Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice.

Would not most servers restrict outgoing connections initiated by the server on an odd port? Would this not be a basic firewall rule?

Apparently not as this technique is used as it is more likely to bypass firewalls, what I don't understand is why.

share|improve this question

2 Answers

up vote 5 down vote accepted

According to my experience, many people concentrate on preventing attacks in the first place and not on mitigating the impact. Therefore outgoing firewalls rules are often not a priority. Especially since you have to define exceptions for update servers, if automatic updates are desired. The list of IP-adresses has to be kept uptodate.

In my experience it is way more common for attackers to try to upload phpshell/perlshell/etc. in file upload forms. The attacker hopes that the files are stored in a folder that is reachable via the webserver with script execution enabled. Or to inject php code and remote includes into request parameters. Furthermore SQL and XSS attacks are quite common, so is phishing. Of course my observations are biases by the areas I am active in: web application and online game security.

That being said, it is of course still a good idea to have outgoing firewall rules.

share|improve this answer
An example is in metasploit, a reverse shell is the most common type of payload (from what I have seen). – Sonny Ordell Sep 7 '11 at 20:23
1  
Yes, people do not spend enough effort on mittigating the impact of an incident. If you need convincing read The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments – this.josh Sep 8 '11 at 7:47
up vote 3 down vote

Your firewall will have some open outbound port, and the bad guys will find and use it. You can usually tunnel out over port 443 (HTTPS), or if not, you could hide in HTTP messages relayed through a proxy server. Heck, the PositivePRO VPN product does (or, at least, did) this.

Your server might have an outbound firewall rule, and the bad guy might be able to disable it or get around it, depending on how badly owned you are (and keeping in mind that you can make the case that there are no "degrees" of owned - you are or you aren't).

Why shells? Well, you can generally do anything from a command prompt that you can do from a GUI, and usually more. They're also faster and lighter-weight than, say, tunneling out a graphical app via RDP. They can be easier to hide on the box as well, and have a smaller memory and CPU footprint.

share|improve this answer
I know why you would want a shell, just not why you would want a reverse shell. It seems easier to block the server from initiating an outgoing connection then it does to start a process and have it accept one. – Sonny Ordell Sep 7 '11 at 20:22
3  
It's a lot harder to get a connection in to your server (through the firewall) than it is to get out. – Steve Dispensa Sep 7 '11 at 20:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.