Hello everybody and welcome back.
And we successfully coded for now a simple message program which sends messages back and forth not just
by simply changing the IP address to bind to an IP address to connect to you can run this on two different
machines on local network or if you do put forward you can run these two programs across the globe.
But right now we are not here to make a simple message program.
We are here to actually make a reverse shell which will run quietly and not be detectable by the target.
So we do not want to prompt the target with the type of message to send to server.
So let's actually make our reverse shell to be able to actually execute this system commands and by
system commands.
I mean the command prompt commands so if we type for example there or something like that we get a list
of all the files in the current directory.
So let's see how we can actually do that.
There is a library in Python called Sub process which allows us to actually execute commands the terminal
commands on the system with the python.
So let's use that library.
Just type here.
Import some process.
I believe that's how you specify it.
If it's not we will have to check it out on the Internet and what we want to do is we want to first
of all delete this.
So if message equals Q that should stay right here so the break and Q stays right here.
This is what goes away.
So we do not want to prompt use or anything.
We do not want to use raw input on the client side or on the reverse Shell side of the code.
What we want to do is basically execute the command that we receive.
So how do we do that.
Well basically we first of all receive the command so we received the command right here.
So let's rename it into the command so you don't get confused.
We do not want to print the command on diversions so delete this as well print message or command delete
that and here delete this ok not send message back.
So right now you should be having only this we only received the command if the command equals Q.
So we have to change that as well.
So not anymore message.
If the command post you know then we break out of the loop else we want.
We want to run a rather long command right now since that is the syntax for this command which allows
us to actually execute a terminal command or a command from comment.
We will call it proc as a process equals.
And now just type what type sub process not be open.
So process open and then we want to run the command which is this that we received and then comma shell
equals true then comma as to the out equals sub process that pipe.
We make sure to type capital type so it doesn't traditionally people work with the small type.
Let us analyze this.
So it all fits.
Let's actually just close this for now.
Well let's analyze this terminal.
So we are only redoing the client right now so else proc equals our process be open.
We run the command that we receive shall equal strew as to the out equals surpasses that pipe.
And then after that as to d e r r as D E R equals s process that pipe as well as standard input also
equals a process that pipe so did the N equals sub process that pipe.
So we want to pipe that process or that result from the command that we received and we will do that
with the result variable.
So we just create a variable called result or call it anything you want I of call it result in my case
and we want to call it proc dot as to d out dot read or not call it we want to add to it plus proc dot
as to the E R dot.
So we want to put both of these outputs of the command that we executed into our result variable and
all we have to do right now is actually send the result back to our target.
We do that with the command that we already use.
So SOC sort about send result and we should be good to go.
So let's see is there anything that we have to change in our server program so this should be it for
you.
This I believe if it is not we will add things necessary.
So control 0 to say enter control X to exit this.
Now let's actually nano this server that P Y let's close it in the other terminal since we do not need
it so let's exit this for a second.
That's only use this terminal for a moment and this is our server.
So right now we send the message which we also want to switch to command.
So we don't get confused.
So command targets send we send to the target command if the command equals Q we'll break out of the
loop and answer which will be the result equals target not receive and then we print the answer.
So this should be good.
I believe so if you switched everything for the command all the messages you switch for the command
and name the answer rename it to results.
So it makes sense if more and print the result Dom pretenders.
Since we don't have the variable answer anymore right now you can control orders this as well.
Control X to exit and we can run the server it is listening for the incoming connections right now let
us open a second terminal enlarge it a little bit two men
let us just make this a little bit more viewable so let's split this into two that's also at this one
here.
OK so this should be good.
Right now let me just switch my directory to where my reverse is and I run the reverse shell.
So we successfully got connection established the server.
And right now what I want to do is first of all modus so we can see both of these terminals and right
now I should be able to execute commands in a terminal.
Let's see how well that work.
If I just type here as we can see that we successfully got back from the other terminal we got back
the contents of that directory.
If I just type here who am I.
I get back through it.
So I am the root user.
If I were to for example type your reboot it would restart my machine.
So we successfully were able to create a program that actually execute the command commands terminal
commands and the command prompt comments on the target machine.
So we successfully created this more simple version of the reverse shell.
This can also be dangerous and it can also be used to change some things on the target machine especially
if they run it as an administrator or as the road user.
So let's see what else we can run TWD Alice minus Ali but you will notice if I for example run out our
code for the IV config OK.
So for this example we get the full output but you will notice that we only specified the received function
to receive 1024 bytes.
But what happens if we actually try to receive more bytes than that that will actually crash our program.
So what we want to do work we want to actually be able to send as much data as we want and receive as
much data as we want.
And we also have to fix some bugs such as this one where I just press enter and don't send anything.
It just bugs out as we can see it is waiting for a reply but our reverse Shell doesn't know what to
reply with since the command that it received was just nothing.
It wasn't anything with just an empty space so it can't execute that command therefore it can't send
the answer back to our server.
Therefore they are both hanging on waiting each other's requests.
So that's something that we also have to fix.
There are many things that need fixing here but this is pretty good for our beginner reverse shell.
Now we have to fix it a little bit at some of the functions here and there.
Fix some bugs and then we can continue adding different options for our reverse shell.
So that would be about it for this video.
I hope you enjoyed it and I hope I see you in the next one by.