Reverse Shell Cheatsheet.
In this video, I'll be taking you through various resources
that you can use, more specifically
cheatsheets that you can use to, essentially, obtain code
that can be executed on the target system
to connect back to a Netcat listener.
All right, so as I mentioned in the previous videos,
or more specifically in the previous video
where I was explaining what a reverse shell is,
one of the great features or one of the great things
about reverse shells is that you do not
need to have Netcat or a Netcat listener
on the actual target system.
The connection to the Netcat listener on the attacker system
can be made through the use of PowerShell code.
You can do it with simple bash code
or just Python code, C code.
You can also generate executables
that will connect to that particular listener
and provide you with a reverse shell.
And you don't need to rely on Netcat
to initiate the connection.
So that's really what I'm going to be
highlighting in this video.
So again, just to go through the process,
I'm going to be performing or demonstrating
all the techniques within this video,
within my own lab environment.
So there isn't a lab environment attached to this video.
The reason for that is, again, I'm
just going through resources, and I'll
give you a simple example of how to utilize these cheatsheets
or tools that I'll be highlighting.
So I'll just switch over to my Kali Linux VM,
and I'll take you through the process.
All right, so I'm currently in my Kali Linux VM,
and these are the two resources that I
wanted to share with you.
And these are resources that are going
to be extremely beneficial to you
as you get into a penetration testing career.
So the first resource is a GitHub repository
called swissky repo, and the repository in question
is PayloadAllTheThings.
Under the PayloadAllTheThings repository,
on the methodology and resources,
you'll find a file or markdown file called Reverse Shell
Cheatsheet that essentially contains a list of commands
or code that can be used to connect back to a Netcat
listener after being executed on the target system.
And in terms of the target system,
there are various cheatsheets are based
on the target operating system.
So for example, if the target operating system is Linux,
you can click on Bash TCP.
And all you need to do is execute this code here
on the target system.
And again, this code can be executed manually
by physically accessing the system
or through social engineering.
This can be essentially be embedded into a payload,
so on, and so forth.
And of course, in most cases, this code
is typically included as part of exploit code.
So once a vulnerability has been exploited,
the following code is executed on the target system.
And then, it's executed, and then the connection
is made back to the attacker's system
or to the Netcat listener on the attacker system.
So you can see that, in this case,
the information that needs to be changed
is you need to substitute this value with your own IP
address as the attacker.
And you can then specify the port
on which the netcar listener is running,
and that's pretty much it.
So that's an example of a very cool command
that you can run for Linux targets.
In terms of Windows, as I said, you're
pretty much limited to only two options.
You can either utilize PowerShell code.
So for example, if this PowerShell code
is executed on the target, it will connect back
to our Netcat listener.
And as I said, there isn't a reliance on Netcat,
and the target system does not have to have Netcat installed.
And PowerShell is very powerful because every Windows system
comes with PowerShell and the ability
to execute PowerShell code.
So that's one of the techniques.
Now, if the target is a Linux target or even a Windows target
and has Python installed, then you also
have Python code that will essentially connect to a Netcat
listener, and all you need to do is just substitute this IP here
with your Kali Linux IP or the attacker system IP,
and then specify the port on which your Netcat listener is
running.
So again, this is a really, really helpful resource.
And again, it's not limited to just operating systems.
If you're targeting or exploiting a web application,
you also have PhP reverse shells right over here.
So you can see that if this code is executed, you can--
let's use this example here.
This code can be executed with PhP, and it'll essentially--
you can see right over here, it's
going to connect to the target or rather the attacker's
system, and then executes bin bash or bin/sh,
and you obtain a reverse shell session.
Now, the other resource that's fantastic,
and one that I recommend that you take a look at
is one called reverse shell generator,
and it's accessible under revshells.com.
And you can see the interface is very simple.
Number one, you need to specify the IP address of the attacker
system.
So your Kali Linux or pen testing distribution
IP address.
And then, the port on which the Netcat listener is running.
In my case, I've already done that.
So you just need to change it up to your own IP address.
On the right, you have your listener.
So, again, instead of using only Netcat as your listener,
you can also use ncat, rustcat, pwncat, socat, et cetera.
Of course, we're not going to be exploring these--
we're not going to be exploring any of these other alternatives
in this course.
That's something that we'll be exploring in the future.
So yeah, in this case, we're just going to use Netcat,
and it gives you the actual command
to set up the Netcat listener based on the report that you
have specified right over here.
So again, if you change this port,
it's going to change over here.
So really, really cool.
At the bottom, you can see-- you have the ability
to generate a reverse shell, a bind shell, and MSFVenom
payloads.
So again, those are also quite useful.
In terms of bind--
in terms of bind code, you can see
that you're pretty much only limited to Python 3 and PhP,
in the event that target does not have a Netcat installed.
And in the context of Windows, the only other option
is Python 3, which, again, is very rare.
So again, if we click on reverse,
you can sort through by operating system.
So in this case, what we'll be trying to do
is obtain a reverse shell on a Windows system
that doesn't have Netcat installed,
and we are only going to utilize the PowerShell code.
So we'll use PowerShell.
This particular option here, so that's PowerShell 2.
And you may have to test around the different variants
of this PowerShell generator.
So again, all you need to do is just copy it.
Once you specify the actual Kali Linux or attacker's IP
and the port, this has already been added for you
or substituted.
So all you need to do is just copy this right over here.
And then, somehow, transfer it over to the target system.
That can be-- as I said, this can be part of a larger exploit
or you can essentially copy it or paste all of this
into a PowerShell file or a PowerShell script
for that matter, and get it executed on the target.
In this case, what I'm going to do
is I'm just going to copy this here, as I've already done.
And I'll show you that you can actually
obtain a reverse shell without Netcat on the target site.
So for receiving the reverse shell,
we're going to set up the Netcat listener here.
So nc -nvlp 1234.
Hit Enter.
And I'm just going to switch over
to my Windows 7 system, just to demonstrate this.
All right, so I'm on my Windows 7 system,
and I can just open up a command prompt session.
So I'll just search for cmd.
And before we actually executed, there
are a few changes that need to be made.
Because if we paste this in here,
it might actually work during the first run.
So I'm just going to paste it.
And in some cases, you may need to specify
that you want to execute powershell.exe
on certain versions of Windows.
And let me just increase the font size here.
And yeah, we can just increase that there.
And we also-- you can see that code is being executed.
As I said, in some cases, you may
need to modify the PowerShell code that has been generated
by the reversal generator.
But lets hit Enter, and let's see what happens.
So we don't get some--
we don't get any feedback, which means this is probably working.
So I'll just switch over to my Kali Linux VM.
OK, so I'm back on my Kali VM.
And as you can see, we get a connection
from the actual target, the Windows 7 system.
And if we hit Enter, you can see we get a partial session.
And we've successfully been able to obtain
a reverse shell on the target system
without Netcat being installed.
So this is really where you can start
seeing the power of reverse shells, as opposed to bind
shells, where you need to have a Netcat listener on the target
system.
So you can see that we can pretty much
do whatever we want.
I can say who am I, and I get the information there.
And then, we can type in systeminfo, for example,
get information regarding the operating system itself.
There we go.
Fantastic.
We can see it's running Windows 7 Ultimate, Build 7601,
so on, and so forth, right?
And as I said, you're not just limited to just PowerShell.
You also have the ability to actually compile
your own executable that will connect to the listener.
So this is your Windows C code that you can then compile.
And the compilation process is essentially the same
as you would be if you are trying to compile or cross
compile a Windows exploit.
We've already explored that.
So you can use the various compilers that
are highlighted in that video.
And as I said, it really is a fantastic resource.
Because, as I said, it's not just limited to--
it's not just limited to one operating system.
You also have your Mac reverse shells here,
so on, and so forth.
So again, definitely check this out.
This is revshells.com.
And the GitHub repository here is just under Payload
All The Things, and it's called the Reverse Shell Cheatsheet.
So both of them are good, but I would personally
recommend utilizing the reverse shell generator
if you're just getting started out
or if you're just getting started,
and you'd like to explore the various types of reverse shell
code that you can generate, essentially, for execution
on the target system.
OK, so this is going to conclude the practical demonstration
side of this video.
All right, so that concludes the bind and reverse shell
section of this course.
In the next section, we're going to be taking a look
at various exploitation frameworks that
can be used to streamline and automate the exploitation
process.
So I'll see you in the next section.