I'm reading a book called ( Black Hat Python: Python Programming for Hackers and Pentesters
Book by Justin Seitz)
and I'm doing a project from the book called Replacing Netcat , basically an attempt to replace netcat with a python script ,
I wrote the code identical to the book but its not running properly,,,
** I mean I had to make some obvious changes , cause the book is using python 2.7 , and I'm using Python 3.9.12**
but the code isn't working as it should , according to the book,,,,
this is how the book is telling me to run the code ::- how the book tells me to run the script
me trying to run the code 1st step
me trying to run the code 2nd step
as u can see it gives no output ,, if I try to run it according to the book
and just print's the strings and stops when I write "python3 file_name.py" 2
and stops , it doesn't even execute a single function after that, what am I doing wrong ?
import sys
import socket
import getopt
import threading
import subprocess
# global variables that we fooking need .
listen = False
command = False
upload = False
execute = ""
target = ""
upload_dest = ""
port = 0
def usage():
print ("BHP Net Tool")
print()
print ("Usage: bhpnet.py -t target_host -p port")
print ("""-l --listen - listen on [host]:[port] for ¬
incoming connections""")
print ("""-e --execute=file_to_run - execute the given file upon ¬
receiving a connection""")
print ("-c --command - initialize a command shell")
print ("""-u --upload=destination - upon receiving connection upload a ¬
file and write to [destination]""")
print()
print()
print ("Examples: ")
print ("bhpnet.py -t 192.168.0.1 -p 5555 -l -c")
print ("bhpnet.py -t 192.168.0.1 -p 5555 -l -u=c:\\target.exe")
print ("bhpnet.py -t 192.168.0.1 -p 5555 -l -e=\"cat /etc/passwd\"")
print ("echo 'ABCDEFGHI' | ./bhpnet.py -t 192.168.11.12 -p 135")
sys.exit(0)
def main():
global listen
global port
global execute
global command
global upload_dest
global target
if not len(sys.argv[1:]):
usage()
# read commandline options
try:
opts,args = getopt.getopt(sys.argv[1:],"hle:t:p:cu:",
["help", "listen", "execute", "target", "port", "command", "upload"])
except getopt.GetoptError as err:
print(str(err))
usage()
for o,a in opts:
if o in ("-h", "--help"):
usage()
elif o in ("-l", "--listen"):
listen = True
elif o in ("-e", "--execute"):
execute = a
elif o in ("-c", "commandshell"):
command = True
elif o in ("-u", "--upload"):
upload_dest = a
elif o in ("-t", "--target"):
target = a
elif o in ("-p", "--port"):
port = int(a)
else:
assert False, "Unhandled Option"
#are we going to listen or just send data from stdin ?
if not listen and len(target) and port > 0 :
#read in buffer from the commandline
#this will block , so send CTRL-D if not sending input
#to stdin
buffer = sys.stdin.read()
# send data off
client_sender(buffer)
# we are going to listen and potentially
# upload things , execute commands , and drop a shell back
# depending on our command line options above
if listen:
server_loop()
main()
def client_sender(buffer):
client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
# connect to out target host
client.connect((target,port))
if len(buffer):
client.send(buffer)
while True:
# now wait for back
recv_len = 1
response = ""
while recv_len:
data = client.recv(4096)
recv_len = len(data)
response += data
if recv_len < 4096:
break
print(response)
# wait for more input
buffer = input("")
buffer += "\n"
# send it off
client.send(buffer)
except:
print("[*] Exception ! Exiting.")
# tear down the connection
client.close()
def server_loop():
global target
#if no target is defined, we listen on al interfaces
if not len(target):
target = "0.0.0.0"
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind((target,port))
server.listen(5)
while True:
client_socket, addr = server.accept()
# spin off a thread to handel our new client
client_thread = threading.Thread(target=client_handler, args = (client_socket,))
client_thread.start()
def run_command(command):
# trim the newline
command = command.rstrip()
# run the command and get the output back
try:
output = subprocess.check_output(command,stderr = subprocess.STDOUT, shell=True)
except:
output = "Failed to execute command.\r\n"
#send the output back to the client
return output
def client_handler(client_socket):
global upload
global exceute
global command
# check for upload
if len(upload_dest):
# read in all of the bytes and write to our destination
file_buffer = ""
#keep reading data until none is available
while True:
data = client_socket.recv(1024)
if not data:
break
else:
file_buffer += data
# now we take these bytes and try to write them out
try:
file_descriptor = open("upload_dest", "wb")
file_descriptor.write(file_buffer)
file_descriptor.close()
# acknowledge that we wrote the file out
client_socket.send(f"Succesfully saved file to {upload_dest}")
except:
client_socket.send(f"Failed to save file to \r\n{upload_dest}")
# check for command execution
if len(execute):
# run the command
output = run_command(execute)
client_socket.send(output)
# now we go into another loop if a command shell was requested
if command:
while True:
# show a simple prompt
client_socket.send("<BHP:#>")
# now we recive until we see a linefeed ( enter key )
cmd_buffer = ""
while "\n" not in cmd_buffer:
cmd_buffer += client_socket.recv(1024)
# send back the command output
response = run_command(cmd_buffer)
# send back the response
client_socket.send(response)
How is your debugging skill?
I was experiencing the same issue afew days ago & i fixed it by debugging entry points into functions to keep track of the eip while the program is running by printing arguments before any operation as they are being passed between functions .. this helps to check whether the code is producing expected values as it runs ..
in short as this case , the book was written in regards to python2 so most of the errors are going to force you to work on your debugging skills..
i would also advice you to take a short crash course in C programming before taking on the BHP book since alot of system calls like socket getopts are really C apis , check on man 2 and man 3 of whatever you're importing in python to have a broader look on things as you debug most errors ..
managed to fix it up until here ..
download source code link
https://filebin.net/i40e2oisabxqmbys
Related
I'm working with Python on my PC, sending serial commands to an arduino which controls a certain number of stepper motors.
However, in this function:
# takes array of commands to send to motors (in order) and sends commmand arcodinlgy
# each element of commands is an absolute angle (rad) to give to one motor
def send_command(commands):
if not len(commands) > 0:
return
# make command string to send serial
# (with command separator and line termination)
command_string = "";
for i in range(len(commands) - 1):
command_string += f"{commands[i]:.4f}{COMMAND_SEPARATOR}"
command_string += f"{commands[-1]:.4f}{LINE_TERMINATOR}"
# make command string into bytes UTF-8
# print(command_string)
command_string = bytes(command_string, "utf-8")
# send command string serial
print(f"Sending command: " + str(command_string))
port.write(command_string)
# wait for arduino's return_code on serial
while True:
if port.inWaiting() > 0:
return_code = int(port.readline())
return return_code
# driving code
while True:
commands = [0, 0]
commands[0] = float(input("command 1: "))
commands[1] = float(input("command 2: "))
return_code = send_command(commands)
print(f"return code: {return_code}")
This code works correctly, but if I don't want user input for the commands :
while True:
commands = [float(random.random()*pi), float(random.random()*pi)]
# or even the following doesn't work for exemple:
# commands = [3.1415, 0.5555]
return_code = send_command(commands)
print(f"return code: {return_code}")
sleep(1)
This code doesn't.
I don't get why because in the first case, the line print(f"Sending command: " + str(command_string)) prints exactly the same as in the second case :
Sending command: b'3.1415:0.5555\n'
(when input those angles)
But in the second case, no return code is received, and the function doesn't work.
I tried totally hardcoding the values given.
I implemented that the commands are always formated the same way, and always converted with float() (before the print("Serial command... line.
So I expected the same behavior for the two codes, and I don't see what changes between the two (since the print("Serial command ... line gives the same and is the last line before the command is sent over serial
Thanks !
Try to add logging to receiving part.
Replace this:
while True:
if port.inWaiting() > 0:
return_code = int(port.readline())
return return_code
With this:
import time
while True:
if port.inWaiting() > 0:
print(f"Received {port.inWaiting()} bytes.")
return_code = int(port.readline())
return return_code
print("Nothing received yet.")
time.sleep(0.1)
Maybe your Arduino does not response for request, and you just waiting for the response in infinite loop.
You can also add timeout for response, so after some time if there was no response method send_command(commands) will just return None.
Found the problem :
After every new serial connection, the Arduino resets.
When it resets, it need a little time to start the loop() function !
So when I was entering my commands manually, I gave it a little time without noticing, but when the commands were generated inside my Python code, the first command was sent so quickly that it wasn't interpreted by the Arduino, and the function didn't get a return code from the Arduino !
2 ways to solve the problem:
1. Adding a timeout
TIMEOUT = 2
TIMEOUT_ACTIVE = True
def send_command(commands):
### same code as above ###
port.write(command_string)
# wait for arduino's return_code on serial WITH TIMEOUT
init_time = time()
while (not TIMEOUT_ACTIVE) or (time() - init_time) <= TIMEOUT:
if port.inWaiting() > 0:
return_code = int(port.readline())
return return_code
2. Waiting before sending the first command
waiting 2 seconds (tested 1 seconds, was not enough) before begining to send commands
sleep(2)
while True:
commands = [float(random.random()*pi), float(random.random()*pi)]
return_code = send_command(commands)
print(f"return code: {return_code}")
# don't need the sleep(0.1) anymore
I am writing a program in python to scan the ports of the host and tell how many of them are open, show the time taken & have also added error handling...
This code is working fine but the problem is it is taking too long to scan all the ports (im talking about the time its taking to generate the full output) like it did not even complete in 1hr, is this normal? or what's wrong here.
secondly, I want the output of this program in a text file... I have tried several methods but none of them did work, one of the methods I tried is written at the end of the code in comment. Any help would be greatly appreciated. Thanks, in advance!
Here's the source code:
#!/usr/bin/env python
import socket
import subprocess
import sys
from datetime import datetime
# Clear the screen
subprocess.call('clear', shell=True)
# Ask for input
remoteServer = input("Enter a remote host to scan: ")
# Using the range function to specify ports (here it will scans all ports between 1 and 1024)
# We also put in some error handling for catching errors
try:
remoteServerIP = socket.gethostbyname(remoteServer)
# Prints a banner with info on which host we are about to scan
print ("-" * 60)
print ("Please wait, scanning remote host", remoteServerIP)
print ("-" * 60)
# Check what time the scan started
t1 = datetime.now()
for port in range(1,1025):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
result = sock.connect_ex((remoteServerIP, port))
if result == 0:
print ("Port {}: Open".format(port))
sock.close()
except KeyboardInterrupt:
print ("You pressed Ctrl+C")
sys.exit()
except socket.gaierror:
print ('Hostname could not be resolved. Exiting')
sys.exit()
except socket.error:
print ("Host is not available")
sys.exit()
# Checking the time again
t2 = datetime.now()
# Calculates the difference of time, to see how long it took to run the script
total = t2 - t1
# Printing the information to screen
print ('Scanning Completed in: ', total)
'''#Text file
f = open('Hostreport.txt', 'a')
print(port,file=f)
f.close()'''
Two common ways to write simple text to a file in python:
with open('/tmp/foo.txt', 'w') as f:
f.write('first line\n')
f.write('second line\n')
Using open as a context manager means it's only valid within the block and python automatically takes care of ensuring it's properly closed at the end.
Or the classic way:
f = open('/tmp/bar.txt', 'w')
f.write('first line\n')
f.write('second line\n')
f.close()
I'm working on a script to send a list of commands to a device and return the output.
When the device first boots up, it has a few prompts. I am able to get through the prompts.
However, after completing the prompts, when I try to send a command the command isn't sent.
Commands
The commands.txt is set up like this:
200,
2,no
2,
The first line (200) is to let the device boot up.
The 2nd and 3rd lines answer 2 different prompts.
Issues
The issues come after these 3 inputs. The code runs and completes. Python prints out each of the commands. So the list is processed by Python. However, I don't think the device is receiving the commands.
In the log, the \n and no are written out, but none of the commands after it are. The commands do show when I use ser.inWaiting()
When I access the device through putty and run the commands through the console, everything works as expected.
Why aren't the commands going through?
Small update:
I read somewhere that python may be sending the commands to quickly, so I tried sending the commands 1 char at a time with a .01 delay.
It still didn't work:
for i in lines[1]:
cmd = i
encoded_cmd = cmd.encode("utf-8")
ser.write(encoded_cmd)
sleep(0.1)
print(cmd)
Code
import serial
import time
from time import sleep
from datetime import datetime
# create list of commands
with open('commands.txt') as commands:
list_of_commands = [tuple(map(str, i.split(','))) for i in commands]
# open and name log file
date = datetime.now().strftime("%Y-%m-%d")
log = open(f'{date}.txt', 'w+')
# serial configuration
info = open('info.txt', 'r')
lines = info.readlines()
port = lines[0].strip('\n')
baud = int(lines[1].strip('\n'))
try:
# open port
ser = serial.Serial(port=port, baudrate=baud, timeout=5, parity=serial.PARITY_NONE, stopbits=serial.STOPBITS_ONE, write_timeout=0)
except ConnectionError:
log.write(''.join('There was a connection error'))
else:
# run commands
x = 0
for lines in list_of_commands:
ser.close()
ser.open()
sleep(2)
cmd = lines[1]
encoded_cmd = cmd.encode("utf-8")
sleep_time = int(lines[0])
ser.write(encoded_cmd)
time.perf_counter()
# log output
while 1:
test = ser.readline()
text = test.decode('utf-8')
print(text)
log.write(''.join(text))
print(time.perf_counter())
print(time.perf_counter() - x)
if time.perf_counter() - x > sleep_time:
x = time.perf_counter()
ser.flushInput()
ser.flushOutput()
break
print(cmd)
# close port
ser.close()
# close files
log.close()
From the question it's obvious that multiple issues are intermingled. The same observation comes when reading the code. So I tried to list some of those I struggled with.
Issues
Try-except-else
What is the intention behind try .. except .. else ?
Not sure, its used correctly on purpose here. See try-except-else explained:
The else clause is executed if and only if no exception is raised. This is different from the finally clause that’s always executed.
The serial connection
Why opening and closing inside the loop:
ser.close()
ser.open()
Why the misleading comment:
# close server
ser.close()
Usage of sleep_time
What is the purpose of using the first column sleep_time of your CSV commands.txt inside a conditional break inside you read-loop?
sleep_time = int(lines[0])
Instead the sleep is fix 2 seconds before sending the command:
sleep(2)
How to debug
I would recommend adding some print (or log) statements to
verify the list_of_commands has been read correctly
verify which commands (cmd or even encoded_cmd) have been sent to the serial output
I'm trying to communicate with a board via serial (rs232) port using PySerial.
The board is a Renesas rl78 and below is my sample code. (Basically what I'm trying here is to execute some pre-defined commands. So here commands is again a command that returns a list of other commands)
import serial, time, io
ser = serial.Serial()
ser.port = "/dev/cu.usbserial"
ser.baudrate = 19200 # as used for HyperTerminal
ser.timeout = 10 #non-block of 10 seconds
ser.bytesize = serial.EIGHTBITS
ser.parity=serial.PARITY_NONE
ser.stopbits=serial.STOPBITS_ONE
ser.xonoff = False
ser.rtscts = True
ser.dsrdtr = True
ser.dtr = True
ser.rts = True
try:
ser.open()
except Exception, e:
print "error open serial port: " + str(e)
exit()
if ser.is_open:
try:
#ser.reset_input_buffer() #flush input buffer, discarding all its contents
#ser.reset_output_buffer() #flush output buffer, aborting current output
#write data
ser.write(b'commands\r')
ser.reset_input_buffer()
time.sleep(2)
in_wait = ser.in_waiting
while True:
if in_wait != 0:
output = ser.read(in_wait)
print(output)
break
else:
break
ser.close()
except Exception, e1:
print "error communicating...: " + str(e1)
else:
print "cannot open serial port "
And from the device's standpoint, we have to hit return (carriage return \r) in order to execute a command using any terminal application. i.e HyperTerminal or Serial for Mac.
So the above code does not return any output but just an empty string (this is what you get in the terminal when you just hit return (\r)). The device is behaving like it got a return (\r) and the command is completely ignored.
To make sure that it is not an issue with PySerial I tried to use PySerial's miniterm to get this terminal behavior, and I was able to successfully execute the commands
Again the catch here is to set CR as the EOL to get the commands to execute successfully.
python -m serial.tools.miniterm -e --eol=CR
So I'm puzzled here on what is wrong with my code and why it is not executing the commands.
I have a Python routine which invokes some kind of CLI (e.g telnet) and then executes commands in it. The problem is that sometimes the CLI refuses connection and commands are executed in the host shell resulting in various errors. My idea is to check whether the shell prompt alters or not after invoking the CLI.
The question is: how can I get the shell prompt string in Python?
Echoing PS1 is not a solution, because some CLIs cannot run it and it returns a notation-like string instead of the actual prompt:
SC-2-1:~ # echo $PS1
\[\]\h:\w # \[\]
EDIT
My routine:
def run_cli_command(self, ssh, cli, commands, timeout = 10):
''' Sends one or more commands to some cli and returns answer. '''
try:
channel = ssh.invoke_shell()
channel.settimeout(timeout)
channel.send('%s\n' % (cli))
if 'telnet' in cli:
time.sleep(1)
time.sleep(1)
# I need to check the prompt here
w = 0
while (channel.recv_ready() == False) and (w < timeout):
w += 1
time.sleep(1)
channel.recv(9999)
if type(commands) is not list:
commands = [commands]
ret = ''
for command in commands:
channel.send("%s\r\n" % (command))
w = 0
while (channel.recv_ready() == False) and (w < timeout):
w += 1
time.sleep(1)
ret += channel.recv(9999) ### The size of read buffer can be a bottleneck...
except Exception, e:
#print str(e) ### for debugging
return None
channel.close()
return ret
Some explanation needs here: the ssh parameter is a paramiko.SSHClient() instance. I use this code to login to a server and from there I call another CLI which can be SSH, telnet, etc.
I’d suggest sending commands that alter PS1 to a known string. I’ve done so when I used Oracle sqlplus from a Korn shell script, as coprocess, to know when to end reading data / output from the last statement I issued. So basically, you’d send:
PS1='end1>'; command1
Then you’d read lines until you see "end1>" (for extra easiness, add a newline at the end of PS1).