#Python spawn interactive ssh shell code#

I was still able to leverage the command injection to compromise not just the server, but the entire infrastructure it was running on. ICMP, and all TCP/UDP ports including DNS were blocked outbound. If the output didn't match this parsing, no output to me. The page was expecting directory listing style output, which was then parsed and reformatted. While developer-provided webshells are always nice, there were a few caveats. There was a page, running in Java, that allowed me to type arbitrary commands into a form, and have it execute them. Recently I came across an interesting command injection vector on a web application sitting on a client's internet-facing estate. #print(stdout.Many times while conducting a pentest, I need to script something up to make my life easier or to quickly test an attack idea or vector. Stdout, stderr = municate() # retrieve outputs form the process Proc = sp.Popen(ssh_cmd, stdin=sp.PIPE, stdout=sp.PIPE, stderr=sp.PIPE) municate() # now the output will start coming out Time.sleep(5) # nothing happens for these 5 seconds It should be used for just sending some fixed input to a process, calling communicate() and then retrieving the resulting output.ĭemos Using subprocess import subprocess as sp The bottom line is that subprocess.Popen is not meant to be used for an interactive dialog. The real problem is that you need to call municate(), which is needed to send the results of all the writes you did to proc.stdin to the actual process and to retrieve the output the process did to stdout and stderr.

I don't see an import statement for that so this suggests you are running Python 2, so I am not sure why you were trying to do the conversion from a string to bytes to begin with. The only method raw_input in Python 3 I know is from class code.InteractiveConsole. The expression you used, b'%s ' % stdin, where stdin is a str, should throw an exception unless you are running Python 2, in which case there is no real difference between a str and a byte. The will use the system default encoding, which is usually UTF-8. If you are running Python 3, then to convert the string returned by raw_input to bytes, you need to encode it with: stdin.encode().

#Python spawn interactive ssh shell code#

To answer code 'What's wrong with the original?', I would say there could be a couple of things:

select and poll always say that proc.stdout is 'ready' for reading regardless of whether or not () will actually work.Įdit: code here is python2.7 but solutions for python3 would be fine too.Įdit: using municate() isn't an option here as that waits for the process to finish, and I want to keep reading/writing to it.

() works if there is one line of data ready, but proc.stdout doesn't return '' when empty so there's no way to read through it, and if there's no data it blocks.

() doesn't work as it never returns EOF, so it blocks.

Ssh_cmd = ['ssh', '-tt', = sp.Popen(ssh_cmd, stdin=sp.PIPE, stdout=sp.PIPE, stderr=sp.PIPE)

What I've tried always starts with: import subprocess as sp I'm trying to control an interactive ssh session from python - so not running ssh command (which there are loads of answers for) but ssh then writing to/reading from that ssh session from Python.