In this lecture, we'll see how we can get a reverse connection from our we shall.
So at the moment we uploaded Wheatly and we're connected to it directly using this URL.
So when we hit enter, we're actually just doing a direct connection and it's as if we're just interacting
with a normal script uploaded on that directory.
So what we want to do is maybe in some cases you can't really run commands like this.
So right now I can run whatever command I want, whatever the next command.
We also see how we can use the shell as a function that comes with Wheatly to try and bypass if we can't
run commands, if none of that works or if you want it, just an actual direct reverse connection from
the target web server to our machine, then you can follow what I'm going to do in this lecture.
It can be really handy because you'll have a direct connection and you'll be able to bypass a lot of
security measurements.
So we're going to do help first to see the options that we have and the function that I want to use
today is the reverse.
Whereas it's back to reverse stickpin and it basically just gives you a reverse TCP shell so it won't
be executed therapy up, it'll be a reverse shell reverse connection coming from the target server towards
your computer.
And because of that, it will bypass firewalls because the connection is coming out of these Web server,
not to the Web server.
So the first thing we got to do is, as usual, we're just going to run backdoor reverse TCP and I'm
going to put minus haste to see the options that we can get with this function.
And you can see the way to use it is the first thing you need to specify the name of the function,
followed by the type of shell.
So we're going to leave that the same.
You can tell it not to auto connect what we don't want that we actually want it to automatically connect.
And then you can specify the vector.
And again, the vector is very important and it specifies the way the reverse connection will be spawned.
So you can use netcode, it can be done through notecard, it can be done through Python, it can be
done through Perl, Ruby.
These are all programming languages.
So if the connection doesn't if the target server doesn't have Netcare installed or if it has certain
security or permissions that prevent you from using that card, then you can try to get your shell through
Python.
If Python is not installed or if it has some sort of measurements that prevent Python from connecting
back to you, then you can do it through Perl.
And again, if Perlis configured in a way that it's not allowed to spawn reverse connections, you can
do it through Ruby.
And again, you can use any of these vectors until one of them works for you.
And once one of them work for you, chances are you're going to be able to bypass a lot of security
measurements.
Definitely you'll be able to run dash commands on the target server.
So if if you can't run back commands normally and if you tried the Shell S.H. function that we seen
in an earlier video and still didn't work for you, then you should come to this try this method.
If it works, then you'll be able to run any shell commands you want on the target server.
So let's try it in action.
So we're going to type in backdoor.
Reverse Tsipi.
We're going to give you the victor.
And I'm going to want to use netcode.
And then we're going to give it dependent on this, as you can see, so we did that and we gave it the
vector, then we need to give it our localhost.
So the IP address of our current computer, followed by the port that we want the connection to be done
through.
So to get the IP address of my computer, I'm just going to run it config.
And you can see that my IP address is 10, 2014 to 13, so I'm going to close this.
And then we're going to give you the portrait and I'm going to set the poll to 1880.
So the command is very simple bacteria, WCP vector, which is going to be not cut, and then we put
our current IP address, followed by the port, that we want the connection to be done through.
I'm going to enter.
Now, the connection established, so now we can run any commands we want and keep in mind that these
commands will be executed through Netcare.
So the connection is coming back now from the server to us and now we're communicating with it through
a completely different port.
It's not going to go through.
We believe it's actually going to go through a net cut.
So if there was some sort of security that didn't allow us to run commands through, we then will be
able to bypass them now.
So now we can use it.
We're going to do, for example, and we have to add a semicolon after it.
You can see that where we are, we can do.
Who am I?
Seems like we lost our connection, so I'm just going to do it back.
So, again, we can do who am I?
We can pretty much do any command we want.
Now, again, if this didn't really work for you, you can go ahead and try a different vector.
You can try the python.
You can try the pearl.
After each of these vectors, try to see who am I and see the current permissions or the current user
that you're us because you might actually be running under a different user.
One thing to keep in mind here is your IP, because the connection is a reverse connection, so it's
coming back from the target web server to your computer.
Therefore, at the moment, I'm actually using a private IP within my current network, but it works
because the website is on the same network.
If I was doing this against a real website, this wouldn't work because my private IP is not accessible
publicly because it's hidden behind the router.
So if you want to receive connections, if you receive reverse connections from an actual Web server,
and if you're not on the same network as that Web server, then you need to either set up your Caleigh
machine as a DMZ host or you need to enable IP forwarding to enable the port, the port that you're
using here.
So AT&T in this case, to be forwarded to your private IP.
You can do both of these things from the control panel of your outer, your outer is usually located
at the first IP.
So my IP now is 10, 20, 14 to 13.
The writer is usually at the first i.p, so it will be at the one so you can access that through the
browser, look for the option called DMC and said the Kali machine as a DMC host.
Another option is to go to port, forwarding other all to forward Port 880 to the IP of the candy machine.
Also, make sure the IP, the candy machine is connected to your actual network and it's not set up
as a network like this.
So make sure you have a wireless card connected to your home network and from there you will have an
actual IP in your network instead of a private virtual IP like we have here.