Kicking the Tires Now let’s play around with it a bit to see some output. In one terminal or cmd.exe shell, run our script like so: justin$ ./bhnet.py -l -p 9999 -c
Now you can fire up another terminal or cmd.exe, and run our script in client mode. Remember that our script is reading from stdin and will do so until the EOF (end-of-file) marker is received. To send EOF, hit CTRL-D on your keyboard: justin$ ./bhnet.py -t localhost -p 9999 <CTRL-D> <BHP:#> ls -la total 32 drwxr-xr-x 4 justin staff 136 18 Dec 19:45 . drwxr-xr-x 4 justin staff 136 9 Dec 18:09 .. -rwxrwxrwt 1 justin staff 8498 19 Dec 06:38 bhnet.py -rw-r--r-- 1 justin staff 844 10 Dec 09:34 listing-1-3.py <BHP:#> pwd /Users/justin/svn/BHP/code/Chapter2 <BHP:#>
You can see that we receive back our custom command shell, and because we’re on a Unix host, we can run some local commands and receive back some output as if we had logged in via SSH or were on the box locally. We can also use our client to send out requests the good, old-fashioned way: justin$ echo -ne "GET / HTTP/1.1\r\nHost: www.google.com\r\n\r\n" | ./bhnet. py -t www.google.com -p 80 HTTP/1.1 302 Found Location: http://www.google.ca/ Cache-Control: private Content-Type: text/html; charset=UTF-8 P3P: CP="This is not a P3P policy! See http://www.google.com/support/ accounts/bin/answer.py?hl=en&answer=151657 for more info." Date: Wed, 19 Dec 2012 13:22:55 GMT Server: gws Content-Length: 218 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.ca/">here</A>. </BODY></HTML> [*] Exception! Exiting. justin$
There you go! It’s not a super technical technique, but it’s a good foundation on how to hack together some client and server sockets in Python and use them for evil. Of course, it’s the fundamentals that you need most: use your imagination to expand or improve it. Next, let’s build a TCP proxy, which is useful in any number of offensive scenarios.