All right, so there are two popular types of shells, bind and reverse.
The usage of them depends on the situation that you're in, in the network.
A Biden show opens up a new service on the target, and it requires you to connect to this service to
get a session.
But on the other hand, it's going to be different for a reversal.
When you're using a reverse shell, you first need to open a service on your host to listen for incoming
probes from the target.
Then the target connects back to your host.
So in a penetration test, you will mostly need to be using reverse because of these reasons and more.
So I'll make it clearer with another example.
For instance, you and a target, maybe in different private networks or a firewall of the target may
block your connection attempts.
What do you do and it's not just limited to these examples, but.
Even when you decide to use a reverse shell due to some egressed firewall rules, the target may not
allow you to get a session.
And that's when you will try to create a reverse shell over some known port that's more typically allowed,
such as 443, 83, 89 and so on.
So when you create the payload, you only provide one port, so you know what, it's not an efficient
way because it kind of makes you try new payloads with a new port on every attempt.
But to avoid this, MSF has another payload type, which is reverse TCP all ports.
You're wondering where I was coming from, huh?
So the reverse TCP payload only allows connection to one port.
But reverse TCP all ports is used to brute force all the ports from one to 65 535.
So one thing to keep in mind, going through the entire port range from one to 65, 535 can take a very
long time.
So think twice before you use it.
You know me.
I see an example and Métis Boydell three.
So open up your terminal and start Métis boy, then search the term all ports in Palos.
And here are the modules related to the term Allport.
And you can probably see the upwards version of some of the payloads that we've been using in the previous
lectures.
You can also display the information of this module.
So let's look at the description of the airport variable.
So it starts on PT. one.
So this means you can set a start value.
So before creating a file with that payload, I'm going to start a handler for that.
To do that will use exploit multi handler as our template.
Set payload to Windows Interpreter.
Reverse TCP Allport.
SAT almost to Collie's IP address.
And show me the options.
So I won't use the set outpoured value.
OK, I'll now open another window to create that ETEC file with reverse all ports payload.
And we'll use MSF venom for this.
P windows.
Interpretor.
Reverse Tsipi, all ports almost equals 10, 10 dot to dot 11.
I'm not going to set Allport even here.
Set file format 2.0 Yangzi.
And zap platform to Windows.
So finally, let's give a name to the output file.
iReports dot exi.
Now I'll go to another town.
And start the exploit in the background.
Jobs to list the background job.
And here's a job that I've currently created.
Now, there's no session as well, so let's go to another time.
Now, I'm going to start a python web here to be able to download Allport, Scott Yuxi from that exploitable
three.
And met a spoiled three is on my second screen, so I'm going to try to bring my parents screen over.
And now I will open Internet Explorer.
Hmmm, I wonder if these warnings are going to let me.
So let's go to HTP tend tend to dot one one Colen eight zero eight zero.
And look at that, as soon as I connect the COLLY, the messages show up on the screen.
So now let's click and download the Allport file.
I'll say that file to the desktop.
And as soon as I click on the file in my disposable three hour session opened in the MSF Council.
Let's look at the connected port.
It is one.
And here are all the sessions.