Reverse shells and reverse tunnels: how one click becomes remote access

The short answer: can a website hack you?

Simply opening a web page almost never gives anyone control of your computer. Modern browsers run websites in a locked box (a "sandbox"), and a site can't start programs on your machine by itself. For an attacker to get a shell, some code has to run on your computer first. Websites are how they get you to run it. There are three common ways:

1. You're tricked into running a command. This is the big one right now, often called ClickFix. A page shows a fake CAPTCHA or error ("Verify you are human"), quietly copies a command to your clipboard, and tells you to press Win + R, then Ctrl + V, then Enter. That pastes and runs the attacker's command. You did the hacking for them.
2. You download and open something. A fake browser update, a "missing font" or video codec, or a fake Zoom or Teams installer from a search ad that looks like the real download page.
3. A browser bug (rare). Occasionally a flaw lets a malicious page escape the sandbox. These are expensive, get fixed quickly, and are mostly used against high-value targets. Keeping your browser updated closes them.

Why "reverse" gets past your firewall

Your office or home router lets traffic out freely (so you can browse) but blocks unsolicited traffic coming in. So an attacker on the internet can't just connect to your PC.

A reverse connection flips it around: the malicious code on your PC calls out to the attacker's server. To your firewall, that looks like any other outbound connection, the same as opening a website, so it's allowed. Once that connection is up, the attacker sends commands back down it.

Normal attack (blocked)
  Attacker ──────────► your firewall  ✖  your PC

Reverse connection (allowed)
  your PC ──────────► your firewall ──────────► attacker's server
          ◄══════ attacker's commands come back down the same connection ══════

Attackers usually make this connection over port 443, the same port as normal HTTPS web traffic, so it blends in even more.

What a reverse shell is

A shell is a command prompt: the text window where you type commands and the computer runs them. A reverse shell is that command prompt handed to someone else over a reverse connection. With it, the attacker can do anything you could do from a command prompt: look through files, steal saved passwords and browser sessions, install more tools, and move on to other computers on your network.

It's usually only the first step. The goal is to settle in quietly, steal credentials, and work towards the valuable systems: email, accounting, file servers and, in the worst case, deploying ransomware.

ssh -R: a sysadmin tool turned back door

SSH is the standard secure way IT people log in to servers. Since 2018 an SSH client (ssh.exe) has been built into Windows 10 and 11, and it's always been on macOS and Linux. That's convenient for admins, and convenient for attackers, because they don't need to bring their own tools. Security people call this "living off the land".

The -R option is remote port forwarding. It tells the SSH connection: "open a door on the remote server, and send anything that comes through it back down this connection to a place on my side." Admins use it legitimately, for example to reach a home lab while travelling. In the documentation it looks like this:

ssh -R <port on the remote server>:<destination on this side>:<port> user@remote-server

When an attacker runs it from a victim's PC, the "remote server" is theirs, and the "destination on this side" can be the victim's own PC or any machine on the victim's internal network, such as a file server or a domain controller. The attacker now has a private doorway from their server straight into your network, carried inside an encrypted SSH connection that your firewall let out.

"Reverse RDP" and remote-support tools

RDP (Remote Desktop) lets you see and control a Windows PC's screen remotely. Exposing RDP directly to the internet is a well-known ransomware entry point, so most firewalls block it coming in. "Reverse RDP" gets around that the same way as above: the victim's PC tunnels its own RDP port out to the attacker, often using ssh -R, so the attacker gets a full remote desktop even though RDP was never opened on the firewall.

Attackers also use:

• Tunnelling services such as ngrok or Cloudflare Tunnel, which developers use legitimately to share a local app, set up to publish the victim's RDP port to the internet.
• Legitimate remote-support tools such as AnyDesk, ScreenConnect or TeamViewer, installed silently or by talking the victim into it ("This is Microsoft support, please install this so we can fix your PC"). Because these are real, signed programs, antivirus often lets them run.

Warning signs

• A website asked you to press Win + R, open PowerShell or Terminal, or paste anything. Assume it ran something.
• A black command window flashed open and closed after you clicked something.
• Your mouse moves on its own, or windows open that you didn't open.
• A remote-access app you don't recognise appears in your Start menu, system tray or installed programs.
• Your computer is suddenly slow or the fans are busy while you're doing nothing.
• Password-reset or "new sign-in" emails you didn't ask for. Stolen browser sessions get used quickly.

How to prevent it: a small-business checklist

None of these need expensive tools. Together they break the attack at several points, which is the idea behind the ACSC's Essential Eight.

For IT: how to detect it

Check a single PC

The Run box keeps a history of what was typed or pasted into it. ClickFix commands often show up here:

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"

Look for entries containing powershell, mshta, curl, ssh or a web address. Then check whether the SSH client is installed and whether anything is connected out over SSH right now:

Get-WindowsCapability -Online -Name OpenSSH.Client*
Get-NetTCPConnection -State Established -RemotePort 22 |
  Select-Object LocalAddress, RemoteAddress, OwningProcess,
    @{n='Process';e={(Get-Process -Id $_.OwningProcess).Path}}

Hunt across the business (Microsoft Defender / Sentinel)

SSH run with remote port forwarding on a workstation is rare and worth a look every time:

DeviceProcessEvents
| where FileName =~ "ssh.exe"
| where ProcessCommandLine matches regex @"(^|\s)-[A-Za-z]*R\s"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine

Outbound SSH from staff PCs to the internet:

DeviceNetworkEvents
| where RemotePort == 22 and RemoteIPType == "Public"
| summarize Connections = count(), Targets = make_set(RemoteIP, 10)
    by DeviceName, InitiatingProcessFileName
| order by Connections desc

ClickFix leaves its mark in the Run history in the registry:

DeviceRegistryEvents
| where RegistryKey has @"Explorer\RunMRU"
| where RegistryValueData has_any ("powershell", "mshta", "curl", "ssh", "http")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryValueData

Also alert on remote-access and tunnelling tools you haven't approved (AnyDesk, ngrok, cloudflared and similar) appearing in process or network events, and on PowerShell or cmd.exe started by explorer.exe straight after a browser was active.

If you think it's happened

1. Disconnect the computer from the network: unplug the cable and turn off Wi-Fi. Don't shut it down, so evidence in memory is kept.
2. From a different, clean device, change the passwords for email, banking and anything saved in that browser, and sign out of all sessions. Turn on MFA where it's off.
3. Tell your IT provider (or us) straight away. The sooner the tunnel and any installed tools are found, the less spreads.
4. Report it to the Australian Cyber Security Centre at cyber.gov.au/report, or call 1300 CYBER1 (1300 292 371) for urgent help.