All language subtitles for 1. Reverse Shells vs Bind Shells

Before we could start the cool exploitation phase we have to first define a couple things.

So we're going to quickly define different shell types we're going to see and then we're going to define

different types of payloads.

We're gonna see.

So let's first start with the shells.

The most common shell you're going to see is what is called a reverse shell.

Now in this example it is using a tool called Net cat which you're going to see here shortly and a shell

all the shell is is access to a machine.

So when we say we pop a shell that means we get access to a machine.

Now reverse shell or reverse shell means that a victim connects to us.

Here you see it says Target connecting to attack box and you may get asked this question about shells

in an interview.

What is a reverse shell.

What is a buying shell.

So a reverse shell means again.

A victim connects to us.

You see that it says Target is connecting attack box is listening.

So what's happening here is that on the attack box you can see that we have net cat.

This is NC and we're just listening on a port here LDP means listening verbose part so we're listening

on port four four four four.

That means on our machine we're opening up that port when we use net cat on this machine.

It's going to say hey net cat I want to connect to this IP address here.

I want to connect to it on port for four four four.

And when I do that I'm going to establish this bean shell here some and execute bean shell which is

a Linux machine.

If this was Windows it would be command EMC.

So what we're going to do is we're gonna say hey let's connect over here and this is going to connect.

So all we're going to do with reverse Shell is we're going to listen now with the bind shell a little

bit different.

We have our attack box and then our target.

So with the bind shell we actually open up a port on the machine then we connect to it.

So we fire off and exploit that exploit goes in and it opens up at Port and then it's listening for

us to connect.

When we connect on that specific port to that specific machine with net cat then we're gonna go ahead

and get that shell.

And on this side it's going to execute for us that been sdh.

Now if we go back.

Same thing here.

We're going to send some sort of exploit that's going to talk back and say hey I want to when you exploit

this go ahead and just connect to 4 4 4 4 on this machine.

Now this is going to come together very clearly when we get into our exploit development part here in

just a little bit.

But all you need to know right now is that a reverse shell means the target can expect to us a bind

shell means we connect to the target.

Now a little bit more about reverse shells you're going to use reverse shells.

Ninety five percent of the time there are instances where you're going to use buying shells buying shells

most likely are going to be on an external assessment.

If you think about it a reverse shell you're sitting in your home network and you are sitting on a VM

in that VM is using an internal IP address is talking out through net.

It's going through your public IP address and you're attacking a target.

Well how are you going to connect that public IP address of the target back to yourself on an internal

IP.

You're going to have to set a port for it or port trigger on your firewall to talk into that specific

machine.

It's a little bit of extra work you're opening some stuff up on your side.

The other idea is to say hey buying shell why don't I just go ahead and open a port up on that target.

All that my way through my public IP address and I'll just connect to that port.

It doesn't care what IP address you're coming from U.S. is just listening.

So we can come from any IP address and connect that port on that machine.

So this is where buying shares are useful when we have to bypass some sort of firewall or just make

sense sometimes a reversal just doesn't work.

And we have to use a buying shell anyway.

So we have to think about the connection and how it's getting to and from us.

Most of the time especially because you're going to practice a lot in labs and you going to do internal

assessments as well.

Most of your shells are going to come in the form of reverse shell however buying shells do exist and

you should know what they are as well.

And again for an interview you should know the difference.

So before we finish here let's go ahead and take a look at what these look like and I'm going to log

back into my machine and I've got two things open here I've got one into.

We're going to play victim and we're going to play target right or attacker.

So on the attacker if we have a reverse Shell we're going to say next that I want to listen and I like

to do envy LP but you can do LV P as well.

The LP it doesn't matter what order.

I just do the MVP and all fours.

So now we're listening on any on all fours right.

So here we're gonna say on the victim's screen we're gonna say Hey net cat I want to connect and this

is a self connection but still I want to connect to the victim machine.

I want to connect to my attacker from the victim machine and our attacker's IP addresses one thirty

nine they've got four four four four open let's establish that connection and we're going to offer them

bin bash only do and here's that connection.

So this is a reverse shell.

We were listening as the attacker and then the victim connected to us and then we could say something

like where am I.

And you could see root and then hostname Calleigh and we have a connection and we offered up that bin

bash here.

So that works.

So that is an example of a reverse shell.

So on the control see this connection kill it.

It dies over here.

Now let's say we wanted to flip the script do we want to bind shell.

Well now guess who needs to be listening.

Now in this instance we're gonna be listening and we're going to be offering up the bin bash because

we are the victim.

OK.

So we still have to offer up whatever command line we are going to have here.

Now all we have to do as the attacker is connect to our victim

and we have the same connection.

You see the connection happens here where my root hostname Colby.

So that is the difference between a find shell and a reverse shell remember reverse shells are most

commonly used but buying shells are important.

Again just to hammer home reverse shell means the victim connects to us by and shell means we connect

to a victim.

So I'll catch you over in the next video when we talk about stage versus non stage payloads.