WO2022222255A1

WO2022222255A1 - Reverse shell risk determination method, apparatus and system

Info

Publication number: WO2022222255A1
Application number: PCT/CN2021/100292
Authority: WO
Inventors: 郑云超; 范渊; 黄进
Original assignee: 杭州安恒信息技术股份有限公司
Priority date: 2021-04-23
Filing date: 2021-06-16
Publication date: 2022-10-27
Also published as: CN113139193A

Abstract

A reverse shell risk determination method, apparatus and system. The method comprises: receiving a reverse shell program issued by a protection center, and running the reverse shell program (S101); using a locally pre-stored protection program to perform protection on a running process of the reverse shell program, and generating protection result information (S102); and obtaining risk information according to the protection result information (S103).By means of the method, the locally pre-stored protection program is used to perform protection on the reverse shell program, and the protection result information can be generated; then, the risk information can be obtained according to the protection result information, the determination of a protection effect on a reverse shell can be implemented, and whether the reverse shell would pose a risk to a protection system can also be determined, such that the protection capability of the system can be improved.

Description

A rebound shell risk determination method, device and system

This application claims the priority of the Chinese patent application filed on April 23, 2021 with the application number 202110441328.7 and the invention titled "A Rebound Shell Risk Determination Method, Device and System", the entire contents of which are incorporated by reference in this application.

technical field

The present application relates to the field of computer technologies, and in particular, to a method, device, system, protection terminal, and computer-readable storage medium for determining a bounce shell risk.

Background technique

Rebound shell means that the control terminal listens on a TCP/UDP port, the controlled terminal initiates a request to the port, and transfers the input and output of its command line to the control terminal, so that the control terminal can execute the shell of the remote controlled terminal locally. instruction.

In the related art, there are many technical means for defending against the bounced shell, but the protection effect of defending against the bounced shell is not judged, so it is impossible to determine whether the bounced shell will cause a risk to the protection system.

SUMMARY OF THE INVENTION

The purpose of this application is to provide a method for determining the risk of a rebound shell, which can determine the protection effect of the rebound shell, and can also determine whether the rebound shell will cause a risk to the protection system, which can improve the protection capability of the system. Its specific plan is as follows:

In a first aspect, the present application discloses a method for determining a rebound shell risk, including:

Receive the rebound shell program issued by the protection center, and run the rebound shell program;

Use a locally pre-stored protection program to protect the running process of the rebound shell program, and generate protection result information;

Risk information is obtained according to the protection result information.

Optionally, the use of a locally pre-stored protection program to protect the running process of the rebound shell program to generate protection result information, including:

Utilize the locally pre-stored protection program to intercept the startup of the running process of the rebound shell program, and generate startup result information;

According to the startup result information, the protection result information is obtained.

Optionally, the protection result information is obtained according to the startup result information, including:

When the startup result information is startup success information, use the protection program to block the running process of the rebound shell program from establishing a connection with the protection center, and generate connection result information;

According to the connection result information, the protection result information is obtained.

Optionally, the protection result information is obtained according to the connection result information, including:

When the connection result information is connection success information, use the protection program to block the rebound shell program from executing the shell command issued by the protection center, and generate execution result information;

According to the execution result information, the protection result information is obtained.

Optionally, after obtaining the risk information according to the protection result information, the method further includes:

When the risk information includes risk-existing information, risk alarm information is generated, and the risk alarm information is sent to the protection center, so that the protection center performs protection supplementation according to the risk alarm information.

Optionally, when the risk information includes risk information, generate risk alarm information, including:

When the risk information includes risk information, determine the protection process information of the protection program for protection;

The protection process information and the rebound shell program are used as risk warning information.

In a second aspect, the present application discloses a rebound shell risk determination device, including:

The running module is used to receive the rebound shell program issued by the protection center, and run the rebound shell program;

A generation module is used to protect the running process of the rebound shell program by using a locally pre-stored protection program, and generate protection result information;

A risk information module, configured to obtain risk information according to the protection result information.

In a third aspect, the present application discloses a rebound shell risk determination system, including:

The protection center is used to send the reverse shell program to the protection terminal;

The protection terminal is used for performing the steps of the above method for determining the risk of a rebound shell.

In a fourth aspect, the present application discloses a protection terminal, comprising:

memory for storing computer programs;

The processor is configured to implement the steps of the above bounce shell risk determination method when executing the computer program.

In a fifth aspect, the present application discloses a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the above method for determining a bounce shell risk are implemented.

The present application provides a method for determining the risk of a rebound shell, including: receiving a rebound shell program issued by a protection center, and running the rebound shell program; using a locally pre-stored protection program to protect the running process of the rebound shell program, Generate protection result information; obtain risk information according to the protection result information.

It can be seen that the present application can use the locally pre-stored protection program to protect the rebound shell program, and can generate the protection result information, and then obtain the risk information according to the protection result information, that is, the present application can realize the protection result of the defense against the rebound shell. Judgment avoids the disadvantage that the protection effect of the rebound shell cannot be judged in the related art, nor can it be determined whether the rebound shell will cause a risk to the protection system. Whether it will cause risks to the protection system can improve the protection capability of the system. The present application also provides a rebound shell risk determination device, system, protection terminal, and computer-readable storage medium, which have the above beneficial effects, and are not repeated here.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only It is an embodiment of the present application. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without any creative effort.

1 is a flowchart of a method for determining a rebound shell risk provided by an embodiment of the present application;

2 is a flowchart of another method for determining a rebound shell risk provided by an embodiment of the present application;

3 is a schematic diagram of an internal module of a protection center provided by an embodiment of the present application;

4 is a schematic diagram of an internal module of a protection terminal provided by an embodiment of the present application;

5 is a schematic diagram of information interaction between an internal module of a protection center and a protection terminal provided by an embodiment of the application;

6 is a schematic diagram of information interaction between a rebound shell attack module, a risk detection module, and a protection center provided by an embodiment of the present application;

7 is a schematic flowchart of a risk detection module detecting a running process of a bounce shell provided by an embodiment of the present application;

8 is a schematic diagram of information interaction between a risk alarm module and a protection center provided by an embodiment of the application;

FIG. 9 is a schematic structural diagram of an apparatus for determining a rebound shell risk according to an embodiment of the present application.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

Rebound shell means that the control terminal listens on a TCP/UDP port, the controlled terminal initiates a request to the port, and transfers the input and output of its command line to the control terminal, so that the control terminal can execute the shell of the remote controlled terminal locally. instruction. For example, the controlled end creates a powershell rebound shell process through the Java process, the control end executes the ipconfig command, and the control end can display the IP information of the controlled end. There are many technical means to defend against the bounce shell in the related art, but there is no method for judging the protection effect of the bounce shell, and there are many protection methods for the bounce shell. The rebound shell process fails to start; some are detected and blocked when the rebound shell is connected to the remote control terminal, and the effect is that the network connection between the rebound shell and the control terminal fails; some are when the rebound shell executes shell commands. To detect and block, the effect is that the command executed by the rebound shell fails to execute.

Based on the above technical problems, this embodiment provides a method for determining the risk of a bounced shell, which can determine the protection effect of the bounced shell, and can also determine whether the bounced shell will cause a risk to the protection system, which can improve the protection capability of the system. Referring to FIG. 1, FIG. 1 is a flowchart of a method for determining a rebound shell risk provided by an embodiment of the present application, which specifically includes:

S101. Receive the rebound shell program issued by the protection center, and run the rebound shell program.

This embodiment does not limit the specific object of the execution body, which may be a computer, a server, or a protection terminal. It can be understood that, the bounce shell program in this embodiment is a code program of the bounce shell, and running the bounce shell program will execute the corresponding bounce shell event. This embodiment does not limit the location where the protection center is located, and the protection center and the execution body of this embodiment may be located in the same device, or may be located in two different devices.

S102. Use a locally pre-stored protection program to protect the running process of the rebound shell program, and generate protection result information.

It can be understood that, the protection program in this embodiment is a code used for protection against rebound shells. In this embodiment, a locally pre-stored protection program is used to protect the running process of the rebound shell program. It can be understood that, after running the rebound shell program, the running process of the rebound shell program can be entered, that is, the event of executing the shell. This embodiment does not limit the specific state of the running process of the rebound shell program, which may be the startup state, the state of establishing a connection with the protection center, or the state of executing the shell command. Correspondingly, this embodiment does not limit the specific operation of protection, which may be protection when starting the running process of the rebound shell program, protection when establishing a connection with the protection center, or protection when executing shell commands. This embodiment does not limit the specific content of the generated protection result information, which may be protection success messages of different protection operations, or protection unsuccessful messages of different protection operations.

This embodiment does not limit the specific process of performing protection. In a specific embodiment, the running process of the rebound shell program is protected by using a locally pre-stored protection program, and the protection result information is generated, which may include:

Use the locally pre-stored protection program to intercept the startup of the running process of the rebound shell program, and generate startup result information;

That is, in this embodiment, a protection program is used to intercept the running process that starts the rebound shell program, and the start-up result information is generated. This embodiment does not limit the specific content of the startup result information, which may include startup success information or startup failure message, and may also include the specific operation of protection performed in this embodiment, that is, information about intercepting the startup of the rebound shell running process. After the startup result information is generated, protection result information can be obtained according to the startup result information. This embodiment does not limit the specific process of obtaining the protection result information according to the startup result information. For example, when the startup result information is the startup success information of the running process of the rebound shell, the protection result information is the protection failure information; When the information about the unsuccessful startup of the running process of the reverse shell is the information about the protection result, the information about the protection result is the protection success information.

This embodiment does not limit the subsequent operations after the protection is unsuccessful. In a specific embodiment, the protection result information is obtained according to the startup result information, which may include:

When the startup result information is the startup success information, the protection program is used to block the running process of the rebound shell program from establishing a connection with the protection center, and the connection result information is generated;

When the startup protection for the running process of the reverse shell program is unsuccessful, that is, when the startup result information is the startup success information, the protection program is used in this embodiment to block the running process of the reverse shell program from establishing a connection with the protection center. That is to say, in this embodiment, when the running process of the rebound shell program is not successfully started to be protected, the process of establishing the connection between the running process of the rebound shell program and the protection center is protected, that is, blocked, and the connection result information is obtained. This embodiment does not limit the specific content of the connection result information, which may include connection success information or connection failure information, and may also include information that this embodiment blocks the connection establishment with the protection center. This embodiment does not limit the specific process of obtaining the protection result information according to the connection result information. For example, when the connection result information is the connection success information for blocking the connection with the protection center, the protection result information is the protection failure information; When the result information is that the connection established with the protection center is blocked, the protection result information is the protection success information.

This embodiment does not limit the subsequent operations after the protection is unsuccessful. In a specific embodiment, obtaining protection result information according to the connection result information may include:

When the connection result information is the connection success information, the protection program is used to block the reverse shell program from executing the shell command issued by the protection center, and the execution result information is generated;

When the protection of blocking the connection between the running process of the rebound shell and the protection center is unsuccessful, that is, when the connection result information is the connection success information, in this embodiment, the protection program is used to block the execution of the rebound shell program issued by the protection center. shell command. That is to say, in this embodiment, under the circumstance that the running process of the rebound shell program is successfully started without protection, and the connection between the running process of the rebound shell program and the protection center is blocked and the connection is established without protection, the reverse shell program is executed under the protection center. The shell command sent is protected, that is, blocked, and the execution result information is obtained. This embodiment does not limit the specific content of the execution result information, which may include execution success information or execution failure information, and may also include information about blocking the rebound shell program from executing shell commands in this embodiment. This embodiment does not limit the specific process of obtaining the protection result information according to the execution result information. For example, when the execution result information is the execution success information of blocking the reverse shell program from executing the shell command, the protection result information is the protection failure information; When the execution result information is the unsuccessful execution of the shell command to block the reverse shell program from executing the shell command, the protection result information is the protection successful information.

S103. Obtain risk information according to the protection result information.

This embodiment does not limit the specific content of the risk information, which may include messages with risks and messages without risks, and may also include corresponding protection operations, and may also include other content. For example, when the protection result information is the protection unsuccessful message, the risk information may be the message that the shell command issued by the protection center is unsuccessful in blocking the reverse shell program from executing the protection center; it may also be the message that the protection result information is protection successful. When the message is displayed, the risk information can be the message that the shell command issued by the protection center is successfully blocked from executing the reverse shell program, and there is no risk.

Based on the above technical solution, this embodiment uses a locally pre-stored protection program to protect the rebound shell program, and can generate protection result information, and then obtain risk information according to the protection result information, that is, the present application can realize the protection of the rebound shell program. The protection result can be determined, and it can also be determined whether the rebound shell will cause risks to the protection system, which can improve the protection capability of the system.

Based on the above-mentioned embodiment, in order to effectively improve the protection capability of the system, this embodiment provides a method for determining the risk of rebound shell. For details, please refer to FIG. 2 , which is another method for determining the risk of rebound shell provided by the embodiment of the present application. A flowchart of the method, including:

S201. Receive the rebound shell program issued by the protection center, and run the rebound shell program.

S202. Use a locally pre-stored protection program to protect the running process of the rebound shell program, and generate protection result information.

S203. Obtain risk information according to the protection result information.

For steps S201 to S203, reference may be made to the above-mentioned embodiments, which will not be repeated in this embodiment.

S204 , when the risk information includes risk information, generate risk alarm information, and send the risk alarm information to the protection center, so that the protection center performs protection supplements according to the risk alarm information.

In this embodiment, when the risk information is a message including a risk, risk alarm information is generated. This embodiment does not limit the specific content of the risk alarm information, and may include a corresponding rebound shell program, and may include process operation information for protection, that is, protection process information. After the risk alarm information is generated, the risk alarm information is also sent to the protection center, and the protection center can perform protection supplements according to the content of the risk alarm information.

This embodiment does not limit the specific process of generating risk alarm information. In a specific embodiment, when the risk information includes risk information, generating risk alarm information may include:

When the risk information includes risk information, determine the protection process information for protection by the protection program;

Use protection process information and rebound shell programs as risk warning information.

In this embodiment, when the risk information includes risk information, the protection process information for protection by the protection program is determined. It can be understood that the protection process information is the operation of using the protection program to block the running process of the rebound shell program. For example, it can block the running process of starting the rebound shell program; when the block is not successful, block the process of establishing the connection between the running process of the rebound shell program and the protection center; Blocks the execution of shell commands by the reverse shell program. This embodiment does not limit the specific content of the protection process information, which is determined according to the actual protection operation. In this embodiment, the protection process information and the rebound shell program are used as the risk alarm information, and the protection center can perform protection supplements according to the specific content of the risk alarm information, which can effectively improve the protection capability of the system.

Based on the above technical solutions, this embodiment uses a locally pre-stored protection program to protect the rebound shell program, and can generate protection result information, and then obtain risk information according to the protection result information, and can realize the determination of the protection effect of the rebound shell. , it can also determine whether the rebound shell will cause risks to the protection system, which can improve the protection capability of the system, and further, according to the risk alarm information, it can supplement the protection of the rebound shell that cannot be protected.

Specific embodiments of a rebound shell risk determination method and system are provided below. It consists of two parts, one is the protection center, which includes the rebound shell configuration module, the rebound shell control module, and the alarm display module, as shown in Figure 3; the other is the protection terminal, which includes the rebound shell attack module, the risk detection module, and the risk alarm module. As shown in Figure 4.

1. Protection Center

The rebound shell configuration module is used to configure the rebound shell program for attack testing and send it to the protection terminal;

The rebound shell control module is used to create a remote control service of the rebound shell, monitor whether the running process of the rebound shell is connected to the control service, and issue shell commands for testing through the channel established by the rebound shell;

The alarm display module is used to receive the risk alarm information of the rebound shell program detected by the protection terminal that cannot be protected, as shown in Figure 5.

2. Protection terminal

The rebound shell attack module is used to accept the rebound shell program configured by the protection center for attack testing, run the rebound shell program, and notify the risk detection module to detect the rebound shell program, as shown in Figure 6;

The risk detection module is used to monitor the running rebound shell program. First, it monitors whether the running process of the rebound shell program is successfully started. If the startup fails, it means that the locally stored protection program is effective for the protection of this type of reverse shell, that is, the reverse shell program, and the running process of the reverse shell has been terminated by the protection program, and there is no risk. If the running process starts successfully, then request the reverse shell control module of the protection center to confirm whether the reverse shell control service of the protection center has established a connection with the running process of the reverse shell. If the connection fails to be established, it means that the protection program is effective for this type of reverse shell protection, and the creation of remote connections of the reverse shell is blocked by the protection program, and there is no risk. If the connection is established successfully, initiate and execute the shell command on the control service of the protection center, and observe whether the shell command is executed successfully. If the execution fails, it means that the protection program is effective for this type of reverse shell protection, and the execution of the reverse shell command is blocked by the protection program, and there is no risk; if the execution is successful, it means that the protection program is invalid for this type of reverse shell protection, and there is a risk , as shown in Figure 7.

Among them, the description of whether the execution result of the shell command is successful can be determined. For example, if a shell command to create a file is issued, then observe whether the file is created successfully. If the file is created successfully, it means that the shell command is successfully executed. Otherwise, the shell command fails to be executed.

The risk alarm module is used to send the rebound shell program that cannot be protected and the complete detection process, that is, the protection process information, to the protection center, as shown in Figure 8.

The following describes a rebound shell risk determination device provided by an embodiment of the present application. The rebound shell risk determination device described below and the rebound shell risk determination method described above can be referred to each other in correspondence with each other, and the relevant modules are set in , refer to FIG. 9 . 9 is a schematic structural diagram of a rebound shell risk determination device provided by an embodiment of the application, including:

In some specific embodiments, it specifically includes:

The operation module 901 is used to receive the rebound shell program issued by the protection center, and run the rebound shell program;

The generating module 902 is used to protect the running process of the rebound shell program by using the locally pre-stored protection program, and generate protection result information;

The risk information module 903 is configured to obtain risk information according to the protection result information.

In some specific embodiments, the generating module 902 includes:

The interception sub-module is used to intercept the startup of the running process of the rebound shell program by using the locally pre-stored protection program, and generate startup result information;

The protection result information sub-module is used to obtain the protection result information according to the startup result information.

In some specific embodiments, the protection result information sub-module includes:

The blocking unit is used to use the protection program to block the running process of the rebound shell program from establishing a connection with the protection center when the startup result information is the startup success information, and generate the connection result information;

The protection result information unit is used to obtain the protection result information according to the connection result information.

In some specific embodiments, the protection result information unit includes:

The blocking subunit is used to block the reverse shell program from executing the shell command issued by the protection center by using the protection program when the connection result information is the connection success information, and generate the execution result information;

The protection result information subunit is used to obtain protection result information according to the execution result information.

In some specific embodiments, it also includes:

The risk alarm information module is used to generate risk alarm information when the risk information contains risk information, and send the risk alarm information to the protection center, so that the protection center can supplement the protection according to the risk alarm information.

In some specific embodiments, the risk warning information module includes:

The determination unit is used to determine the protection process information for protection by the protection program when the risk information includes risk information;

The risk alarm information unit is used to use the protection process information and the rebound shell program as the risk alarm information.

Since the embodiments of the rebound shell risk determination device part correspond to the embodiments of the rebound shell risk determination method part, the embodiments of the rebound shell risk determination device part refer to the description of the embodiments of the rebound shell risk determination method part, which is not mentioned here for the time being. Repeat.

The present application also discloses a rebound shell risk determination system, including:

The protection terminal is used to execute the steps of the above method for determining the risk of rebound shell.

Since the embodiments of the rebound shell risk determination system part correspond to the embodiments of the rebound shell risk determination method part, the embodiments of the rebound shell risk determination system part refer to the description of the embodiments of the rebound shell risk determination method part, which is not mentioned here for the time being Repeat.

A protection terminal provided by an embodiment of the present application is introduced below, and the protection terminal described below and the method described above may refer to each other correspondingly.

The application also discloses a protection terminal, comprising:

memory for storing computer programs;

The processor is configured to implement the steps of the above method for determining the risk of rebound shell when executing the computer program.

Since the embodiments of the protection terminal part correspond to the embodiments of the method part, the embodiments of the protection terminal part refer to the description of the embodiments of the method part, which will not be repeated here.

The following describes a computer-readable storage medium provided by an embodiment of the present application. The computer-readable storage medium described below and the bounce shell risk determination method described above may refer to each other correspondingly.

The present application also discloses a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the above method for determining a bounce shell risk are implemented.

Since the embodiments of the computer-readable storage medium part correspond to the embodiments of the rebound shell risk determination method part, the embodiments of the computer-readable storage medium part refer to the description of the embodiments of the rebound shell risk determination method part, which are not mentioned here for the time being. Repeat.

The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the various embodiments can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant part can be referred to the description of the method.

Professionals may further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two, in order to clearly illustrate the possibilities of hardware and software. Interchangeability, the above description has generally described the components and steps of each example in terms of functionality. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

The steps of a method or algorithm described in connection with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.

The method, device, system, protection terminal, and computer-readable storage medium provided by the present application for determining a bounce shell risk have been described above in detail. Specific examples are used herein to illustrate the principles and implementations of the present application, and the descriptions of the above embodiments are only used to help understand the methods and core ideas of the present application. It should be pointed out that for those of ordinary skill in the art, without departing from the principles of the present application, several improvements and modifications can also be made to the present application, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

A rebound shell risk determination method, characterized in that it includes:

Receive the rebound shell program issued by the protection center, and run the rebound shell program;

Use a locally pre-stored protection program to protect the running process of the rebound shell program, and generate protection result information;

Risk information is obtained according to the protection result information.
The method for determining the risk of a bounce shell according to claim 1, wherein the protection of the running process of the bounce shell program by using a locally pre-stored protection program to generate protection result information includes:

Utilize the locally pre-stored protection program to intercept the startup of the running process of the rebound shell program, and generate startup result information;

According to the startup result information, the protection result information is obtained.
The method for determining a bounce shell risk according to claim 2, wherein the protection result information is obtained according to the startup result information, comprising:

When the startup result information is startup success information, use the protection program to block the running process of the rebound shell program from establishing a connection with the protection center, and generate connection result information;

According to the connection result information, the protection result information is obtained.
The method for determining a bounce shell risk according to claim 3, wherein the protection result information is obtained according to the connection result information, comprising:

When the connection result information is connection success information, use the protection program to block the rebound shell program from executing the shell command issued by the protection center, and generate execution result information;

According to the execution result information, the protection result information is obtained.
The method for determining a bounce shell risk according to any one of claims 1 to 4, wherein after obtaining the risk information according to the protection result information, the method further comprises:

When the risk information includes risk-existing information, risk alarm information is generated, and the risk alarm information is sent to the protection center, so that the protection center performs protection supplementation according to the risk alarm information.
The method for determining a bounce shell risk according to claim 5, wherein when the risk information includes risk information, generating risk alarm information, comprising:

When the risk information includes risk information, determine the protection process information of the protection program for protection;

The protection process information and the rebound shell program are used as risk warning information.
A rebound shell risk determination device, characterized in that it includes:

The running module is used to receive the rebound shell program issued by the protection center, and run the rebound shell program;

A generation module is used to protect the running process of the rebound shell program by using a locally pre-stored protection program, and generate protection result information;

A risk information module, configured to obtain risk information according to the protection result information.
A rebound shell risk determination system, characterized in that it includes:

The protection center is used to send the reverse shell program to the protection terminal;

The protection terminal is configured to execute the steps of the bounce shell risk determination method according to any one of claims 1 to 6.
A protection terminal is characterized in that, comprising:

memory for storing computer programs;

The processor is configured to implement the steps of the rebound shell risk determination method according to any one of claims 1 to 6 when executing the computer program.
A computer-readable storage medium, characterized in that, a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the rebound shell risk determination according to any one of claims 1 to 6 is realized steps of the method.