./ReverseShell

In this chapter, we will focus on getting a reverse connection from an exploited system. We will also cover different methods for getting a secure reverse connection, explaining the difference between a non-encrypted and encrypted channel by showing the noise level it creates in the network using tcpdump for packet-level analysis.

When penetration testing, it is common to encounter the issue of getting a shell. In this case, individuals either upload a web shell on the target site and interact with the server or they execute a command to get the reverse connection. In both cases, if the scope of testing includes internal network recon, then reverse shell connection is a must.

For beginners, getting a reverse shell is very interesting. However, many of them don't realize how careless it is to move forward with this without gaining the proper knowledge first...

Technical requirement

• Metasploit Framework
• netcat, socat, cryptcat, powercat
• ngrok

Introduction to reverse connections

When the user connects to a server, the user binds its socket with the server's port. This is called a bind connection. Bind connections are only possible if incoming connections are allowed by the firewall. In a situation in which incoming connections are restricted, a user can ask the server to connect back. Firewalls generally restrict incoming connections but don't restrict outgoing connections. When the server makes an outgoing connection to the user, this is called a reverse connection.

Unencrypted reverse connections using netcat

Reverse connections can be initiated over an unencrypted channel or an encrypted one. To understand reverse connections, let's use a tool...

Introduction to reverse shell connections

A reverse shell is a type of shell in which the target server connects back to the attacker machine. For example, an attacker finds a target server with port 21/tcp, 80/tcp and 443/tcp in OPEN state and the FTP service running on port 21/tcp is vulnerable. Let's say an attacker exploits this port in order to open another port 1337/tcp on the target server for shell connection, as shown in the following diagram:

Credit goes to https://creately.com/ for network architectural diagrams

The problem arises when the attacker tries to connect to the target server on port 1337/tcp. The attacker is not able to connect to port 1337/tcp. Why? Because the firewall blocked that port. The firewall can only allow port 21/tcp, 80/tcp and 443/tcp for incoming connections and it will block all other ports, as shown in the following diagram:

This...

Summary

At the beginning of this chapter, we explored what a reverse connection and reverse shell connection is using tools such as netcat, ncat, openssl, socat, cryptcat, and powercat. We then tried different payloads to get reverse shell connections using Metasploit—reverse_tcp, reverse_tcp_rc4, and reverse_https. We then saw the enhanced version of reverse_https by using a custom SSL certificate with an impersonation technique, a meterpreter hijacking case scenario, paranoid mode, and by getting a meterpreter session over ngrok. Finally, we provided you with a cheat sheet that you can refer to whenever you want a reverse shell.

Questions

1. Is it absolutely necessary to understand the concept of reverse shell connections?
2. Is it required for us to get a reverse shell over an encrypted channel?
3. Are there any GUI tools that can be used to generate Metasploit payloads?
4. Can we get Cryptcat for Windows?
5. Can we use a different stage encoder other than shikata_ga_nai?
6. Can we use paranoid mode in our red-team operations?
7. Is ngrok free to use?

Further reading

For more information on the topics discussed in this chapter, please visit the following
links:

• Reverse connection: https://en.wikipedia.org/wiki/Reverse_connection
• Reverse Shell cheat sheet: https://gtfobins.github.io/
• InfoSec Resources: https://resources.infosecinstitute.com/icmp-reverse-shell/
• The GNU Netcat: http://netcat.sourceforge.net/
• Ncat Users' Guide: https://nmap.org/ncat/guide/
• Powercat: https://github.com/besimorhino/powercat
• CryptCat Project: http://cryptcat.sourceforge.net/
• socat: http://www.dest-unreach.org/socat/doc/socat.html
• metasploit-framework: https://github.com/rapid7/metasploit-framework/wiki/How-to-use-a-reverse-shell-in-Metasploit
• Meterpreter: https://blog.rapid7.com/2011/06/29/meterpreter-httphttps-communication/
• Meterpreter paranoid mode:https://github.com/rapid7/metasploit-framework/wiki/Meterpreter-Paranoid-Mode
• Meterpreter over...