Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.
- Create BookmarkCreate Bookmark
- Create Note or TagCreate Note or Tag
- PrintPrint
Backdoors > Reverse Shell
Reverse Shell
A reverse shell is a connection that originates from an infected machine and provides attackers shell access to that machine. Reverse shells are found as both stand-alone malware and as components of more sophisticated backdoors. Once in a reverse shell, attackers can execute commands as if they were on the local system.
Netcat, discussed in Chapter 3, can be used to create a reverse shell by running it on two machines. Attackers have been known to use Netcat or package Netcat within other malware.
When Netcat is used as a reverse shell, the remote machine waits for incoming connections using the following:
nc -l –p 80
The –l option sets Netcat to listening mode, and –p is used to set the port on which to listen. Next, the victim machine connects out and provides the shell using the following command:
