🥇A Small Backdoor on Flask or How to Control Computers on a Local Network

Hello, Habr!

Recently, I watched a downloaded version of the programming stream "How to Create Your Own Web Application on Flask". I decided to reinforce my knowledge with a project. I struggled to find an idea until I thought, "Why not create a mini backdoor using Flask?"

As soon as I had the idea, various implementation possibilities for the backdoor came to mind. I decided to immediately compile a list of its capabilities:

Ability to open websites
Access to the command line
Ability to open programs, photos, videos

So, the first point can be easily implemented using the webbrowser module. I decided to implement the second point using the os module. The third point will also use the os module, but I will utilize "links" (more on that later).

Writing server

So, *drumroll please*, here’s the entire server code:

from flask import Flask, request
import webbrowser
import os
import re

app = Flask(__name__)
@app.route('\/mycomp', methods=['POST'])
def hell():
    json_string = request.json
    if json_string['command'] == 'test':
        return 'The server is running and waiting for commands...'
    if json_string['command'] == 'openweb':
        webbrowser.open(url='https:\/\/www.'+json_string['data'], new=0)
        return 'Site opening ' + json_string['data'] + '...'
    if json_string['command'] == 'shell':
        os.system(json_string['data'])
        return 'Command execution ' + json_string['data'] + '...'
    if json_string['command'] == 'link':
        links = open('links.txt', 'r')
        for i in range(int(json_string['data'])):
            link = links.readline()
        os.system(link.split('>')[0])
        return 'Launch ' + link.split('>')[1]
if __name__ == '__main__':
    app.run(host='0.0.0.0')

I’ve shared all the code; now it's time to explain its essence.

The entire code runs on the local computer on port 5000. To interact with proxy server we need to send a JSON POST request.

The structure of the JSON request:

{‘command’:  ‘comecommand’, ‘data’: ‘somedata’}

Well, it’s logical that ‘command’ is the command we want to execute. ‘data’ is the command's arguments.

You can write and send JSON requests to interact with the server manually (requests library is there to help you). Alternatively, you can create a console client.

Writing the client

Code:

import requests

logo = ['nn',
        '******      ********',
        '*******     *********',
        '**    **    **     **',
        '**    **    **     **      Written on Python',
        '*******     **     **',
        '********    **     **',
        '**     **   **     **      Author: ROBOTD4',
        '**     **   **     **',
        '**     **   **     **',
        '********    *********',
        '*******     ********',
        'nn']

p = ''
iport = '192.168.1.2:5000'
host = 'http://'+iport+'/mycomp'

def test():
    dict = {'command': 'test', 'data': 0}
    r = requests.post(host, json=dict)
    if r.status_code == 200:
        print (r.content.decode('utf-8'))

def start():
    for i in logo:
        print(i)

start()
test()

while True:
    command = input('>')
    if command == '':
        continue
    a = command.split()
    if command == 'test':
        dict = {'command': 'test', 'data': 0}
        r = requests.post(host, json=dict)
        if r.status_code == 200:
            print (r.content.decode('utf-8'))
    if a[0] == 'shell':
        for i in range(1, len(a)):
            p = p + a[i] + ' '
        dict = {'command': 'shell', 'data': p}
        r = requests.post(host, json=dict)
        if r.status_code == 200:
            print (r.content.decode('utf-8'))
        p = ''
    if a[0] == 'link':
        if len(a) > 1:
            dict = {'command': 'link', 'data': int(a[1])}
            r = requests.post(host, json=dict)
            if r.status_code == 200:
                print (r.content.decode('utf-8'))
        else:
            print('The command does not contain arguments!')
    if a[0] == 'openweb':
            if len(a) > 1:
                dict = {'command': 'openweb', 'data': a[1]}
                r = requests.post(host, json=dict)
                if r.status_code == 200:
                    print (r.content.decode('utf-8'))
            else:
                print('The command does not contain arguments!')
    if a[0] == 'set':
        if a[1] == 'host':
            ip = a[2] + ':5000'
    if command == 'quit':
        break

Explanations:

First, the requests module is imported (for interaction with the server). Then, the start and test functions are defined. After that, there is a loop where the magic happens. Have you read the code? Then the meaning of the magic occurring in the loop is clear to you. Enter a command – it will be executed. Shell – commands for the command line (the logic is intense).

Test – checks if the server (backdoor) is working.
Link – using a "shortcut".
Openweb – opening a website.
Quit – exit the client.
Set – set your computer's IP in the local network.

Now let’s go into detail about link.

Next to the server is the link.txt file. It contains links (full paths) to files (videos, photos, programs).

The structure is as follows:

full_path>description full_path>description

Summary

We have a backdoor server to control the computer in the local network (inside the Wi-Fi network). Technically, we can run the client from any device that has a Python interpreter.

P.S. I added the set command so that if the computer in the local network is assigned a different IP, it could be changed directly in the client.

Source: habr.com

A Small Backdoor on Flask or How to Manage a Computer in a Local Network

Summary