《python黑帽子》源码二，创建一个TCP代理

环境python3.5，win10

实现代码

import sys
import socket
import threading
import binascii

def server_loop(local_host,local_port,remote_host,remote_port,receive_first):
    """
     作为一个服务器，与客户端和目标主机进行交互
    :param  local_host      服务端地址
    :param  local_port      服务端端口
    :param  remote_host     远程主机地址
    :param  remote_port     远程主机端口
    :param  receive_first   是否接受连接时远程主机自动发送的数据
    """
    server = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    try:
        server.bind((local_host,local_port))
    except:
        print("[!!] Failed to listen on %s:%d" % (local_host,local_port))
        print("[!!] Check for other listening sockets or correct permissions.")
        sys.exit(0)

    print("[*] Listening on %s:%d" % (local_host,local_port))
    server.listen(5)
    while True:
        client_socket,addr = server.accept()
        print(" [==>] Received incoming connection from %s:%d" % (addr[0],addr[1]))
        # 开启线程处理一个客户端连接
        proxy_thread = threading.Thread(target=proxy_handler,args=(client_socket,remote_host,remote_port,receive_first))
        proxy_thread.start()

def main():
    """
     主函数
    """
    # 命令解析，有误将不再往下执行，而是弹出帮助信息
    if len(sys.argv[1:]) != 5:
        print("Usage:   ./proxy.py [localhost] [localport] [remotehost] [remoteport] [receive_first]")
        print("Example: ./proxy.py 127.0.0.1 9000 10.12.132.1 9000 True")
        sys.exit(0)

    # 本地监听
    local_host = sys.argv[1]
    local_port = int(sys.argv[2])
    # 远程监听
    remote_host = sys.argv[3]
    remote_port = int(sys.argv[4])

    # 告诉代理在发送给远程主机之前连接和接受数据
    receive_first = sys.argv[5] # 'True'  
    if "True" in receive_first:
        receive_first = True
    else:
        receive_first = False
    
    # 现在设置好监听socket
    server_loop(local_host,local_port,remote_host,remote_port,receive_first)

def proxy_handler(client_socket,remote_host,remote_port,receive_first):
    """
     代理的主体逻辑
    :param  client_socket   连接客户端套接字
    :param  remote_host     远程主机地址
    :param  remote_port     远程主机端口
    :param  receive_first   是否接受连接时远程主机自动发送的数据  
    """
    # 连接远程主机
    remote_socket = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    remote_socket.connect((remote_host,remote_port))
    # 如果必要从远程主机接受数据
    if receive_first:
        remote_buffer = receive_from(remote_socket)
        
        hexdump(remote_buffer)

        # 发送给我们的响应处理
        remote_buffer = response_handler(remote_buffer)
        if len(remote_buffer):
            print("[<==] sending %d bytes to localhost." % len(remote_buffer))
            client_socket.send(str.encode(bytes.decode(remote_buffer)))
        
        # 现在我们从本地循环读取数据，发送给远程主机和本地主机
    while True:
        # 从本地读取数据
        local_buffer = receive_from(client_socket)
        if len(local_buffer):
            print("[==>] Received %d bytes from localhost." % len(local_buffer))
            hexdump(local_buffer)
            # 发送给我们的本地请求
            local_buffer = request_handler(local_buffer)
            # 向远程主机发送数据
            remote_socket.send(local_buffer)
            print("[==>] Sent to remote.")
        # 接收相应数据
        remote_buffer = receive_from(remote_socket)
        if len(remote_buffer):
            print("[<==] Received %d byte from remote." % len(remote_buffer))
            hexdump(remote_buffer)
            remote_buffer = response_handler(remote_buffer)
            client_socket.send(remote_buffer)
            print("[<==] Sent localhost")
        # 如两边都没有数据 关闭连接
        if not len(local_buffer) or not len(remote_buffer):
            client_socket.close()
            remote_socket.close()
            print("[*] No more data. Closing connections")
            break

def hexdump(src,length=16):
    """
     输出数据包的十六进制和可打印的ASCll码字符
    :param src      原数据
    :param length   转换进制
    """
    result = []
    digits = 4 if isinstance(src,str) else 2
    for i in range(0,len(src),length):
        s = src[i:i+length]
        hexa = ' '.join(["%0*x" % (digits,(x))for x in s])
        text = ''.join([chr(x) if 0x20 <= x < 0x7F else '.' for x in s])
        result.append("%04x %-*s %s" % (i,length*(digits + 1), hexa, text))
    print('\n'.join(result))

def receive_from(connection):
    """
     接受数据
    :param connection   套接字连接
    :return 解码好的数据
    """
    buffer = ""

    # 设置两秒的超时时间
    connection.settimeout(2)
    try:
        # 持续从缓冲中读取数据直到没有数据或者超时
        while True:
            data = connection.recv(4096)
            if not data:
                break
            data = bytes.decode(data)
            buffer += data
            buffer = str.encode(buffer)
    except:
        pass
    return buffer

def request_handler(buffer):
    """
     对目标是远程主机的请求进行修改
    """
    return buffer

def response_handler(buffer):
    """
     对目标是本地主机的响应进行修改
    """
    return buffer

main()

测试

我先在VMware安装了win7然后开启了FTP服务进行测试的，开启FTP服务器后就可以不用管了，不过首先你的物理主机能访问这个FTP服务器

以管理员权限运行cmd运行上面代码文件

python agtcp.py 127.0.0.1 21 192.168.43.128 21 True

127.0.0.1 21是作为带来TCP服务器监听的主机和端口号，192.168.43.128 21 是FTP的IP和端口号

然后我再打开一个cmd，敲上 ftp 127.0.0.1   发送连接FTP服务器的请求

当代理TCP从127.0.0.1接受到FTP连接请求后便将该请求转发给 192.168.43.128，然后 192.168.43.128又发回消息等，就是这么个过程

代理TCP运行：

客户端连接FTP：