Gray Hat Hacking, Second Edition, 2nd Edition

Implementing Reverse Connecting Shellcode

The last section was nice, but what if the vulnerable system sits behind a firewall and the attacker cannot connect to the exploited system on a new port? As discussed in the previous chapter, attackers will then use another technique: have the exploited system connect back to the attacker on a particular IP and port. This is referred to as a reverse connecting shell.

Reverse Connecting C Program

The good news is that we only need to change a few things from our previous port binding code:

1. Replace bind, listen, and accept functions with a connect.

2. Add the destination address to the sockaddr structure.

3. Duplicate the stdin, stdout, and stderr to the open socket, not the client as before.

Therefore, the ...