Technique
technique:reverse_shell
Also: PowerShell reverse shell, remote shell, reverse connection
A shell that connects from a compromised computer back to the tester’s listener.
A shell that connects from a compromised computer back to the tester’s listener.
“my PowerShell, reverse shell”
A connection initiated from a compromised machine back to an operator-controlled server, providing remote command access.
“it was a meterpreter reverse-shell that gave us access into their machine.”
“It was just opening up a reverse connection.”
A remote access mechanism set up on the network-connected computer so it could be controlled from the hotel.
“he sets up a reverse shell to this computer”
“from there, he can remotely connect into this computer”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | USES | Metasploit | Explicit | 69 |
| incoming | USES | Meterpreter | Explicit | 69 |
| incoming | USES | Os | Explicit | 101 |
Tinker Secor USES reverse shell
Tinker deployed a PowerShell reverse shell to obtain remote access to a finance workstation.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“my PowerShell, reverse shell”
“I’ve got a little thumb drive with my malware on it”
Metasploit USES reverse shell
Jack says a reverse shell can be set up with Metasploit in the described remote-access scenario.
Explicit Confidence 98% · Jack Rhysider EP 69 Details
“This is easily set up, too, with a tool called Metasploit. This is just a reverse-shell”
Meterpreter USES reverse shell
The supposed PC cleaner was actually a Meterpreter reverse shell that provided remote access to the employee's machine.
Explicit Confidence 99% · Christopher Hadnagy EP 69 Details
“it was a meterpreter reverse-shell that gave us access into their machine”
Os USES reverse shell
Os established a reverse shell on the long-forgotten computer so he could access it remotely from the hotel.
Explicit Confidence 99% · Jack Rhysider EP 101 Details
“he sets up a reverse shell to this computer”