# Unraveling a Reverse Shell with Managed EDR

Attacker with access to a partner's ScreenConnect RMM instance spawned encoded PowerShell that fetched an SSH reverse-shell payload with scheduled-task persistence.

- Payout: Real-world hack
- Severity: high
- Program: ScreenConnect
- Analysis by: Huntress
- Disclosed: 2022-09-13
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/unraveling-a-reverse-shell-with-process-insights
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-unraveling-a-reverse-shell-with-process-insights
- Tags: area:cloud domain:infra impact:internal-access impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:source-review vuln:misconfiguration vuln:rce

**Target:** Windows endpoint managed via ScreenConnect RMM
**Root cause:** Attacker gained control of the partner's ScreenConnect RMM host, which let them spawn child processes (encoded PowerShell) on connected endpoints.
**Steps:**
1. Alert: encoded PowerShell command executed on partner host; parent process is the partner's ScreenConnect instance.
2. Decode Base64 payload: `Invoke-WebRequest` to `hxxps[://]onerecoveryclick` and parse returned HTML.
3. Fetch `hxxps[://]onerecovery[.]click).rawcontent` via wget to bypass the 'loading...' page.
4. Response contains public IP `88[.]119[.]175[.]55`, PowerShell scripts, and an SSH path.
5. Payload drops SSH executable, adds firewall rule allowing inbound SSH, creates scheduled task persistence, and a `go.bat` batch script.
6. Batch script starts an SSH reverse-shell listener back to the attacker IP, with a scheduled task relaunching it for persistence.
**How found:** Managed EDR flagged an encoded PowerShell command; analysts checked the parent process and found it was the partner's ScreenConnect instance, then decoded the payload in CyberChef and pulled the full script with wget after the site appeared defunct.
**Exploitation:** Adversary controlling the ScreenConnect RMM instance used it to push an encoded PowerShell stager to managed endpoints; the stager pulled a second-stage payload that installed SSH, opened a firewall rule, and established a persistent reverse shell to 88[.]119[.]175[.]55 via scheduled task.
**Escalation:** Control of RMM infrastructure could grant access to thousands of other connected computers, enabling cascading compromise across the network.
**Insight:** RMM parents spawning encoded PowerShell are a high-signal pivot: treat the RMM host itself as an attack surface, and when a staging domain shows only 'loading...', fetch raw content directly (wget/curl) to reveal the real payload.