Black Hat Python Python Programming for Hackers and Pentesters (Justin Seitz)（Z-Library）
Cybersecurity
When it comes to creating powerful and effective hacking tools, Python is the language of choice for most security analysts. But just how does the magic happen? In Black Hat Python, the latest from Justin Seitz (author of the best-selling Gray Hat Python), you’ll explore the darker side of Python’s capabilities—writing network sniffers, manipulating packets, infecting virtual machines, creating stealthy trojans, and more. You’ll learn how to: –Create a trojan command-and-control using GitHub –Detect sandboxing and automate common malware tasks, like keylogging and screenshotting –Escalate Windows privileges with creative process control –Use offensive memory forensics tricks to retrieve password hashes and inject shellcode into a virtual machine –Extend the popular Burp Suite web-hacking tool –Abuse Windows COM automation to perform a man-in-the-browser attack –Exfiltrate data from a network most sneakily Insider techniques and creative challenges throughout show you how to extend the hacks and how to write your own exploits. When it comes to offensive security, your ability to create powerful tools on the fly is indispensable. Learn how in Black Hat Python. Uses Python 2
8
Views
Registered users can read the full content for free
Register as a Gaohf Library member to read the complete e-book online for free and enjoy a better reading experience.
Page
1
(This page has no text content)
Page
2
Black Hat Python: Python Programming for Hackers and Pentesters Justin Seitz Published by No Starch Press
Page
3
To Pat Although we never met, I am forever grateful for every member of your wonderful family you gave me. Canadian Cancer Society www.cancer.ca
Page
4
About the Author Justin Seitz is a senior security researcher for Immunity, Inc., where he spends his time bug hunting, reverse engineering, writing exploits, and coding Python. He is the author of Gray Hat Python, the first book to cover Python for security analysis.
Page
5
About the Technical Reviewers Dan Frisch has over ten years of experience in information security. Currently, he is a senior security analyst in a Canadian law enforcement agency. Prior to that role, he worked as a consultant providing security assessments to financial and technology firms in North America. Because he is obsessed with technology and holds a 3rd degree black belt, you can assume (correctly) that his entire life is based around The Matrix. Since the early days of Commodore PET and VIC-20, technology has been a constant companion (and sometimes an obsession!) to Cliff Janzen. Cliff discovered his career passion when he moved to information security in 2008 after a decade of IT operations. For the past few years Cliff has been happily employed as a security consultant, doing everything from policy review to penetration tests, and he feels lucky to have a career that is also his favorite hobby.
Page
6
Foreword Python is still the dominant language in the world of information security, even if the conversation about your language of choice sometimes looks more like a religious war. Python-based tools include all manner of fuzzers, proxies, and even the occasional exploit. Exploit frameworks like CANVAS are written in Python as are more obscure tools like PyEmu or Sulley. Just about every fuzzer or exploit I have written has been in Python. In fact, the automotive hacking research that Chris Valasek and I recently performed contained a library to inject CAN messages onto your automotive network using Python! If you are interested in tinkering with information security tasks, Python is a great language to learn because of the large number of reverse engineering and exploitation libraries available for your use. Now if only the Metasploit developers would come to their senses and switch from Ruby to Python, our community would be united. In this new book, Justin covers a large range of topics that an enterprising young hacker would need to get off the ground. He includes walkthroughs of how to read and write network packets, how to sniff the network, as well as anything you might need for web application auditing and attacking. He then spends significant time diving into how to write code to address specifics with attacking Windows systems. In general, Black Hat Python is a fun read, and while it might not turn you into a super stunt hacker like myself, it can certainly get you started down the path. Remember, the difference between script kiddies and professionals is the difference between merely using other people’s tools and writing your own. Charlie Miller St. Louis, Missouri September 2014
Page
7
Preface Python hacker. Those are two words you really could use to describe me. At Immunity, I am lucky enough to work with people who actually, really, know how to code Python. I am not one of those people. I spend a great deal of my time penetration testing, and that requires rapid Python tool development, with a focus on execution and delivering results (not necessarily on prettiness, optimization, or even stability). Throughout this book you will learn that this is how I code, but I also feel as though it is part of what makes me a strong pentester. I hope that this philosophy and style helps you as well. As you progress through the book, you will also realize that I don’t take deep dives on any single topic. This is by design. I want to give you the bare minimum, with a little flavor, so that you have some foundational knowledge. With that in mind, I’ve sprinkled ideas and homework assignments throughout the book to kickstart you in your own direction. I encourage you to explore these ideas, and I would love to hear back any of your own implementations, tooling, or homework assignments that you have done. As with any technical book, readers at different skill levels with Python (or information security in general) will experience this book differently. Some of you may simply grab it and nab chapters that are pertinent to a consulting gig you are on, while others may read it cover to cover. I would recommend that if you are a novice to intermediate Python programmer that you start at the beginning of the book and read it straight through in order. You will pick up some good building blocks along the way. To start, I lay down some networking fundamentals in Chapter 2 and slowly work our way through raw sockets in Chapter 3 and using Scapy in Chapter 4 for some more interesting network tooling. The next section of the book deals with hacking web applications, starting with your own custom tooling in Chapter 5 and then extending the popular Burp Suite in Chapter 6. From there we will spend a great deal of time talking about trojans, starting with GitHub command and control in Chapter 7, all the way through Chapter 10 where we will cover some Windows privilege escalation tricks. The final chapter is about using Volatility for automating some offensive memory forensics techniques. I try to keep the code samples short and to the point, and the same goes for the explanations. If you are relatively new to Python I encourage you to punch out every line to get that coding muscle memory going. All of the source code examples from this book are available at http://nostarch.com/blackhatpython/. Here we go!
Page
8
Acknowledgments I would like to thank my family — my beautiful wife, Clare, and my five children, Emily, Carter, Cohen, Brady, and Mason — for all of the encouragement and tolerance while I spent a year and a half of my life writing this book. My brothers, sister, Mom, Dad, and Paulette have also given me a lot of motivation to keep pushing through no matter what. I love you all. To all my folks at Immunity (I would list each of you here if I had the room): thanks for tolerating me on a day-to-day basis. You are truly an amazing crew to work with. To the team at No Starch — Tyler, Bill, Serena, and Leigh — thanks so much for all of the hard work you put into this book and the rest in your collection. We all appreciate it. I would also like to thank my technical reviewers, Dan Frisch and Cliff Janzen. These guys typed out and critiqued every single line of code, wrote supporting code, made edits, and provided absolutely amazing support throughout the whole process. Anyone who is writing an infosec book should really get these guys on board; they were amazing and then some. For the rest of you ruffians that share drinks, laughs and GChats: thanks for letting me piss and moan to you about writing this book.
Page
9
Chapter 1. Setting Up Your Python Environment This is the least fun — but nevertheless critical — part of the book, where we walk through setting up an environment in which to write and test Python. We are going to do a crash course in setting up a Kali Linux virtual machine (VM) and installing a nice IDE so that you have everything you need to develop code. By the end of this chapter, you should be ready to tackle the exercises and code examples in the remainder of the book. Before you get started, go ahead and download and install VMWare Player.[1] I also recommend that you have some Windows VMs at the ready as well, including Windows XP and Windows 7, preferably 32-bit in both cases.
Page
10
Installing Kali Linux Kali is the successor to the BackTrack Linux distribution, designed by Offensive Security from the ground up as a penetration testing operating system. It comes with a number of tools preinstalled and is based on Debian Linux, so you’ll also be able to install a wide variety of additional tools and libraries beyond what’s on the OS to start. First, grab a Kali VM image from the following URL: http://images.offensive-security.com/kali- linux-1.0.9-vm-i486.7z.[2] Download and decompress the image, and then double-click it to make VMWare Player fire it up. The default username is root and the password is toor. This should get you into the full Kali desktop environment as shown in Figure 1-1. Figure 1-1. The Kali Linux desktop The first thing we are going to do is ensure that the correct version of Python is installed. This book will use Python 2.7 throughout. In the shell (Applications▸Accessories▸Terminal), execute the following: root@kali:~# python --version Python 2.7.3 root@kali:~# If you downloaded the exact image that I recommended above, Python 2.7 will be automatically installed. Please note that using a different version of Python might break some of the code examples in this book. You have been warned.
Page
11
Now let’s add some useful pieces of Python package management in the form of easy_install and pip. These are much like the apt package manager because they allow you to directly install Python libraries, without having to manually download, unpack, and install them. Let’s install both of these package managers by issuing the following commands: root@kali:~#: apt-get install python-setuptools python-pip When the packages are installed, we can do a quick test and install the module that we’ll use in Chapter 7 to build a GitHub-based trojan. Enter the following into your terminal: root@kali:~#: pip install github3.py You should see output in your terminal indicating that the library is being downloaded and installed. Then drop into a Python shell and validate that it was installed correctly: root@kali:~#: python Python 2.7.3 (default, Mar 14 2014, 11:57:14) [GCC 4.7.2] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import github3 >>> exit() If your results are not identical to these, then there is a “misconfiguration” in your Python environment and you have brought great shame to our Python dojo! In this case, make sure that you followed all the steps above and that you have the correct version of Kali. Keep in mind that for most examples throughout this book, you can develop your code in a variety of environments, including Mac, Linux, and Windows. There are some chapters that are Windows- specific, and I’ll make sure to let you know at the beginning of the chapter. Now that we have our hacking virtual machine set up, let’s install a Python IDE for development.
Page
12
WingIDE While I typically don’t advocate commercial software products, WingIDE is the best IDE that I’ve used in the past seven years at Immunity. WingIDE provides all the basic IDE functionality like auto- completion and explanation of function parameters, but its debugging capabilities are what set it apart from other IDEs. I will give you a quick rundown of the commercial version of WingIDE, but of course you should choose whichever version is best for you.[3] You can grab WingIDE from http://www.wingware.com/, and I recommend that you install the trial so that you can experience firsthand some of the features available in the commercial version. You can do your development on any platform you wish, but it might be best to install WingIDE on your Kali VM at least to get started. If you’ve followed along with my instructions so far, make sure that you download the 32-bit .deb package for WingIDE, and save it to your user directory. Then drop into a terminal and run the following: root@kali:~# dpkg -i wingide5_5.0.9-1_i386.deb This should install WingIDE as planned. If you get any installation errors, there might be unmet dependencies. In this case, simply run: root@kali:~# apt-get -f install This should fix any missing dependencies and install WingIDE. To verify that you’ve installed it properly, make sure you can access it as shown in Figure 1-2.
Page
13
Figure 1-2. Accessing WingIDE from the Kali desktop Fire up WingIDE and open a new, blank Python file. Then follow along as I give you a quick rundown of some useful features. For starters, your screen should look like Figure 1-3, with your main code editing area in the top left and a set of tabs on the bottom.
Page
14
Figure 1-3. Main WingIDE window layout Let’s write some simple code to illustrate some of the useful functions of WingIDE, including the Debug Probe and Stack Data tabs. Punch the following code into the editor: def sum(number_one,number_two): number_one_int = convert_integer(number_one) number_two_int = convert_integer(number_two) result = number_one_int + number_two_int return result def convert_integer(number_string): converted_integer = int(number_string) return converted_integer answer = sum("1","2") This is a very contrived example, but it is an excellent demonstration of how to make your life easy with WingIDE. Save it with any filename you want, click the Debug menu item, and select the Select Current as Main Debug File option, as shown in Figure 1-4.
Page
15
Figure 1-4. Setting the current Python script for debugging Now set a breakpoint on the line of code that says: return converted_integer You can do this by clicking in the left margin or by hitting the F9 key. You should see a little red dot appear in the margin. Now run the script by pressing F5, and execution should halt at your breakpoint. Click the Stack Data tab and you should see a screen like the one in Figure 1-5. The Stack Data tab is going to show us some useful information such as the state of any local and global variables at the moment that our breakpoint was hit. This allows you to debug more advanced code where you need to inspect variables during execution to track down bugs. If you click the drop- down bar, you can also see the current call stack, which tells you which function called the function you are currently inside. Have a look at Figure 1-6 to see the stack trace.
Page
16
Figure 1-5. Viewing stack data after a breakpoint hit
Page
17
Figure 1-6. Viewing the current stack trace We can see that convert_integer was called from the sum function on line 3 of our Python script. This becomes very useful if you have recursive function calls or a function that is called from many potential places. Using the Stack Data tab will come in very handy in your Python developing career! The next major feature is the Debug Probe tab. This tab enables you to drop into a Python shell that is executing within the current context of the exact moment your breakpoint was hit. This lets you inspect and modify variables, as well as write little snippets of test code to try out new ideas or to troubleshoot. Figure 1-7 demonstrates how to inspect the converted_integer variable and change its value.
Page
18
Figure 1-7. Using Debug Probe to inspect and modify local variables After you make some modifications, you can resume execution of the script by pressing F5. Even though this is a very simple example, it demonstrates some of the most useful features of WingIDE for developing and debugging Python scripts.[4] That’s all we need in order to begin developing code for the rest of this book. Don’t forget about making virtual machines ready as target machines for the Windows-specific chapters, but of course using native hardware should not present any issues. Now let’s get into some actual fun! [1] You can download VMWare Player from http://www.vmware.com/. [2] For a “clickable” list of the links in this chapter, visit http://nostarch.com/blackhatpython/. [3] For a comparison of features among versions, visit https://wingware.com/wingide/features/. [4] If you already use an IDE that has comparable features to WingIDE, please send me an email or a tweet because I would love to hear about it!
Page
19
Chapter 2. The Network: Basics The network is and always will be the sexiest arena for a hacker. An attacker can do almost anything with simple network access, such as scan for hosts, inject packets, sniff data, remotely exploit hosts, and much more. But if you are an attacker who has worked your way into the deepest depths of an enterprise target, you may find yourself in a bit of a conundrum: you have no tools to execute network attacks. No netcat. No Wireshark. No compiler and no means to install one. However, you might be surprised to find that in many cases, you’ll find a Python install, and so that is where we will begin. This chapter will give you some basics on Python networking using the socket[5] module. Along the way, we’ll build clients, servers, and a TCP proxy; and then turn them into our very own netcat, complete with command shell. This chapter is the foundation for subsequent chapters in which we will build a host discovery tool, implement cross-platform sniffers, and create a remote trojan framework. Let’s get started.
Page
20
Python Networking in a Paragraph Programmers have a number of third-party tools to create networked servers and clients in Python, but the core module for all of those tools is socket. This module exposes all of the necessary pieces to quickly write TCP and UDP clients and servers, use raw sockets, and so forth. For the purposes of breaking in or maintaining access to target machines, this module is all you really need. Let’s start by creating some simple clients and servers, the two most common quick network scripts you’ll write.
The above is a preview of the first 20 pages. Register to read the complete e-book.
AI Reading Assistant
Whole-book reading guide from stratified index samples; jump to passages in the text
AI guide
【One-Line Pitch】
A hands-on field manual for turning Python into a working offensive-security toolkit—sniffers, proxies, trojans, and Windows post-exploitation tricks—written for pentesters who learn by building. Read it if you already know some Python and want to understand how real attack tooling is assembled from sockets, raw packets, and OS APIs.
【Book Arc】
- **Opening (~0%–10%)**: Sets up a Kali-based hacking VM and a Python IDE (WingIDE), then immediately builds the smallest useful primitives—a TCP client and server—establishing the "write a tool on the fly" mindset that drives the whole book.
- **Early (~10%–30%)**: Extends those primitives into a reusable netcat-style tool (command execution, file upload, shell) and a TCP proxy, then moves into Paramiko-based SSH and raw-socket sniffing, teaching packet decoding with `ctypes` and C-struct mapping.
- **Middle (~30%–55%)**: Shifts to Scapy for higher-level packet work—sniffing, ARP poisoning/MITM, and credential capture—showing how to escalate from passive observation to active network manipulation.
- **Late (~55%–85%)**: Turns to the host: Windows privilege escalation via process control, offensive memory forensics (hash retrieval, shellcode injection), and COM automation for man-in-the-browser attacks.
- **Ending (~85%–100%)**: Closes on stealth and exfiltration—sandbox detection, keylogging/screenshotting automation, GitHub-based command-and-control, and Burp Suite extension work—tying individual tools into end-to-end tradecraft.
【Book Arc note】The excerpts sample the opening through roughly the middle; later-chapter coverage is inferred from the book's stated table of contents, not from detailed excerpts.
【Key Takeaways】
- **Small primitives compound into real tools** (Opening): A bare TCP client and threaded server become a netcat replacement with command execution, upload, and shell modes—the book's core teaching pattern is "build the smallest piece, then extend it."
- **Know your assumptions** (Opening): The first TCP client assumes the connection always succeeds and the server always waits for the client to speak first; the author flags these explicitly, training you to see where tools break in the wild.
- **Raw sockets demand structure literacy** (Early–Middle): Decoding IP headers means mapping C structs to Python via `ctypes`, including bit fields—this is where low-level networking intuition is built.
- **Scapy is the force multiplier** (Middle): A few lines of `sniff()` with BPF filters replace hand-rolled parsers; the book uses it for mail-credential capture and PCAP collection, and pairs it with ARP poisoning for MITM.
- **Proxies are assessment instruments** (Early): A TCP proxy isn't just for bouncing traffic—it's how you inspect and fuzz network-based software, with hex dumps revealing protocol behavior (e.g., FTP banners and auth exchanges).
- **Paramiko unlocks SSH-level tooling** (Early): Standing up a Paramiko SSH server/client pair shows how to build authenticated command channels rather than plain sockets.
- **Offense crosses into the OS layer** (Late): Windows process control, memory forensics, and COM automation represent the pivot from network scripts to host-level exploitation—the excerpts do not detail these chapters.
- **Stealth and exfiltration are design goals, not afterthoughts** (Ending): Sandbox detection, GitHub C2, and covert data exfiltration frame tooling as tradecraft, though the excerpts do not cover the specifics.
【Reading Tips】
- **Code along, don't just read**: Every concept arrives as a script; typing and running them (in an isolated VM) is where the learning happens—passive reading yields little.
- **Deep-read the opening third**: The socket, proxy, and sniffing chapters establish patterns reused throughout; skim only if you're already fluent in raw sockets and Scapy.
- **Mind the Python 2 gap**: The book uses Python 2 (`print` statements, `raw_input`); expect to mentally translate to Python 3 or run a legacy environment.
- **Treat later chapters as guided labs**: Windows/memory/COM material is environment-sensitive—budget time for VM setup and expect platform-specific friction.
- **Extract the method, not just the exploit**: The transferable skill is the build-extend-test loop and assumption-spotting, which outlasts any single tool.
【Coverage Limits】
This guide is built from stratified excerpts concentrated in the opening through middle chapters (setup, sockets, proxying, SSH, sniffing, Scapy); the Windows escalation, memory forensics, COM, and exfiltration chapters are represented only by the book's stated contents, so their specifics are not verified here.
Passage locations
Page 8
ion to keep pushing through no matter what. I love you all. To all my folks at Immunity (I would list each of you here if I had the room): thanks for tolerat...
View in text
Excerpt 2
client that is connected to us. The exception-handling code will catch generic errors and return back a message letting you know that the command failed. Now...
View in text
Excerpt 3
he bh_sshserver is sent to the bh_sshclient and executed on the bh_sshclient, and the output is returned to bh_sshserver. Let’s give it a go. Figure 2-3. SSH...
View in text
Excerpt 4
nd store it in a PCAP file for analysis, which we will also demonstrate. To get a feel for Scapy, let’s start by building a skeleton sniffer that simply diss...
View in text
Recommended for You
{{#thumbnailUrl}}
{{/thumbnailUrl}}
{{^thumbnailUrl}}
{{/thumbnailUrl}}
Loading recommended books...
Failed to load, please try again later
Tip the Site
Scan the WeChat Pay or Alipay code to tip. No login required.
WeChat Pay
Alipay