3

How possible is it for a reverse shell to connect back to the attacker if the vulnerable web server only has Http ports open like 80 and 443 through the Netscaler behind the perimeter firewall?

Would the web server be able to connect back, for an example, to an attacker port 443 from a random port? If not would a bind shell work on the busy ports mentioned?

  • Any loadbalancer can be bypassed if the Application is vulnerable. I have seen instances where malicious WAR files were uploaded to the application server's root directory using HTTP PUT method but reverse shell connection was blocked, thanks to Firewall whitelists. – Krishna Pandey Sep 25 '17 at 10:40
  • @KrishnaPandey Did the load balancer forward the connection from the random port at the web server towards the attacker's litsenning port? – Limpid.Security Sep 25 '17 at 18:57
  • I am not sure as it was long back, but I saw Server making requests to Public IP addresses, didn't checked that on LB. Also it depends on how LB is configured. – Krishna Pandey Sep 26 '17 at 6:24
1

Assuming that the Netscaler (or other load balancing appliance) is configured properly and the network architecture is such that the target server cannot bypass the load balancing layer to directly reach the internet, you cannot expect to get a normal reverse shell to work.

There are a few ways you can approach this problem:

  • If the Netscaler appliance is configured to allow SSH forwarding for remote management purposes, then you may be able to have the payload add a user.
  • Have the payload drop a webshell onto the system which allows for interactive access to be tunneled through the load balancing layer.
  • Exploit the vulnerability repeatedly and have the payload tunnel data back through an out-of-band channel, e.g. DNS requests to subdomains of a system where you control the nameserver.
  • Attempt to attack the Netscaler itself. There's an old Netscaler management application written in Java which uses a custom protocol on top of TLS, but the protocol is fairly trivial and there's no account lockout, so bruteforce is trivial. The server always has the management port open on the internal side and (last I checked) there's no way to disable it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.