Is it possible for a software to open port in the router for my local device without permissions to access router setup page?

If it's not possible then how does a bind shell work?

  • 1
    You can't force the router to forward a port without interacting with the router. The forwarding problem is why reverse shells are often preferred over bind shells. – Arminius Jan 15 '18 at 21:40
  • So, when are bind shells preferred or at least could be used successfully? – Nour A. Hakim Jan 15 '18 at 21:43
  • 2
    E.g. when the server's open ports are directly exposed to the Internet (or automatically forwarded). Or when you're in the same network as the target machine. – Arminius Jan 15 '18 at 21:45

A typical bind shell payload will not be able to open ports on firewalls in front of the targeted system. It would be possible to include a UPnP client in the payload which would open firewall ports on firewalls where UPnP is enabled.

As Arminius mentioned, reverse shells are generally preferred to bind shells because most networks have far more liberal egress rules than ingress rules. However, there are some cases where bind shells can be quite effective:

  1. There are no firewalls between you and the target.
  2. There is a legacy firewall rule (perhaps a decommissioned FTP or Telnet server) that you can make use of.
  3. You've already compromised the firewall and are in the process of lateral movement and will open your own port on the firewall.

The biggest advantage for a bind shell payload that I can think of is that you can change where your connection is coming from (pivot, change attack boxes, etc.), which makes it quite useful when testing from e.g., the client's WiFi network. Additionally, it makes forensics harder if they did not capture the traffic -- a reverse shell will have the IP it tries to connect to in the payload, the bind shell leaves the DFIR team without that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.