This lecture We'll see how we can get a reverse connection from our weekly show.
So at the moment we upload it weekly and we're connecting to it directly using this you are Elb.
So when we hit enter we're actually just doing a direct connection.
And it's as if we're just interacting with a normal ph script uploaded on that directory.
So what we want to do is maybe in some cases you can't really run commands like this so right now I
can run whatever command I want whatever Linux command we also seen how we can use the shell SH function
that comes with weekly to try and bypass if we can't run commands.
If none of that works or if you wanted just an actual direct reverse connection from the target web
server to our machine then you can follow what I'm going to do in the structure.
It can be really handy because you'll have a direct connection and you'll be able to bypass a lot of
security measurements.
So we're going to do help first to see the options that we have and the function that I want to use
today is the reverse whereas it's back to reverse TCAP and it basically just gives you a very TCAP shell
so it won't be executed throw a PSP it will be a reverse shell or reverse connection come in from the
target server towards your computer.
And because of that it'll bypass firewalls because the connection is coming out of these web server
not to the web server.
So the first thing we gonna do is as usual we're just going to run back reverse TCAP.
And I'm going to put mine on stage to see the options that we can get with this function.
And you can see the way to use it is the first thing you need to specify the name of the function followed
by the type of shell so we're going to leave that the same.
You can tell it not to auto connect but we don't want that.
We actually want it to automatically connect and then you can specify the vector and again the vector
is very important and it specifies the way the reverse connection will be spawned.
So you can use netcat.
It can be done through netcat it can be done through python.
It can be done through perl ruby.
These are all programming languages.
So if the connection doesn't if the target server doesn't have netcat installed or if it has certain
security or permissions that prevent you from using netcat then you can try to get your shell through
python.
If Python is not installed or if it has some sort of measurements that prevent Python from connecting
back to you then you can do it through Perl.
And again if Perl is configured in a way that it's not allowed to spawn reverse connections you can
do it through Ruby.
And again you can use any of these vectors until one of them works for you.
And once one of them works for you chances are you're going to be able to bypass a lot of security measurements.
Definitely you'll be able to run bash commands on the target server.
So if you can't run bash commands normally and if you tried the shell SH function that we seen in an
earlier video and still didn't work for you then you should come to this try this method.
If it works then you'll be able to run any shell commands you want on the target server.
So let's try it in action.
So we're going to type in backdoor reverse TCAP.
We're going to give it the vector and I'm going to want to use netcat
and then we're going to give it dependent on this as you can see so we did that and we gave it the vector
then we need to give it our localhost So the IP address of our current computer followed by the port
that we want the connection to be done through.
So to get the IP address of my computer I'm just going to run if config
and you can see that my IP address is 10 20 14 to 13 so I'm going to close this.
And then we're going to give it forward and I'm going to set the port to 80 80 so the command is very
simple.
After the first ECP vector which is going to be netcat and then we put our current IP address followed
by the port.
So we want the connection to be done through.
I'm going to head into
and now the connection established So now we can run any commands we want and keep in mind that these
commands will be executed through netcat.
So the connection is coming back now from the server to us and now we're communicating with it through
a completely different port.
It's not going to go through really it's actually going to go through and that's cut.
So if there was some sort of security that didn't allow us to run commands through weekly then we'll
be able to bypass them now.
So now we can use it.
We're going to do W.D. for example and we have to add a semicolon after it.
You can see that where we are we can do all my
Seems like we've lost our connection so I'm just going to do it back.
So again we can do.
Who are.
We can pretty much do any commands we want.
Now again if this didn't really work for you you can go ahead and try a different vector.
You can try the python.
You can try the Prawle after each of these vectors try to see who are my and see the current permissions
or the current user that you're ionised because you might actually be Arayan under a different user.
One thing to keep in mind here is your IP because the connection is is a reverse connection.
So it's coming back from the target web server to your computer.
Therefore at the moment I'm actually using a private IP within my county network but it works because
the website is on the same network.
If I was doing this against a real Web site this won't work because my private IP is not accessible
publicly because it's hidden behind the router.
So if you want to receive connections if you receive reverse connections from an actual web server and
if you're not on the same network as that web server then you need to either set up your Cali machine
as a DMZ host or you need to enable IP forwarding to enable the poor at the port that you're using here.
So 88 in this case to be forwarded to your private IP you can do both of these things from the Control
Panel of your router your router is usually located at the first IP.
So my IP now is Dan 20:14 and 2:13.
The router is usually at the first IP so it will be at the one so he can access that through the browser.
Look for the option called DMZ and said the Callimachi in the DMZ host another option is to go to Port
forwarding other will to forward port 80 80 to the IP of the Callimachi and also make sure the IP the
Kalli machine is connected to your actual network and it's not set up as a network like this.
So make sure you have a wireless card connected to your home network and from there you will have an
actual IP in your network instead of a private virtual IP like we have here.