Remote Shell: Embedding Client-Side Code into a Package

Social engineering is still the easiest way to take advantage of users to gain access to remote systems. In this lab, you will execute a social engineering attack that uses a vulnerable Python package that embeds a remote shell command that is sent as an attachment to the victim. The victim installs the package and runs the Python script which launches the remote shell attack.  

outcomes:

In this lab, you will learn to: 

  1. Insert remote shellcode into a package 
  2. Execute a social engineering attack using a vulnerable email attachment 

videos:

Before you start this lab, review these videos.

Inserting Code into a Program

Spear Phishing

Overview

The development of this document is funded by the Boston Area Advanced Technological Education Connections (BATEC) Grant No. NSF-0703097 thru Bunker Hill Community College.

Hashing can be used to verify the integrity of data. That is why a lot of sites include a hash function to verify the package has not been tampered with when downloading. Packages should never be installed unless they come from a trusted source, and with the package's integity upheld. This lab will demonstrate embedding BASH command into a package and using Social Engineering tactics to entice a user Alice into installing it. This lab will also demonstrate consequences of this action by allowing the attacker system access through a remote shell.

image001.png

Embedding Client-Side Code into a Package

Courses

Key terms and descriptions

social engineering
Social engineering is a term used to describe the act of manipulating people into performing actions or divulging confidential information.
phishing
Phishing is a form of social engineering that uses electronic communications to impersonate a trustworthy entity in an attempt to scam users.
spear phishing
Spear phishing is the more targeted version of phishing, where the attacker sends emails or messages to specific individuals.