2

What is the connection between an exploit to the point of privelage escalation and opening a reverse shell?

I understand certain parts of the process but not how they are tied together.

E.g. If a vulnerability is found and an overflow exploited with some payload that includes a NOP sled down to the executing payload, how is it connected to actually get root on the system or to copy the code to VM and change the memory section to executable?

Do additional payloads need to be sent through the same overflow? What is the actual controller that pieces the components together?

And for the reverse shell, is that an encrypted socket back to some system so that the C&C packets can be sent? I'm still missing what actually takes control on the remote system to handle this? Can a full program be injected in the overflow or in pieces and somehow reassembled and start running?

3

What is the connection between an exploit to the point of privelage escalation and opening a reverse shell?

There isn't actually a direct connection. An exploit takes advantage of a vulnerability in software. For the exploits you are referring to, you are looking to deliver code you've written to get access to the target system. This could open a reverse shell back to you so that you can run commands.

Escalating your privileges isn't directly related because the exploit runs with the permissions of the software you are attacking. If the software runs as root, you get root when you exploit it. If the software runs as joe, you get joe's permissions. Escalating after that is a separate process that may require running more exploits.

And for the reverse shell, is that an encrypted socket back to some system so that the C&C packets can be sent?

It depends on what you want to run. Things like netcat are not encrypted by default, while sbd, or secure backdoor, are. It's really up to you and the code you deliver to the target.

I'm still missing what actually takes control on the remote system to handle this?

When you exploit software in the scenario we are talking about, you are redirecting the flow of the program to execute your code. When it does that, it executes whatever code you tell it to do, as if you had yourself written the software.

Can a full program be injected in the overflow or in pieces and somehow reassembled and start running?

This depends on the vulnerability. In a buffer overflow, you may have a limited size to deliver your code. In that case, you'll have to do what's called staging. Staging is delivering a much smaller program that then downloads more code from you until it gets to the full program you want your exploit to run.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.