Description
The Shell Access or Remote Shell feature in malware provides attackers with a remote interface to the compromised system, essentially acting as a backdoor that allows them to execute commands as if they were physically present at the machine. This level of access gives attackers a near-omnipotent control over the target, allowing them to perform a wide range of actions from file manipulation to launching additional exploits. One of the most significant capabilities offered by shell access is the potential for privilege escalation. By exploiting vulnerabilities or misconfigurations in the system, an attacker can elevate their access rights, gaining more thorough control and making it easier to carry out further malicious activities. Moreover, a remote shell can be used to pivot to other systems on the network, enabling lateral movement and increasing the scope of the attack.
| Categories | Lateral Movements, Privilege Escalation, System Management |
| Dangerousness | High |
Existing Technique
| Name | Associated Feature(s) | Has Snippet | Matching Sample |
|---|---|---|---|
 Execute Programs
|
File Manager, Shell Access | 0 |
Lost Door 3.0 Stable
Cerberus 1.0 Beta
Cerberus 1.01 Beta
Cerberus 1.02 Beta
SynRAT 4.3.1-A-1
Apocalypse RAT 1.4
Cerberus 1.03.4
Spy-Net 2.6
DarkComet RAT 1.3
Cerberus 1.03.5 Beta
DarkComet RAT 2.0 RC4
CyberGate 1.04.8
Lost Door 4.3.1
DarkComet RAT 2.0 RC7
Schwarze Sonne 1.0
Lost Door 5.1
Coolvibes 1 Update 8
Xtreme RAT 2.9
DarkComet RAT 5.3
DarkComet RAT 5.3.1
NjRat 0.7d
Quasar 1.0
Lost Door 9.2 Aws