Shells & Listeners Fundamentals

In many real-world assessments, a minor bug becomes a foothold. Imagine a file upload feature that fails to validate content type properly. You slip in a tiny script, trigger it, and suddenly have remote code execution (RCE). But RCE alone is not the finish line, you still need a remote shell to control, stabilise, and upgrade to enumerate, pivot and escalate privileges. This room teaches you the practical craft of catching, using and hardening shells so you can move from "code runs" to "I own this box".

A shell is a command-line environment that interacts with an operating system. On your own machine, that's a local shell (e.g., bash on Linux, cmd.exe or PowerShell on Windows). In offensive security, you aim to obtain a remote shell on a target so you can run commands there from your attacker's host. Initial shells are usually non-interactive ("half-shells"): no tab-completion, no job control, broken su/ssh, and no proper TTY. We'll fix that.

Learning Objectives

• Understand the difference between reverse and bind shells and when each is appropriate
• Use nc and socat to establish shells reliably
• Stabilise shells into fully interactive TTYs (Python, rlwrap, socat-PTY)
• Practise everything on Linux first, then repeat key patterns on Windows

Prerequisites

• Basic Linux CLI (cd/ls/cat, file permissions, processes)
• Basic networking (IP/ports, TCP vs UDP, listening vs connecting)

Machine Access

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Attacker machine

Status:Off

Lab machine - Task 1

Status:Off

Start Lab Machine

The Linux target machine includes nc and socat pre-installed. You'll need to SSH into the target VM with the following credentials: