When an exploit was successfully executed, is there a way to block the user from bouncing back a shell?
I would like to know about this on both Windows and Linux machines.
On a production web server, you should prevent outbound TCP connections from being created, excepted for trusted addresses. Any stateful firewall should allow you to create rules for this kind of scenario.
If you're using iptables
, try something like this:
iptables -A OUTPUT -p tcp --tcp-flags ALL SYN -m state --state NEW -j DROP
My iptables
-fu is a bit rusty, so excuse any errors in that command.
This drops all outbound TCP packets that belong to a new TCP connection, with only the SYN flag set. In other words, it completely prevents outbound TCP connections.
If you are talking about reverse shells this can be quite tricky to try preventing. For example the attacker successfully exploits target and uses the client to connect back to attacker on port 80 delivering a shell. Outbound port 80 should of course be allowed. Trying to prevent shell signature over port 80 would probably create a whole lot of false positives.
I would rather aim for detection rather than prevention.
yum update
or apt-get update
uses http, no? Wordpress's auto-update code certainly does. I can see a number of scenarios where allowing outbound connections might be needed, to arbitrary addresses - clearly best avoided, but it does depend on your scenario.