First I've got a few questions about Reverse shell.
I'm trying to understand the Reverse shell technique.
My reasoning is as follows (I'd be glad if you could point out any mistake about it)
1) Reverse shell is different (I'd say the opposite) from a normal shell since in this particular case the remote server opens a connection (normal or direct shell implies that the client establishes a connection to the server)
2) Reverse shell can bypass firewall controls since it's basically an outgoing connection. Firewalls are supposed to guard against incoming connections.(Probably this might be questionable)
3) Furthermore, is the following scenario feasible? (I mean, can I inject command through a proxy software like ZAP?)
Scenario: A site is vulnerable to user's input data. Users insert data through a text field.
OS: GNU/Linux. Server: Apache/2.2.15 X-Powered-By:PHP/5.3.5
Suppose that through a proxy software (like ZAP) after some checking, you are able to note that there's a field which matches the user's input field available through the user interface.
The field is called:
Given that, I can try to inject a simple command separator ";" which practically it is as though you set:
Then I notice that there are some files embedded in the web page the application returns.
Wow, the app is vulnerable.
The application is vulnerable, so it's possible to directly interact with the server file system. Now ...the knotty problem (for me) 4) Is the following command correct? (Using ZAP I try to fire up a reverse shell)
netcat -v -e '/bin/bash' -l -p 40552
-v (verbose),-e (when a connextion is made it runs the Bash shell), -l (parameter to listen for a connection) -p (it enables to assign a port to listen on, here port 40552), the port chosen must be free.
5) So using ZAP the injection is the following code correct?:
user_val=; netcat -v -e '/bin/bash' -l -p 40552
Thanks a lot (I do apologize for the long post).