Hey everybody welcome to the next video.
We're gonna be talking about stabilizing a shell.
So once you've actually exploded the machine and you got your initial access whether that's what net
CAD or whatever the case might be you have a shell on the machine.
You have some sort of interactive prompt in most cases you're going to have something called something
like in that controversial so we'll set that up real quick.
Port for
right and then pretend like this window on the right is our attack or is our victim machine on the left
as our attacking machine.
So when I hadn't added a reverse shell listener.
And then we'll go ahead and connect it back to local host REPORTER For 444 so you can see here we are
indeed on the system.
Where am I.
Where are you.
OK so.
Indeed we are on the machine.
Now this does not be your version could be a step forward catch to the shell itself.
There's any any which way that it says but you're using net CAD or something like a P HP reverse shell.
Pearl however you want to get the shell.
In most cases if you're not using return fritter you don't have an interactive prompt.
So this isn't interactive.
Now what I mean by that is if we do clear it only works because it's registering in this prompt.
However if we do by let's say a test that takes time.
Right so in here it's we might look like it's working but none of these commands really work.
See we're no longer able to do anything else than we were before
this is because it is an unstable shell and there isn't a T2 y attached to the prompt.
Now this can be for a lot of reasons this is just the t t y part.
So in this case we've lost the prompt and if we go ahead and kill it we kill the other side too which
might get before.
If our exploits a one shot one pump stop where we can only run it once.
This is a serious problem.
There's other issues that could cause your shell to be unstable such as the process runtime.
So whether the if you're using HP as an example or some web service we'll specifically BHP there is
a time that allows a runtime allows for the script to actually execute or this is also known as script
runtime and this depending on what they have the setting to it this is set to the minute your shell
will automatically die after a minute unless it's been fought off on another process which then it depends
on how you built the shell it wasn't a peach was it written entirely in BHP or using HP to execute another
command if it was used to execute another command.
You should be fine as far as the stability of time but you still run into the same issue here like we
just saw.
Now there's other issues as well such as the exploit stability Metis Boyd has a nice feature where you're
able to migrate them interpreter process into a different running process for the same that has the
same permissions as the current user that allows.
That means that if the other process that you exploit it dies you don't lose access.
However there is not anything on the system that will let you do that without writing some custom code.
So the exploit stability such as Does it crash this system does it recover from the exploit correctly
and that's where exploit stability comes into concern which we had in previous videos but that's also
important that that can make your one shell if that's all you had a chance to get crash and 30 seconds
a minute 20 minutes whatever whenever the process decides it's going to die.
So if it's a Java process as an example or any process the alleged killer in Linux will actually go
through and kill it if the processes if the memory gets too high as an example there's too much usage
such as an egg hunt going stupid.
There's also things like a these that will kill off the process if it does a routine scan and it happens
to catch this process running and it finds it malicious it'll go ahead and just kill the process.
Same thing with monitoring ideas host based ideas and IP systems.
You got to keep track of all these things and those are some of things you're gonna want to look for
right away to know what kind of shell you need to work with.
But what I'm going to show you first is a few ways to get around using or essentially kind of stabilizing
the shell.
All right so I'll go ahead and clear out of this and issue the same shell again.
Go ahead and actually close this terminal completely because it's a little boring right now bring this
over the screen a little bigger and we'll just connect back like we did before again.
We've got our shell perfect but there is a quick python module that you're able to use called Python
P2 Y which is a pseudo t pseudo terminal essentially it can trick applications like s you pseudo and
a few others to thinking that there is an actual terminal in place when there's really not so to do
this.
We do Python dash C import P2 y P2 y dot spawn and we're going to do bean bash
that's it.
Now you can see here it looks like our prompt died but it really didn't.
So our problem now works clear.
Who am I interesting.
So you can see it's executing the command and showing it then it's going ahead and giving us the result.
That's how you know you're still in that shell.
So if we go ahead and exit this you can see boot.
Now we're gonna end up back into our normal process once we're done but what we exited right here is
our pseudo prompt in Python.
So again if we exit one more time we've gone ahead and clear killed the shell off.
We can see how just that little bit allows us to work a little bit more so we'll take this and actually
move this to a different director.
So we'll do a user share right.
So that way when we launch our prompt if we end up in user share and not they're not slash route we
should be fine.
So that's one way.
Just using Python can help you a little bit but again it's a pseudo prompt it doesn't work for everything.
But there's another tool called so Kat that's very very powerful when it comes to giving you full interactive
shells.
Now there are so Kat binaries on Kelly that you can pass over there are compiled by an areas on a get
on you get repos whatever you choose to use.
But the way.
So Kat works is it actually executes it raw and brings in a full fully interactive T2 II terminal so
to show this we need to catch this from our Cally machine.
So this is going to be are still our attacking machine but we're going to set up our listener server
so Kat file and these are back ticks by the way t t y so for the application raw echo equals zero DCP
Dash listen port for 444.
Now I'm not going to exploit each of these parameters I want you guys to go ahead and look up the look
up the so-called binary help file and find out what these parameters are for.
That's a little extra exercise for you guys and then.
So Kat
KATZ So this is on our victim machine we're actually executing this command to give us our shell back.
So Kat exactly.
BASH Dash I will do P.T. y standard error
set I d Sig ints.
So we're actually able to use our controls saying that TGP a local host on port for football for
us.
Sorry about that.
All of these commands and everything that I'm typing in here will be below the video as well for quick
reference.
So if we go in and do that we can see on the top left here we now have our user share.
And this is a full interactive prompts for example test data.
Let's say we can do whatever we want here save the file and we back out so we can see we are indeed
working with a full show.
Now these are just some quick shortcut ways to kind of go about this.
But the next part I want to show you is actually it's a it's a unique way to do this and it does allow
you to do this with essentially just NetApp so this one's a little bit different.
So there's a little bit going to be going on with this I'll have a full tutorial written below that
explains a little bit more on each one.
So we're going to do now is going to actually you be able to take net cat and create a full t t y show
with full interactivity from just net cat alone.
So how this works is we're going to go ahead and set up our reverse show and we're going to go out and
connect to it
so following that what we're gonna want to do is get our Python interactive show.
So we're going to do Python C import
y
declined on Josh
apologies on that one.
It is Python C import P Y P2 I spawn
bash
perfect.
Now we see we've got our interactive show.
So the way we're gonna do this is this is with with text or with the terminal settings and rebuilding
the teaching life from scratch.
So if we look here we've got our show which is great.
It's not fully interactive but it's a pseudo interactive.
So the next thing we're gonna do is we're gonna go ahead and send this to the background.
Now when I send this to the background it's going to be this next session is gonna get sent to the background
on our attacking machine.
So we do control Z.
We'll go ahead and send that to the background.
Now the next thing we're gonna want to do is gain access to our our terminal.
So we're gonna want to know what our term windows are and our TDY settings are.
So if we do echo term we're gonna go ahead it's x term dash to 256 color so keep that in mind and write
it down then s t t y Dash.
Because we want to get our rows and columns.
So this is rows 27 columns eighty seven so we'll go ahead and keep that written down as well.
And following this what we need to do is we're going to want to generate are new to Y in the net process
but we need to be able to do that from the foreground.
So what we do is we need this.
We need to actually rebuild the set our t y on our current terminal which is this guy right here on
our attacking machine to roar.
We want to make sure it's completely set up.
S t t y raw dash echo.
So what you're gonna notice is I'm going to be typing f g like I just did right now for our foreground
process.
So we push everything into the foreground but what we've done is we reset the T Y but the application
is still intercepting and grabbing the commands to go ahead and enter after I've just hit F G so we're
gonna look like I just hit net cat again.
But I did not I never hit that cat again but what we want to do is do reset which essentially resets
the turmoil on the other side.
And good.
So it's gonna look nothing's going to look different here but that's important but you've noticed that
we don't have anything else above this right.
So what we need to do is export shell as you go to bash.
Now we're gonna do export term is equal to x term dash 256 color and then we're going to do s t t y
rows twenty seven columns 28 or is that 80 to 81 I think that's close.
Perfect.
That's all we need.
Once that's done we now have a fully interactive show.
So if we go ahead and the I guess star data we go ahead and get our data again perfect so we can see
everything is working correctly.
So this is a quick way to how to do that with just net cat alone.
And this is also just a few ways to stabilize your shelves there.
There's countless more but I want you guys to understand is the limitations that a unstable shell or
a non interactive shell has.
You might run into a problem where you forget to actually interact with the shell when you go to type
something like F teepee or you're trying to SDH to different machine that calls for an interactive terminal
and you'll and you're going to be nothing but cause yourself problems unless you sort this out right
away.
So stabilize your shell first make sure it's consistent then go ahead and make sure that you have a
full t t y section available to you then we're gonna follow up with persistence which is gonna be the
next set of videos.