📖 What is Reverse Shell?
A Reverse Shell is a connection initiated from a compromised target machine back to the attacker's listening machine. This technique is used to bypass firewalls that typically block incoming connections but allow outgoing traffic on common ports like 80 or 443.
"Contrast this with a Bind Shell, where the target opens a port and waits for the attacker; reverse shells are far more common in real-world scenarios."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Reverse Shell?
- ▸ The attacker must establish a listener, typically using tools like Netcat (nc), to wait for the incoming connection from the target machine.
- ▸ Reverse shells are specifically designed to bypass ingress firewall rules by leveraging permitted egress traffic on common ports like 80, 443, or 53.
- ▸ Payloads are often delivered via command injection or malicious uploads, utilizing languages like Bash, Python, or PowerShell to initiate the outbound connection.
- ▸ Initial reverse shells are often non-interactive; testers must 'upgrade' the shell to a full TTY for better control and command stability.
🎯 How does Reverse Shell appear on the PT0-002 Exam?
You may be asked to identify the most effective method for gaining remote access to a target that has a strict firewall blocking all incoming ports but allows outbound HTTPS traffic.
A scenario might describe a situation where you have successfully uploaded a PHP web shell and must now execute a specific one-liner command to receive a connection on your listener.
Expect questions that require you to differentiate between a bind shell and a reverse shell based on which system initiates the TCP handshake and how that affects firewall traversal.
❓ Frequently Asked Questions
Why is a reverse shell preferred over a bind shell in most penetration tests?
Most corporate firewalls block unsolicited incoming connections (ingress) but allow outgoing connections (egress). A reverse shell leverages this by making the target initiate the connection, effectively bypassing the firewall's inbound restrictions.
How can an attacker make a reverse shell less likely to be detected by network monitoring tools?
Attackers often use common ports like 443 (HTTPS) to blend in with web traffic and may wrap the shell in SSL/TLS encryption to hide the command-and-control traffic from Deep Packet Inspection.