I want to write a reverse shell like netcat. Everything works fine, but after several commands typed in, the client machine throws an error. I managed to identify the problem. When I change to the Desktop directory on the server, for example C:/Users/Desktop and I type in the command "dir" the error gets thrown on the client machine.

Note that open_shell is a boolean that I set to True with passing an argument to the program

server code:

'''creates server'''
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.connect((target, port))
print(f"[*] Connecting to client ...", os.linesep)
client_msg = server.recv(buffer_size).decode()
print("[*] current directory: ", client_msg)

# opening a reverse shell to client
if open_shell:
    server.send("open shell".encode())
    print(server.recv(buffer_size).decode())
    while True:
        command = input(">>")
        if command.lower() == "exit":
            print("[*] Closing connection ...")
            break
        if not command.strip():
            continue
        else:
            server.send(command.encode())
        output = server.recv(buffer_size).decode()
        print(output)

client code:

'''creates client'''
global target
if not len(target):
    target = "0.0.0.0"

client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
client.bind((target, port))
client.listen(5)
client_socket, addr = client.accept()
print("[*] Connected to server ...")

cwd = os.getcwd()
client_socket.send(cwd.encode())

command = client_socket.recv(buffer_size).decode()
    if command.lower() == "exit":
        print("[*] Connection closed by server ...")
        break
    if command.lower() == "open shell":
        client_socket.send("[*] reverse shell established\n[*] To exit reverse shell type in 'exit'".encode())
        while True:
            execute = client_socket.recv(buffer_size).decode()
            if execute.lower() == "exit":
                break
            message = run_command(execute) # executes command on client
            client_socket.send(message.encode())

The error is located in the process module in the function "communicate" but I can't figure out wants going on.

Error:

Traceback (most recent call last):
  File "netcat.py", line 200, in <module>
    main()
  File "netcat.py", line 195, in main
    client_object()
  File "netcat.py", line 122, in client_object
    message = run_command(execute) # executes command on client
              ^^^^^^^^^^^^^^^^^^^^
  File "netcat.py", line 33, in run_command
    output = subprocess.getoutput(command)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "Python\Python311\Lib\subprocess.py", line 689, in getoutput
    return getstatusoutput(cmd, encoding=encoding, errors=errors)[1]
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "Python\Python311\Lib\subprocess.py", line 669, in getstatusoutput
    data = check_output(cmd, shell=True, text=True, stderr=STDOUT,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "Python\Python311\Lib\subprocess.py", line 465, in check_output
    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "Python\Python311\Lib\subprocess.py", line 548, in run
    stdout, stderr = process.communicate(input, timeout=timeout)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "Python\Python311\Lib\subprocess.py", line 1192, in communicate
    stdout = self.stdout.read()
             ^^^^^^^^^^^^^^^^^^
  File "Python\Python311\Lib\encodings\cp1252.py", line 23, in decode
    return codecs.charmap_decode(input,self.errors,decoding_table)[0]
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
UnicodeDecodeError: 'charmap' codec can't decode byte 0x81 in position 323: character maps to <undefined>

CodePudding user response：

Before starting Python, set your environment variable PYTHONIOENCODING=utf-8.