I heard about persistent reverse shells, and how in theory, they can stay indefinitely on the target's system, and how they can connect back to the host when the target's machine boots up, but how do reverse shells gain their persistence? Do they copy themselves to the Windows Startup folder, is there an external script which runs the program, or do write to a process?

  • 1
    Your question is pretty broad. It depends. It could be that the reverse shell is embedded into a program, or an attacker could have just had remote code execution as a privileged user and installed a system service. It depends on the attack and the payload. Some attacks are really complex, others very simple.
    – nbering
    Nov 7 '18 at 0:34

They don't.

A reverse shell is just a technique to connect to and control a computer. On its own, a reverse shell has absolutely no persistence capabilities. In order to persist, it must be the payload of malware which does offer persistence. For example, malicious software set to run as a service could install a reverse shell.

  • Thanks for the answer, but I have a few questions: How does persistence happen, in other words what are the ways backdoors and other malware gain persistency?
    – Practical1
    Nov 7 '18 at 0:30
  • 2
    @Practical1 That's a different question and is entirely too broad. It could be an actual backdoor in an executable or kernel module, or a service scheduled to run. It could be a script put in an autorun directory.
    – forest
    Nov 7 '18 at 0:31

There are numerous ways this can occur and these differ depending on your stack. Unfortunately there are too many to go through here - BUT what I would suggest if you are interested in this sort of thing (and it is extremely interesting) is that you go the the Mitre ATT&CK site and look over the category marked persistence for practical examples.

The short of it is things like tasks or applications that run quite often can have certain flaws in them that will allow malicious code to be executed giving persistence. Why on windows you can use WMI events to maintain persistence every time the user opens chrome if you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.