Hello everybody.
And welcome back.
And now let us continue on fixing our reverse shell and server code so we'll start off with server.
As I said we will fix this code a little bit add some functions here and there and we will also add
two functions one for sending data and one for receiving data which will allow us to actually send and
receive as much data as we want as we can see right here.
The result equals target receive 1024 bytes is limited to this if the target output or answer is bigger
than this it might actually make our program crash.
So we want to fix that.
First of all for example for any bigger commands such as gnats that this will not fit in 2010 24 bytes
so let's first start off by actually putting our servers through a function so we will put this part
of the code in our server function so we can actually make it a little bit prettier.
So let's copy this copy.
Let's go all the way down since we will specify it down here and paste the same code then.
Right now what we can do is we can actually delete this so we can delete all of this.
Now I know this isn't a pretty code but trust me it doesn't really matter as long as it works and it's
long as it doesn't break.
So first thing we want to do is first of all separated from the while loop then what we want to do right
now is actually make our function so that server and then we will put all of this in that function so
creating a socket then by setting Socket options then binding the socket all of that should be in the
same function.
We can also print listening for incoming connections and then we can accept the connection as well and
print Target connected.
So you will notice that we also use these these as variable right here in the other commands as well
as or pardon me not be as variable we use the target variable in the other commands.
So what we want to do is make those variables actually global so we can use it in any other function
we make or in our while loop as well.
If you'll just specify the variable inside the function it will only be used in that function and won't
be recognized outside of the code for that function.
So we need to make those variables to be global so global as global IP since we use IP right here which
is outside of the function and global what's global target.
So Target is also something that we use in order to send and receive the output of the command.
And right now this should be good for the target and for the server function if we need to add anything
else afterwards we will add it now right now you will notice something wrong which is how can we actually
execute this.
So we actually have to call the function in order to execute it so we will do that with server and then
the Open parentheses and close parentheses which will call this function which will execute this function
and which will go down to execute the code.
But the next code as you can see right here is as Dot close or basically as soon as this program starts
it will all.
It will go into the wild to loop first before doing any of this.
So we want to make a function for the while True loop as well.
We will call the function shell.
So first of all let's go upwards.
Let's define that function to be shall we call it simple since Shell is something that we use to execute
the commands and we tab all of this into our shell functions.
Tab it all just once.
So it looks good and this should be it.
Now you might notice that we didn't call the shell command so we have to call it down there.
We have to call it after the server command so we can't actually execute the commands before the target
connects back to us.
So the server function has to be called first and then the shell function has to be called right after
the server function.
So our shell function when we run indefinitely until the until we as are as an attacker and 30 command
Q which will terminate the connection and which will continue outside of the while loop and we'll go
to the next execution of as close which will close the program and the connection so this should be
it.
I believe everything is set.
Good.
Now you might be asking why doesn't this execute this.
Well basically once you have a code in a function the machine doesn't read the code or the Python doesn't
read this code in a function until the function gets called.
So we have to call it in order to execute this code right here.
So what we want to add as well is two functions that will actually make us able to send and receive
as much data as we want.
So we will code that up.
So to make space and let's call that reliable sense so reliable underscore sent.
And we want to input a data to that function so reliable send will be our command of which we will input
in this function and then we have to add another library which we will use in order to dump that data
and make it send as much as much bytes as it can.
So import Jason is the name of the library that we will use.
So just type upwards import Jason.
And then in our function what you want to do is Jason underscore data we'll call it like that equals
Jason dot numbers which is a function and then we want to use data in that function.
So Jason dumps and then we want to specify data inside the brackets then we want to type our regular
sockets and function which is Target and send and we want to send the adjacent data underscore data.
And this will be our reliable scent which means we can send as much as we want.
So let us actually switch all of our target dot it with the reliable scent so we can see right here
we have the one and only target that sense will just delete that and type here reliable underscore scent
and then we send the command.
So then our command will get put in this function right here and then the adjacent data will take the
value of Jason the dumps of our command then we will send adjacent data to the target.
So right now what we want to do is also code a function that will perform a reliable receive.
Now the reason it's called Reliable is because it will actually receive as much bytes as the target
sends.
So let us call that as well defined which is the short for function reliable underscore receive.
Now you can call these functions anything you want.
I will just call it like this.
And right now what we want to do is actually perform a little bit of a bigger code and for the reliable
send in the reliable receive we do not need to specify anything between the brackets since we are the
ones that are receiving the the results of our command.
So we want to specify a local variable called J some data equals and then the empty string and we want
to run a while to loop in order to actually add the bytes provide so 1024 bytes to another thousand
24 bytes until we run out of bytes.
Well it sounds maybe it maybe sounds problematic but it really is.
And so just type here a while True loop which is an infinite loop and we want to perform something that
we used before which is to try and acceptable.
So it will try something except when it receives an error and we will use the terror in order to continue
so let's try to call this.
So try this should work.
Try Jason underscore data equals Jason underscore data plus target not receive and we want to receive
here thousand twenty four bytes as usual and then after that we want to return the function.
Jason loads of our Jason data and then if that is it if the Jason data is basically a lower than 20
1024 bytes it will return it except it will give us a value error already check this.
So I know that the name of the error where we value error.
So I just type it right here accept value are two dots and then continue why do we specify here continue.
Well basically if we get a value error it means that the that the data that the target sent was larger
than thousand and 24 bytes which means we need to go back to the real true loop and then it will perform
the receiving 1024 bytes once again and it will add it to our variable Jason data which also has the
previous thousand twenty four bytes and it will do that as long as there is some bytes left receive
and as soon as the bytes are no longer left to receive it will just quit right here and it will send
us back all of the bytes that the target sent.
So these are two functions used to send and receive as much data as we want but right now since we coded
the reliable receive we want to change this.
So result equals with three thousand twenty four bytes in our normal function we do not specify anything
in the brackets and result equals reliable receive.
So we will get the result right here and we will.
And we will print the result.
So this should be good.
All should be good.
For now we have the command equals Q Is break.
Else result equals receive reliable receive and then print the result.
Then we go back to the wall to loop and then we get printed for the same command which we sent with
our reliable send comment.
Good.
Let's see down here.
We coded a function server we call the shell function in while True loop.
And we also called and called Reliable receive and reliable send function which we use in our show loop.
Good.
So this should be I believe it for the server so let's close it.
Now let's before we close it actually call two functions since we will use same functions in our client
server problem in our client code which is our or shell.
So we copy this.
We close this and then we now know the reverse shall not be why here.
Let those just paste these two functions right away and we have to actually change a few things in these
functions since we do not have something called target in our client code.
We have to change that into actually SOC.
So as we can see right here in our client code we actually send and receive data with socket that receive
and socket sent.
So we have to change that right here as well.
So it's not targeted sent it is socket or sent.
So let's delete this SOC dot sent and we send adjacent data.
And here we have to type here socket out received since that is what we specified in our client code.
Good.
So we have the functions ready.
All we have to do right now is actually use them in our while to look for a socket that received no
longer we do not longer need that.
We only need reliable not received and we delete the thousand 24 bytes.
Then right here once we send the result we do not need to socket send we can use reliable underscore
sent and we send the result but right here let us also run our simple functions.
So this code looks a little bit prettier.
What we want to do is let's actually create
known here
what we want to do is also on our while to create a shock shower function.
So while the truth will be put in our shall function defined shall we will call it same as in our server
code and all we have to do is just tab all of our code so tab with this tab this tab this tab and just
do same with all of these.
Code now that we have shall function we have to call it.
But before we call it we actually have to perform the connection.
So let's actually copy this upper code below all of these functions right here.
So copy this.
Then we can delete this and will paste it at the end of our code.
So it actually goes through all of our functions before executing that code and we paste it right here
so we paste the same code.
Yes it was upper.
So let's see if this will work.
SOC equals socket socket socket.
Therefore I know that.
OK.
We connect.
We print connection established to server and then we can run our shell from here and then we enter
div all true loop which makes us execute the commands on target.
P.S. so we have the reliable central rival received function.
And right now I believe we should be good to go.
But before we actually save this program and run it.
Let's run a simple try and accept rule for executing the command on target server on target machine.
So right here this is the part of the code where we actually execute the command that we get from the
server and send the result back to the server.
Here we want to run a simple try and acceptable for the commands that can be run so try.
We want to try to execute the command.
We want to try to do all of this and then send the command back to us and then accept.
So for every time a command can be executed for some reason or target machine we will want to make and
try and accept also our code doesn't break.
So for every command that can be run we want to reliable send or sent to our target machine reliable
reliable underscore sent open brackets.
Let's make it like this.
Can't execute that command.
We can do it like this or we can put this string in a variable and then prompted to the reliable send.
But we can also do it simply like this just by sending a string to our reliable send function.
It is the same as if we actually took this string put it in a variable and then printed on and then
put the variable between these brackets.
So this should work if you ask me for non let's just save this right here exit and then let's first
of all check out the server before we run it.
We have reliable sand the shell function the server function.
OK.
Let's run the server.
Right now we are listening for the incoming connections.
So let's open another window.
You zoom in.
Let's put this so we can see both of the windows.
Let's go to the White on reverse.
And then we run or let's clear the screen first and then we run the reverse.
Sheldon P Y.
So the connection established well right now.
So we know that on our server the connection or the server function was executed and we went into our
shell function which prompted us for executing command.
So let's type your l s and something right here
something right here doesn't work so let's see what.
Here we can have.
Oh yes.
In our reverse shell cause we didn't import the Jason library so let's close this immediately.
This terminal in order for us to use these functions right here as we did in the server code we need
to import the Jason library so we can use these functions Jason dumps Jason that load loads right here
we need to have that library so we can use those functions otherwise that normal our code will not recognize
them.
So import Jason then let's say this once again close this Let's open another terminal
enlarge this right here you zoom in make this a little bit smaller.
Go to the Python and reverse run our server once again run our reverse shell and then execute our last
comment so we can see we successfully executed our reverse reliable send and reliable reliability comment
received comments so everything works perfectly for now.
So let's see who am I and what if I type here and instead that A.P. for example we get everything right
here clear it clears the screen since we actually cleared the screen of our terminal where my p WD I
know we can try I have config so we get output of all of these commands back to us also if you type
your enter as you can see right now it doesn't actually hang on the code and we can still execute the
commands if at I point I can still get the result of the commands.
That's why that's because we implemented that try and accept rule on executing the command.
You try it tried executing nothing as a command and it didn't work.
So it actually skipped right to it.
So we can try executing something that doesn't exist or let me just see so we can get prompted can't
execute that command.
Let's see dear OK so the works as well right here well I believe we will get to that.
Sometimes it doesn't really matter what matters is that our code now works we can execute all the commands
we can just print out yes to list running processes we can print working directory we can do anything
we want we can create directory same Kadir test and they put up here last once again we can see there
is another directory right now called test in our file folder.
So that's good to know.
Now let's see if the queue option works as well so we type your queue and we can see both programs closed
without any error which is good.
And right now if I type your class you can see it we still have the test directory.
So I will just remove it since we don't really need it and right now we have a working reverse shell
and server that by which can be used to execute sys commands on target but there are still some things
that don't work here such as changing our directory.
For example if I tried to change my directory I won't be able to.
We will see how we can actually fix that as well.
And then we will start adding some more functions and some more available things for our reverse shell.
So that'll be about it for this video.
I hope you enjoyed it and I hope I see you in the next one.
Bye.