Welcome everybody to this tutorial.
Today, I will open up a chapter on reverse shells.
Now, let me begin by just explaining what they are in general.
Basically, a reverse shell would be something that you put a piece of code,
that you would place on a device, mainly on a computer.
But you can also place it on a phone and pretty much SmartPhone like an Android
device, or an iPhone, or something of a kind.
And then you are able to control such devices
remotely from the location of your choice.
Now, to do this over the Internet, it's a little bit trickier and
you would have to combine several things, what we have learned thus far.
For example, you would have to first, if you had a computer at home and
if you didn't have a VPN with a static IP,
you would need to configure your own router.
Well actually it's not that hard,
all you would need to do is put an IP address of your computer.
So I have config, you can also use the IP of a virtual machine no problem.
If it's in the bridge mode as I have showed you.
And you would need to find an option DMZ, so
demilitarized zone as it is usually referred to.
And you would basically put this IP address.
Keep in mind if it changes that you need to put it back in.
That you need to change the DMZ as well.
I've decided not to show you how to do this on a router because I could only show
you how to do it on my own router, and there are various routers out there.
But, look, it's pretty simple.
Just open up your Web interface of a router, and find DMZ.
So DMZ.
There's usually just one option, one field.
You can only put one IP address.
And just type in this IP address, and
then you will be able to use your public IP address
which you can get by typing in your favorite search engine, what is my IP.
Then get that public IP address, and you can use that IP address as a listener for
all the reverse-shells you create.
Now, there are several approaches here,
in terms of deployment and creation of a reverse-shell.
To create them you can either code it yourself,
which is a preferable way primary because the reverse shells that you
can generate automatically, can be detected by anti viruses, and
that's not what you really want, you want something that's undetectable.
But for the time, coding a reverse shell on your own, I can tell you, it's not
a simple task, especially when you need to do hex dumps to avoid privileges and
stuff of a kind, to avoid firewall detection.
But look, basically if you code
it yourself, it's probably
going to be something simple.
It's going to be far away from professional, it's going to be bad.
Let's face the reality of things.
However, because it's bad, because it's unprofessional,
because it doesn't contain any complex functions, because it
doesn't contain the usual patterns that a pro reverse shell would contain,
it is not that likely to be detected by antiviruses.
So that's a big plus for you.
So if you can even code the basic reverse
shells, just look it up on the net.
I'm not gonna get into that because that would be
a separate course for itself, a programming course.
If you can code even the basic reverse shells,
you stand a very good chance of not getting detected primarily because
your reverse shells will be noobish, and that's a good thing.
That can be a good thing, actually.
Anyway, it is unlikely that you will pass the detection
by an automatically generated reverse shell
on a fully updated system, so keep that in mind.
You need to look for a system that doesn't have the latest updates,
that is behind in such a sense.
And then you have a very good chance of passing with an automated reverse shell.
The tool for or the framework for
creating reverse shells is Metasploit.
Metasploit is a fantastic framework used by pen testers all around the world.
Now professionals use a paid version, pro version, which costs,
I remember a long time ago, I knew the exact price, but it doesn't really matter.
It was around $5000, so 5k per license per month.
That costs quite a bit.
Things might have changed.
In the meantime, it's been a while since I checked those prices out.
But I'm just trying to make a point that even though the pen testing companies
are paying such prices, and they're not paying it for
a single license, usually they're paying for more than one.
Even though the program is open source.
If the program is open source,
that doesn't necessarily mean that it's free of charge.
Of course, we will be using a free of charge version.
You don't have a good interface there.
You have to do everything by terminal.
So that's kind of a down side for some but not to the fullest of extents, and
there are some features that are only available for the pro version.
However, if you feel like paying 5k per month,
just go over on the net, type in Metasploit in the search engine,
and your first result should be their official website.
Anyway, without further ado, we're gonna get into Metasploit immediately.
I'm gonna go ahead and clear the screen and
we will use it to generate a script, and we will also use it as a Listener.
Now, Metasploit, I mean you can run it just by default in Kali without
actually doing any sort of configuration of whatsoever.
But I don't recommend it.
Primarily because you can speed up pretty much everything by
just doing a few simple things.
So go ahead and type in, service.
We will give Metasploit framework a database to use.
And if it's use as a database it is faster.
So type in postage, SQL.
Start.
You will need to start postage SQL.
It's already running for me.
I can just type in status.
And there you go, it says running clusters.
Anyway.
Go ahead and clear the screen.
Type in service Metasploit.
Start.
And, this should start the Metasploit service, as well.
I'm gonna type in status.
And, okay.
So there are a few things that will start up,
once you type in service Metasploit start.
Anyway, go ahead and clear the screen.
Type in msfconsole.
Press Enter.
And and I gotta warn you.
This is gonna take a while, actually, to start.
Primarily because Metasploit is pretty big, it has a lot of things in it.
And it takes a while on a virtual machine to actually start,
primarily because of the limited resources.
Let me just go ahead and open up another terminal and
type in msfupdate, this is it.
Excellent. So if you type in msfupdate in a root
terminal, it will update the Metasploit framework.
I would suggest to do this as often as possible, says,
note, expect weekly or weekish updates using this method.
So, I mean, if you are, if they issue weekly updates you should
definitely consider updating it at least twice a week, just to be sure.
Just to make sure that you have those latest updates readily available at hand.
Now this here, where it says, username and security password line.
This is nothing, this is a banner.
Don't let that confuse you, let me just show you.
Banner.
You see?
It changes, and then it changes again.
I don't know why, but a lot of these banners are actually cows.
There is a logic to it.
But I'm gonna let you actually figure that one out.
I'm pretty sure, I knew that a while ago, but it doesn't really matter.
So, a cow, this one, Metasploit.
A cow again.
Cow again.
This sign, cow again.
So there we go, you can just keep on typing in banner, and
it's gonna give you different banners.
I do believe that every time you start Metasploit,
it does actually give you a different banner.
Now go ahead and type in help,
just to see a ton load of options that you have here that you can use.
And the usage of commands is pretty much
the same as in a Linux shell, so don't worry about it.
What you have used thus far, you can use here.
You see I've changed directory, okay, for a change of banner back.
Now instead of using cd space .., you would use
back to exit a current payload or exploit or whatever.
Anyway you can apparently, can even change colors.
I'm not gonna do that now.
Now those are all aesthetics, doesn't matter.
So you have connected it.
Exit will exit completely.
That's how you quit.
MSFConsole.
We've got a lot of things down here, so help for help menus.
And you usually would use, space -H for commands here.
Just like you would use in a Linux shell as well.
It would give you a list of options.
Info, it displays info about modules.
We'll soon get into that.
You can also save jobs, because in Metasploit you can issues several jobs and
they can all run in the background.
And you can list them and then you can summon them into foreground as well
to see what is going on to give you real time update, so that's not a bad idea.
Now, you might get a, there's an option that goes like this, Search.
Now if you type in search, and there is a yellow flag telling you that you're
not connected to a database after all that we did thus far.
Well, we didn't do that much.
We just started two services basically.
We have given Metasploit a database to use.
Just go ahead and type in DB rebuild cache, the one that I am selecting now.
If that doesn't work, go ahead and exit Metasploit,
reset the computer and repeat the steps.
See if that helps you out.
If it doesn't help you out, come back on Udemy, post it in the discussions, and
I will see what I can do.
But just try resetting it a couple of times, resetting Metasploit,
resetting post SQL, and resetting reboot the system.
Don't know why sometimes it breaks.
I don't know. It's a free version, it's open source, and
it's fantastic.
But of course, it's not perfect.
So you have to work with me here and adapt a little bit.
Anyway, we will use some of these commands but
I wanted you to have a look at them, and just know how to summon them.
I would strongly recommend that you go at least through some of them,
through at least a couple more that we're going to use today,
just to familiarize yourself with a bit of extra information, as Metasploit is huge.
It is gigantic.
There are so many things in it.
There are so many exploits.
There are so many modules.
There are so many payloads.
It is ridiculous.
So let me just, banner.
Okay, so there are 1,400 there, 900 here, 244 here,
363, 378, I think it sums up around 3k or something of a kind.
Not sure.
But 3,000 things to use in general is a pretty large number.
Plus Metasploit also supports scripting.
You can write your own scripts, you can use as payloads and deploy them.
It's just ridiculous how many options it possesses.
We're gonna through some of them today, but
I would strongly recommend that you keep on exploring and
see what else you can do with them.
Out of 3,000 things basically that are there something is bound to work.
So you have 1,443 exploits that you can attempt on various systems.
Because exploits come with payloads and axillary comes without payloads.
And if you just keep on trying, something is bound to work.
I mean, they pretty much got an exploit for
every single piece of code that was ever created out there.
Probably not like that but you get the idea.
You get what I'm saying.
Okay, so let's just clear it one more time.
I like to keep it neat, and now we're gonna,
today we're gonna actually generate an automatic reverse shelf for Windows 8.1.
How you deploy it is up to you.
You have the benefit of the previous tutorials of me showing you
a couple of things with the DNS and with Wi-Fi, and with all of that,
how you can redirect the users, how you can reroute their traffic,
how you can manipulate it and you can use some of those methods,
actually you can use almost all of them to actually inject this
sort of code onto your victim's computer.
Well, not to inject it, but actually to trick the user into downloading it and
into running it.
You can even force it by denying connection, or
by saying that it's a new security feature of a browser, or something of a kind.
Once the user is redirected to your website because if you alter the DNS
settings, you can basically say, whenever the user opens up a browser and
browses for any website, redirect him here, and you can just say, I don't know,
Firefox, or Internet Explorer
requires this piece of code as a security update.
You need to install, you just need to click here to install it and
they click there and they install it.
Guess what?
You have a reverse shell back to them.
It's not really that difficult.
It's not really that hard.
Play around with it and see how it works out for you.
Benefits can be numerous.
Anyway, before I actually go ahead and start generating reverse shells,
you also have an option search which you are gonna probably be using extensively.
Let's just usespace-h.
And here you have various arguments it can pass.
Here is how it actually looks like.
The example of the search command.
We will just go ahead type in search.
I like to use name, and what shall we use with name?
Let's say, I want meterpreter,
which is a listener.
It's a session that you can open.
If I got some of the terminology wrong,
feel free to hang me in the discussion section.
I'll be more than happy to accept any reviews or criticism.
Nobody's perfect.
But anyway, here you go, you have these payloads,
what else do we got, okay, so, yep, there we go.
These are a bit meter here.
Says payload for Android, I've only set at one
meterpreter and here it's usually reverse TCP,
blind TCP, reverse HTTP, reverse HTTPS,
so you can even encrypt the tri-fect.
You see there's one for Android for BSD, out of all operating systems.
There's Java one.
Java one will work on pretty much anything that has Java installed on it,
which is pretty much anything these days.
You even got ones for Linux via PHP.
PHP will work on pretty much anything out there as well.
Python, well if they have it installed sure, if not then not.
There we go, so there is payload for Windows meterpreter,
and then you have different variants of different types.
I have a specific one in mind that I planned to use today but
feel free to take a look at these.
You have descriptions here.
You have their rating here.
They can be poor, normal and excellent.
I think those three parameters apply, and
then you have a description here of what it actually does.
A brief description of how it is done.
Anyway, let's just go ahead and clear the screen.
Now that you have some of the basic options, in the follow up tutorial,
I'm gonna come back and actually generate a reverse shell and see how it works.
There will be a demo.
Until then, I bid you farewell.