如何通过开放外壳端口使用python套接字访问Metasploitable 2 VM外壳？

Question

I just trying to learn penetration test tools like nmap, netcat etc. now and I'm testing this tools on my Metasploitable 2 VM.When I scanned my Metasploitable machine's port, I saw there is Metasploitable root shell(1524) open port:

1524/tcp open shell Metasploitable root shell

When I connect to port 1524 with simple netcat tcp connection, I accessed my Metasploitable 2 VM's shell immediately:

root@kali:~# netcat 10.0.2.4 1524

root@metasploitable:/#

It was very easy even for me and I thought I can connect to the my Metasploitable 2 VM via python socket but, it was not as easy as I thought.

import sys
import socket
import subprocess

host = '10.0.2.4' # Metasploitable 2 VM's IP
port = 1524 # Metasploitable root shell
sock = socket.socket()
try:
    sock.connect((host, port))
except Exception as err:
    print(err)

while True:
    data = sock.recv(1024)
    cmd = input('root@nonkali:#> ')
    if cmd == 'quit':
        sock.close()
        sys.exit()
    if cmd:
        command = subprocess.Popen(data.decode('utf-8'), shell=True, stderr=subprocess.PIPE, stdout=subprocess.PIPE, stdin=subprocess.PIPE)
        outs = command.stdout.read() + command.stderr.read()
        str_outs = str(outs, 'utf-8')
        sock.send(cmd.encode())
        print(str_outs)

sock.close()

Output:

root@nonkali:#> ls

/bin/sh: 1: root@metasploitable:/#: not found

ls


ls

^CTraceback (most recent call last):

  File "Python/tcp_client.py", line 15, in <module>

    data = sock.recv(4096)

KeyboardInterrupt

I tried some bunch of codes like this but I never access my VM's shell. I still don't know what am I doing wrong.I need a bit help.Actually, I want to understanding difference between netcat 10.0.2.4 1524 and python socket connection.

Answer 1

I'll provide two ways of doing it, that both worked for me. I tried the following on ubuntu 17.10 (with python 2.7.14 ). The first one is using sockets and establishing a TCP connection . The code snippet is the following:

#!/usr/bin/env python

import sys
from socket import *

def nc(host, port):
    s = socket(AF_INET, SOCK_STREAM) # TCP client
    s.connect((host, port))
    try:
        while 1:
            mydata = raw_input("root@root:#> ")
            if mydata.strip()!='':
                s.sendall(str(mydata))
                data = s.recv(1024)
                print data
    except KeyboardInterrupt:
        s.close()
        sys.exit(0)

if __name__ == '__main__':
    host = '...'
    port = 11111
    nc(host, port)

This gave me the following output:

$ ./test.py
root@root:#> ls
file1
testfile.zip
testfile3

root@root:#> whoami
testuser

root@root:#> 

The other way as I said in the comments is by using pwntools . The script is the following:

from pwn import *

p = remote(host,port)
p.interactive()

This will work also. The main difference between the two scripts is that the first script is a native python socket-based implementation (use standard libraries only) while the other way even if its easier depends on pwntools framework and doesn't mess with low-level socket programing. Actually both scripts are nothing more than just a simple TCP-client implementation.

Answer 2

I guess,I found my problem: Threading! I don't know exactly how works threading but,I implemented threading module to my code and It works well now.

#!/usr/bin/python3.6

import sys
import socket
import threading

def tcp_connect(host, port):
    global sock
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((host, port))
        interact()
    except Exception as err:
        print(err)
        sys.exit()

def recv():
    while True:
        try:
            data = sock.recv(1024)
            sys.stdout.write(data.decode('utf-8'))
            sys.stdout.flush()
        except Exception as err:
            print(err)
            sock.close()
            sys.exit()

def interact():    
    th = threading.Thread(target=recv)
    th.start()
    try:
        while True:
            cmd = sys.stdin.read(1)
            sock.send(cmd.encode())
        print('Connection closed.')
        sock.close()
        sys.exit()
    except KeyboardInterrupt:
        sock.close()
        sys.exit()

if __name__ == '__main__':
    host = '10.0.2.4'
    port = 1524
    tcp_connect(host, port)

And my commands are working:

root@metasploitable:/# id
uid=0(root) gid=0(root) groups=0(root)