Definition
A reverse shell is a type of shell session where the target machine initiates a connection back to an attacker's machine, allowing the attacker to execute commands on the target system. This method is often used to bypass firewall restrictions that block incoming connections.How It Works
- 1The attacker sets up a listener on their machine to wait for incoming connections.
- 2A malicious payload is executed on the target machine, prompting it to initiate a connection back to the attacker's listener.
- 3Once connected, the attacker gains a command-line interface to execute commands on the target machine remotely.
Key Characteristics
- Outbound Connection: Initiates from the target to the attacker's machine.
- Bypasses Inbound Firewalls: Effective in environments with strict inbound rules.
- Common Payloads: Bash, Python, netcat, PowerShell.
Comparison
| Feature | Reverse Shell | Bind Shell |
|---|---|---|
| Connection Type | Outbound (Target to Attacker) | Inbound (Attacker to Target) |
| Firewall Bypass | Yes | No |
| Setup | Easier in restricted environments | Needs open ports on target |
Real-World Example
A notable example is CVE-2019-19781, where attackers used reverse shells in exploiting Citrix ADCs to gain remote code execution.Detection & Prevention
- Monitoring Outbound Connections: Use network monitoring tools to flag unusual outbound traffic.
- Endpoint Detection and Response (EDR): Employ EDR tools to detect and block reverse shell activities.
- Firewall Rules: Restrict outbound connections to known and necessary destinations.
Common Misconceptions
- 1Only Hackers Use Them: While often malicious, pentesters also use reverse shells to demonstrate security weaknesses.
- 2Undetectable: Reverse shells can be detected with proper monitoring and security tools.
- 3Complex to Execute: With tools like Metasploit, setting up a reverse shell can be straightforward.