mirror of
https://github.com/kmanc/remote_code_oxidation
synced 2026-06-08 15:21:46 +00:00
kmanc
645a41a9ed
* Update index.md * Update process_hollowing.md * Update process_migration.md * Update tcp_reverse_shell.md * Update xor_params.md
58 lines
4.3 KiB
Markdown
58 lines
4.3 KiB
Markdown
---
|
|
title: "TCP Reverse Shell"
|
|
datatable: true
|
|
---
|
|
|
|
# RCO: TCP Reverse Shell
|
|
|
|
[](https://github.com/kmanc/remote_code_oxidation/tree/main/tcp_reverse_shell)
|
|
|
|
<div class="datatable-begin"></div>
|
|
|
|
Target OS | Demo
|
|
--------- | ----
|
|
Linux | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/tcp_reverse_shell.gif)
|
|
Windows | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/gifs/tcp_reverse_shell_windows.gif)
|
|
|
|
<div class="datatable-end"></div>
|
|
|
|
## How it works
|
|
|
|
The reverse shells for both Linux and Windows work by establishing a [Transmission Control Protocol (TCP) session](https://www.scottklement.com/rpg/socktut/overview.html) from the victim machine to the attacking machine. Then a Terminal (Linux) or Command Prompt (Windows) process starts with its [standard input](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin)), [standard output](https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)), and [standard error](https://en.wikipedia.org/wiki/Standard_streams#Standard_error_(stderr)) all assigned to the TCP session. This means that input commands and output results are read from and written to (respectively) the TCP stream.
|
|
|
|
|
|
## Using it
|
|
|
|
1. *[Not shown in demo]* Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/main/rco_config/src/lib.rs)
|
|
and change the IP address and port to match the IP address of your attacking machine and the port you will use for a listener respectively
|
|
2. *[Not shown in demo]* Compile the executable
|
|
1. For Linux targets
|
|
```commandline
|
|
cargo build -p tcp_reverse_shell [antisand][,][antistring]] --release
|
|
```
|
|
2. For Windows targets
|
|
```commandline
|
|
cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell [antisand][,][antistring]] --release
|
|
```
|
|
3. Start a netcat listener on the attacking machine on the same port you configured in step 1
|
|
```commandline
|
|
nc -nlvp 4444
|
|
```
|
|
4. Execute the payload on the victim machine
|
|
5. Return to the listener and enter desired commands for the victim machine to run
|
|
|
|
|
|
## Detection rates
|
|
|
|
<div class="datatable-begin"></div>
|
|
|
|
Target OS | Features | Detections | Screenshot
|
|
--------- | ----------------------------- | -------------------------------------- | ----------
|
|
Linux | None | [0 / 40](https://kleenscan.com/scan_result/a940621ddd4de3ac694ab97584536a1e0a06a222f174d023051c5c7786cb02ce) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/linux/shell.png)
|
|
Windows | None | [0 / 40](https://kleenscan.com/scan_result/3125f79d0b309eaecab29d4dbd8fb1521a53ca9bbd0f0b08f469a9c21cb0cb7b) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell.png)
|
|
Windows | `antisand` | [0 / 40](https://kleenscan.com/scan_result/5554067d19d276e3b9c85967d1c0044bdf3d1ab3ca36be816cc4f80d0296df1b) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antisand.png)
|
|
Windows | `antisand,antistring` | [0 / 40](https://kleenscan.com/scan_result/a0dc07b781618acdbc07c32cb12e5a41a860904672c288ba860a830e645eaaf8) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antisand_antistring.png)
|
|
Windows | `antistring` | [0 / 40](https://kleenscan.com/scan_result/2430b38a062a6aa57ac52f508308bcc171b258fc04c06d9d05ae39c0bd1e7417) | [](https://raw.githubusercontent.com/kmanc/remote_code_oxidation/main/docs/assets/images/windows/shell_antistring.png)
|
|
|
|
<div class="datatable-end"></div>
|