This project showcases the development of a reverse shell malware written in C. The reverse shell allows remote access to a compromised system for command execution. The goal is to educate about the risks of reverse shells and highlight how attackers exploit such vulnerabilities, as well as how these types of malware evade detection by antivirus software and firewalls. This project is for educational purposes only and demonstrates both offensive and defensive cybersecurity techniques.
- Reverse Shell Access: Enables remote command execution on the target system.
- Keylogger Integration: Captures user keystrokes to demonstrate how sensitive information can be compromised.
- Windows Registry Persistence: The malware is added to the Windows registry to ensure it runs every time the system starts, achieving persistence.
- Antivirus and Firewall Evasion: The project demonstrates how to evade antivirus detection and bypass Windows Firewall on Windows 10, including an encrypted version to avoid signature-based detection.
- First Version: This version is blocked by Windows Defender due to the detection of typical malicious patterns.
- Second Version: This version uses encryption to evade antivirus detection and Windows Firewall and shows a console with attacker commands and activity.
- Third Version: This version is stealthy, does not show a console, and is designed to evade detection by antivirus solutions.
This project is intended for educational purposes only. Unauthorized use of this software outside an ethical, controlled environment is illegal and unethical. All testing must be conducted in a virtual environment, and no unauthorized systems should be targeted.
- Create a Reverse Shell in C: Establish a connection from the target to an attacker's server.
- Keylogging: Capture user keystrokes to demonstrate potential data compromise.
- Windows Registry Persistence: Add the malware to the Windows registry for persistent execution.
- Antivirus and Firewall Evasion: Demonstrate techniques to evade antivirus detection and Windows Firewall.
- Highlight Mitigations: Discuss mitigation strategies to protect systems against reverse shell attacks.
- Virtual Machines: Windows 10 and Kali Linux VMs running on VMware Workstation for testing and simulating the reverse shell attack.
- C Programming Language: The reverse shell is developed in C, showcasing low-level system access and socket programming skills.
- Linux System (for Attacker): Kali Linux is used as the attacker's server to receive the reverse shell connection.
- Reverse Connection: The reverse shell establishes a connection from the target Windows system to the attacker's server.
- Command Execution: Once the connection is established, commands can be executed remotely.
- Keylogging: Captures all keystrokes and sends them to the attacker.
- Registry Persistence: Modifies the Windows registry to ensure the malware runs automatically on reboot.
- Antivirus and Firewall Evasion: Uses encryption to evade antivirus detection and firewall rules.
- Set Up Virtual Machines: Set up both Windows 10 and Kali Linux VMs using VMware Workstation.
- Compile the Code: Compile the C code for the reverse shell using GCC on the Windows VM.
- Start Listener: Use Netcat (
nc -lvnp <port>) on the Kali Linux VM to listen for incoming connections. - Execute Reverse Shell: Run the compiled reverse shell executable on the Windows VM.
- Observe Remote Connection: Execute commands on the compromised system remotely.
- VMware Workstation: Used to set up the virtual environment.
- GCC Compiler: Required to compile the C code.
- Netcat (Kali Linux): Used to receive the reverse shell connection.
This project is intended solely for educational purposes. Unauthorized use of this or similar software to access or compromise systems you do not own is illegal and unethical. All demonstrations must be conducted in a controlled environment.
- Network Monitoring: Use IDS/IPS to detect unusual outbound connections.
- Firewall Rules: Block suspicious outgoing connections.
- Registry Monitoring: Monitor Windows registry changes to detect persistence mechanisms.
- User Awareness: Educate users on the risks of running untrusted software.
Contributions are welcome! Please note that this project is for educational purposes only and should not be used for malicious purposes.
This project is licensed under a custom license. Permission to use, modify, or distribute this software is only granted if explicitly authorized by the owner. Unauthorized use is strictly prohibited.