Welcome everybody to this tutorial. Today, I will open up a chapter on reverse
shells. Now, let me begin by just explaining what they are in general.
Basically, a reverse shell would be something that...you put a piece of code
that you would place on a device, namely on a computer, but you can also place it
on a phone or a smartphone, like an Android device, or an iPhone, or
something of a kind. And then you are able to control such devices remotely
from the location of your choice. Now to do this over the Internet it's a little
bit trickier, and you would have to combine several things what we have
learned thus far. For example, you would have to, if you had a
computer at home, but if you didn't have a VPN with a static IP, you would need to
configure your own router. Well, actually, it's not that hard. All you would need to do
is put an IP address of your computer, so ifconfig. You can
also use the IP of a virtual machine, no problems, if it's in the bridge mode, as I
have showed you. And you would need to find the option DMZ, so demilitarized
zone as it is usually referred to, and you would basically put this IP address.
Keep in mind if it changes you need to
change the DMZ as well. I've decided not to show you how to do this in a router
because I could only show you how to do it on my own router, and there are
various routers out there. But, look it's pretty simple. Just open up your web
interface of a router and find DMZ, so DMZ. There's usually just one option, one
field, you can only put one IP address, and just type in this IP address. And
then you will be able to use your public IP address which you can get by typing
in your favorite search engine, what is my IP, then get that public IP address,
and you can use that IP address as a listener for all the reverse shells you
create. Now, there are several approaches here in
terms of deployment and creation of a reverse shell. To create them you can
either code it yourself, which is a preferable way. Primarily because, the
reverse shells that you can generate automatically can be detected by
anti-viruses, and that's not what you really want. You want something that's
undetectable. But, for the time being,
coding a reverse shell on your own, I can tell you, it's not a simple task.
Especially when you need to do hex dumps to avoid privileges, and stuff of a kind
to avoid firewall detection. But look, basically, if you code it yourself, it's
probably going to be something simple. It's going to be far away from
professional. It's going to be bad, let's face the reality
of things. However, because it's bad, because it's unprofessional, because it
doesn't contain any complex functions, because it doesn't contain the usual
patterns that a pro reverse shell would contain, it is not that likely to be
detected by anti-viruses. So, that's a big plus for you. So if you can even code the
basic reverse shells, just look it up on the net as I'm not gonna get into that,
because that would be a separate course for itself, a programming course. If you
can code even the basic reverse shells, you stand a very good chance of not getting
detected. Primarily because, your reverse shells will be noobish, and that's a good
thing. That can be a good thing, actually. Anyway,
it is unlikely that you will pass the detection by a generated, by an
automatically generated reverse shell, on a fully updated system. So, keep that in
mind. You need to look for a system that doesn't have the latest updates, that
is behind in such a sense, and then you have a very good chance of passing with
an automated reverse shell. The tool for the framework for creating reverse
shells is Metasploit. Metasploit is a fantastic framework used by pentesters
all around the world. Now professionals use a paid version, a pro version, which
costs, I remember a long time ago I knew how exact the exact price. But, it doesn't
really matter. It was around five thousand dollars, so 5k per license, per
month. That costs quite a bit. Things might have changed in the meantime,
it's been a while since I checked those prices out, but I'm just trying to make a
point. Even though the pentesting companies are paying such prices and
they're not paying it for a single license, usually they're paying for more
than one even though the program is open-source. If the program is
open-source that doesn't necessarily mean that it's free of charge. Of course,
we will be using a free of charge version. You don't have a GUI
interface there, you have to do everything via a terminal. So, that's kind
of a downside for some, but not to the fullest of extents.
There are some features that are available only for the pro version.
However, if you feel like paying 5k per month, just go over on the net type in
Metasploit in the search engine, and your first result should be their official
website. Anyway, without further ado, we're gonna get into Metasploit immediately.
I'm gonna go ahead and clear the screen, and we will use it to generate a script,
and we will also use it as a listener. Now Metasploit, I mean you can run it
just by default in Kali without actually doing any sort of configuration
whatsoever. But, I don't recommend it, primarily because you can speed up
pretty much everything by just doing a few simple things. So,
go ahead and type in service. We will give the Metasploit framework a
database to use, and if it uses a database it is faster. So, type in postgresql
start. You will need to start postage SQL, it's already running for me. I can just
type in status, and there you go it says running clusters. Anyway, go ahead and
clear the screen, type in service metasploit start, and this should start
this metasploit service as well. I'm gonna type in
status, and, okay, so there are a few things that will
start up once you type in service metasploit start. Anyway, go ahead and
clear the screen, type in msfconsole, press ENTER, and I gotta
warn you, this is gonna take awhile actually to start. Primarily because,
Metasploit is pretty big, it has a lot of things in it, and it takes a while on a
virtual machine to actually start. Primarily because of the limited
resources. Let me just go ahead and open up another terminal and type in
msfupdate, is this it, excellent! So, if you type in msfupdate
in a root terminal, it will update the Metasploit framework. I would
suggest to do this as often as possible. It says, Note: expect weekly(ish)
updates using this method. So, I mean, if they issue weekly updates, you
should definitely consider updating it at least twice a week just to be sure,
just to make sure that you have those latest updates readily available at hand.
Now this here where it says username, security, password, blank, this is nothing,
this is a banner. Don't let that confuse you. Let me just to show you
banner, you see it changes, and then it changes again. I don't know why but a lot
of these banners are actually cows. There is a logic to it,
but I'm gonna let you actually figure it out.
I'm pretty sure I knew that a while ago, but it doesn't really matter. So, a cow, this
one, Metasploit, a cow again, cow again, this sign, cow again. So there we go, you
can just keep on typing in banner and it's gonna give you different banners. I
do believe that every time you start by this point it does actually give
you a different banner. Now go ahead and type in -help just to see a ton load
of options that you have here, that you can use. So, if you, and the usage of
commands is pretty much the same as in a Linux shell, so don't worry about it.
What you have used thus far you can use here. So you have change directory, okay, for
change of banner, back. Now instead of using cd.., you would use
back to exit a current payload, or exploit, or whatever. Anyway,
apparently you can even change colors. I'm not gonna do that now, those are all
aesthetics, it doesn't matter. So you have connect, edit, exit, it will exit
completely. That's how you quit msfconsole. You got a lot of
things down here. So, help for help menus. And you usually would use space -h
for commands here just like you would use in a Linux shell as well. It would
give you a list of options. Info, it displays info about modules, we will soon
get into that. You can also say jobs, because in Metasploit you can
issue several jobs, and they can all run in the background. And you can list them,
and then you can summon them into the foreground as well to see what is going
on, to give you real-time updates. So that's not a bad idea. Now you might get
an option, it goes like this, search. Now if you type in search and
if there is a yellow flag telling you that you are not connected to a database,
after all that we did thus far. Well, we didn't do much, we just started two
services, basically, and we have given metasploit a database to use. Just go ahead and
type in db_rebuild_cache, the one that I'm selecting now. If that doesn't work,
go ahead and exit Metasploit, reset the computer, and repeat the steps see if
that helps you out. If it doesn't help you out, come back on udemy, post it in
the discussions, and I will see what I can do. But, just try resetting it a
couple of times, resetting Metasploit, resetting postgresql, and
reboot the system. I don't know why, sometimes it breaks. I don't know, it's a
free version, it's open source, and it's fantastic, but of course it's not perfect.
So, you have to work with me here and adapt a little bit. Anyway, we will use
some of these commands, but I wanted you to have a look at them and just know how
to summon them. I would strongly recommend that you go at least through
some of them, through at least a couple of more that we're going to use today,
just to familiarize yourself with a bit of extra information, as Metasploit is
huge. I mean, it is gigantic. There are so many things in it, there's so many
exploits, there's so many modules, there's so many payloads, it is ridiculous. Let me
just
banner. Okay, so there are 1,400 there, and 900 here, 244 here,
363, 37, 8. I think it sums up to around 3k, or something of a kind, not sure, but
3,000 things to use in general is a pretty large number. Plus, Metasploit also
supports scripting. You can write your own scripts, you can use as payloads and
deploy them, it's just ridiculous how many options it possesses. We're gonna go
through some of them today, but I would strongly recommend that you keep on
exploring and see what else you can do with them. Out of 3000 things,
basically, that are there, something is bound to work. So you have 1443
exploits that you can attempt on various systems.
Exploits come with payloads and auxiliary come without payloads, and if you just
keep on trying something is bound to work. I mean, they pretty much got an
exploit for every single piece of code that was ever created out there. Well, maybe
not like that, but you get the idea, you get what I'm saying.
Okay, so let's just clear it one more time, I'd like to keep it neat. And now
we're gonna, today we're gonna actually generate an automatic reverse shell for
Windows 8.1. How you deploy it is up to you. You have the benefit of the previous
tutorials of me showing you a couple of things, with the DNS, and with Wi-Fi, and
with all of that. How you can redirect the users, how you can reroute their
traffic, you can manipulate it, and you can use some of those methods. Actually,
you can use almost all of them to actually inject this sort of
code onto your victims computer. Not to inject it, but to actually the trick the
user into downloading it, and into running it. You can even force it by
denying connection, or by, I don't know, saying that it's a new security feature
of a browser, or something of a kind, once the user is redirected to your website.
Because if you alter the DNS settings you can basically say, whenever
the user opens up a browser and browses for any website, redirect them here. And
you can just say, I don't know, Firefox, or Internet Explorer requires
this piece of code as a security update. You just need to
click here to install it, and they click there and they install it. Guess what? You
have a reverse shell back to them. It's not really that difficult, it's not
really that hard. Play around with it and see how it works out for you, benefits
can be numerous. Anyway, before we actually go ahead and start
generating reverse shells, you also have an option search which you are
gonna probably be using extensively. Let's just do space -h, and here you
have, I don't know, various arguments it can pass. Here is how it actually looks
like, the example of a search option, of the search command. We will just go ahead
and type in search, I like to use name:, and what shall we use with name? Let's
say I want meterpreter...oh, yeah, my famous typing. It's
a listener, it's a session that you can open. If I got some of the terminology
wrong feel free to hang me in the discussion section. I'll be more than
happy to accept any reviews or criticism. Nobody's perfect. But, anyway,
here you go. You have these payloads. What else do we got? Okay, so, yup, there we go.
These are a bit neater here. It says payload for Android. I've only said
that I want meterpreter, and here it's usually reverse _tcp,
bind_tcp, reverse_http, reverse_https. So you can even encrypt the traffic. You see there
is one for Android, for bsd, out of all operating systems.
There's Java. Java will work on pretty much anything that has
Java installed on it, which is pretty much anything these days. You even
got ones for Linux, via PHP, PHP will work on pretty much
anything out there as well. Python, well, if they have it installed, sure. If not,
then not. There we go. So there is a payload for the Windows interpreter, and then
you have different variants of different types. I have a specific one in
mind that I plan to use today, but feel free to take a look at these. You have
descriptions here, you have their rating here, it can be poor, normal, and excellent, I
think those three parameters apply, and then you have a description here of
what it actually does. A brief description of how it's done. Anyway,
let's just go ahead and clear the screen. Now that you have some of the basic
options, in the follow tutorial I'm gonna come back and actually generate a
reverse shell and see how it works. There will be a demo. Until then, I bid you
farewell.