Building a Windows Reverse Shell in C Before Converting It to Shellcode

Summary

The video demonstrates a lab reverse shell in C: a Windows process connects back over a socket, redirects its standard streams to that socket, and accepts commands through a Netcat listener. The series plans to convert the working program to shellcode.

Key points

• The presenter uses a C program to establish and test reverse-shell behavior before implementing it in shellcode.
• The program spawns command.exe and redirects standard input, output, and error to the socket.
• The lab uses virtual machines on a VMware NAT network and checks connectivity between them with ping.
• Netcat listens on the configured address and port; running the program connects the victim-role machine to the listener.
• The demonstrated shell runs with the permissions of the user running the program and terminates with Ctrl+C.
• The presenter says this demonstration does not add persistence or process migration; later videos will examine the code and shellcode implementation.

MITRE ATT&CK

Products

Tools

Related Articles

• New Spirals Ransomware Used in Double-Extortion Attack on South Asian IT Companysecurity.comVMware · T1059.003
• APT35-Linked Documents Detail Two RATs, Custom Webshells and Malware Operationscloudsek.comVisual Studio · T1059.003
• SneakyChef Uses SpiceRAT in Phishing Campaign Targeting Government Agenciesblog.talosintelligence.comVisual Studio · T1059.003
• How eBPF Can Detect Kubernetes Container Escapes and Runtime Attackswiz.ionetcat · T1059.003
• Node2Shell Brotli Flaw Prompts Patches Across Microsoft, Node.js and Pythonsecurityweek.comVisual Studio