SonicWALL 5.8.1 Manuale Utente

action or a default action such as Reset/Drop. For the Connection Side, select Client Side. 
You can also modify other settings. For more information about creating a policy, see 

.

The reverse shell exploit is an attack that you can prevent by using Application Control’s 
custom signature capability (See 

). A reverse shell exploit 

could be used by an attacker if he or she is successful in gaining access to your system by 
means of a Zero-day exploit. A Zero-day exploit refers to an attack whose signature is not yet 
recognized by security software.

In an early stage while still unknown, malicious payloads can pass through the first line of 
defense which is the IPS and Gateway Anti-Virus (GAV) running at the Internet gateway, and 
even the second line of defense represented by the host-based Anti-Virus software, allowing 
arbitrary code execution on the target system. 

In many cases, the executed code contains the minimal amount of instructions needed for the 
attacker to remotely obtain a command prompt window (with the privileges of the exploited 
service or logged on user) and proceed with the penetration from there. 

As a common means to circumvent NAT/firewall issues, which might prevent their ability to 
actively connect to an exploited system, attackers will make the vulnerable system execute a 
reverse shell. In a reverse shell, the connection is initiated by the target host to the attacker 
address, using well known TCP/UDP ports for better avoidance of strict outbound policies. 

This use case is applicable to environments hosting Windows systems and will intercept 
unencrypted connections over all TCP/UDP ports.