Could you guys help me understand reverse shells better?

Would an attacker be exposed when using a reverse shell in a real attack?

For example, if I have a reverse shell on a Linux VM that connects back to my Linux machine. The backdoor contains my IP, so if the Server Admin identifies it he knows where the connection is going to, right?

The problem is, in order to achieve this in the real world, the backdoor would use the REAL IP of the attacker. This would lead to the attacker being easily tracked down?

Am I missing something? How do people use a reverse shell and don't get caught?

  • You can do several things to hide your identiy. For example routing the traffice via a cheap vps or letting the reverse shell connect to a tor hidden service. – architekt Mar 14 '17 at 6:54
  • In an enterprise network you can do things to obfuscate yourself such as using spoofed IPs and/or proxy chains. Realisticly your best bet is to try and blend in with normal traffic in an effort not to trigger the SIEM, IDS or NGFW's. Computers are designed to talk to each other, take advantage of that fact. – TheJulyPlot Mar 14 '17 at 7:04

You are correct. In fact, many defense systems are designed to look for the traffic going out to a C&C server, and the traffic details would identify the destination (the attacker's C&C server).

So, the attacker needs to take this into account and design around this problem.

The obvious solution is to not make your own personal PC the C&C server. Instead, use another compromised machine (unsecured web servers make great C&C).

If the attacker needs to connect directly, then the simplest options are to use free public wifi, crack a neighbour's wifi, VPNs, proxies, TOR, or use a burner SIM card. Something to obfuscate the attacker's IP or borrow another one.


What you are missing:

Most attackers are clever enough to never hack directly from their home-box without using a VPN, proxy or routing through the onion-network.

In Theory, if you open a reverse shell without any precautions you are exposed, yes.


Yes, and it's practically easy to be done, if the attacker hasn't taken any measures to hide his identity. In that case, even a wireshark would be enough to find the ip the malware is "talking" to. Reverse engineering is also easy. Thats why in a serious, real-time attack, a reverse shell would be encoded or packed, so reversing would be hard and its process would be migrated in another system process, so its network traffic would be harder to detect. It could also be customized to open a shell for a specific time windows and not constantly, to avoid IDS detections. Last, but not least, as @Gewure mentioned, their traffic will be sent through vpn, proxy(ies) or through onion network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.