Jack wants to plant a reverse shell from his office computer to his home computer after work hours. However, his home computer has a dynamic IP address that changes each time he connects, so he would not know the IP address in advance. To solve this problem, the document discusses using dynamic DNS to check if the home computer is online before transferring the reverse shell payload. It provides code snippets to continuously check for an ICMP response from the dynamic DNS hostname, and if a response is received, it will transfer the reverse shell payload and spawn the shell. The document concludes with a demonstration of this dynamic reverse shell technique.

1. Spawning Reverse Shell
Anytime With Any IP !
Bhaumik Merchant

2. Author And Speaker at….

3. Objectives
• Reverse shell basics
• Advance reverse shell method
• Dynamic DNS concepts
• Demo

4. Let’s Consider One Scenario To
Understand Reverse Shell Attack……
• Jack works in a corporate environment which is protected by
IPSs , IDSs , Firewalls etc.
• He plans for an attack , and decides to plant reverse shell ,
because few security mechanisms permit some amount of out
bound traffic.
• He wants to spawn the shell from his office machine to home
machine after 6 p.m, i.e. once he reaches his home.

5. • Jack wants one live system which is up and going,
plus a handler running on it at his place, to receive
the shell.
• Jack must know the IP address of his home machine
before planting the shell in the office machine.

6. Then what is the roadblock for Jack?

7. • Jack’s home machine should be working during the
office hours with the handler listening on some port
to get the shell .
• Jack should know the IP address of his home machine
before planting the shell into office machine.
• But if he is using PPP or DHCP mechanism then IP
address will change for each connect and disconnect.
(ISPs allocates Dynamic IP to home users, e.g. Home
Routers , Internet Dongles)

8. What Is The Original Problem In Following
The Formal Way To Spawn Reverse-Shell?
• Your Place
• Your Time
• Your IP

9. #include < reverse-shell.h>

10. • Handler started in the attacker machine.
One
• Payload transfer phase from attacker to victim
machine.
Two
• Reverse Shell or msf payload injected in the victim’s
machine.
Three
• Attacker get’s victim’s bash/cmd (Attack !! )
Four

11. Formal Way To Spawn The Reverse
Shell !
Attacker
Handler Started In
The Attacker’s
Machine
Inject Shell Into The
Victim’s Machine
Handler Gets The
Reverse Shell
Game Over !

12. Formal Flow Of Reverse-Shell - I
Attacker
Start Handler
No
If Handler Is
Started ?
Yes
Wait For Reverse-Shell
Get Reverse-Shell
Game Over !

13. Dynamic Flow Of Reverse-Shell - II
Attacker
Start Handler
Handler started or may not
have started but still you can
Yes
If Handler plant reverse shell
Is Started ?
Yes
Wait For Reverse-Shell
Get Reverse-Shell
Game Over !

14. Base Level Mechanism (Diagram)
EXE - I Synchronous
Execution
EXE - II
EXE-I :- Existence check for attacker , whether online or offline
EXE-I I :- Transfer reverse shell to attacker machine, Any Payload.

15. So How It Works (I) ?
A
Victim’s Machine Sends
Some Packets To Check Attacker Machine
The Existence Of Attacker Listening For Reverse Shell
V
EXE – I In Execution

16. So How It Works (II) ?
A
Victim’s Machine Sends
Some Packets To Check Attacker Machine
The Existence Of Attacker Listening For Reverse Shell
V
Execution Of EXE – I Completed !

17. So How It Works (III) ?
A
Victim’s Machine Sends
Some Packets To Check Attacker Machine
The Existence Of Attacker Listening For Reverse Shell
V
Execution Of EXE – II Started N Game Over !

18. #include < my-method.h>

19. Dynamic Flow Of Reverse-Shell - II
Attacker
Start Handler
Handler is started or may not
have been started but still you
Yes
If Handler Is can plant reverse shell
Stared ?
Yes
Wait For Reverse-Shell
Get Reverse-Shell
Game Over !

20. How To Program it ?
While(true)
{
if( icmp reply from hh2012.dynamic-update.com)
{
break;
}
}
Void Reverse_Shell_Transfer()
{
Transfer Reverse Shell;
}

21. Captured DNS Request Made By
Normal Browser

22. Captured DNS Request Made By Our
EXE In Live Attack

23. Let’s Get Our Hands Dirty !
#include < demo.h>

24. Thank You
Backdoor.security@gmail.com
Bhaumik.merchant@indusface.com