SubShell is a python command shell used to control and execute commands through HTTP requests to a webshell. SubShell acts as the interface to the remote webshells.
Switch branches/tags
Nothing to show
Clone or download
Latest commit baa51d9 Nov 7, 2016
Permalink
Failed to load latest commit information.
.gitignore setup.py added Nov 6, 2016
LICENSE.md readme updates Jan 15, 2016
README.md readme updated Oct 3, 2016
requirements.txt readme updates Jan 15, 2016
setup.py setup.py update Nov 6, 2016
subshell-1.0-py2.7.egg setup.py update Nov 6, 2016
subshell.asp error handling fixes Nov 9, 2015
subshell.aspx update Nov 6, 2016
subshell.jsp update Nov 6, 2016
subshell.php updates Dec 28, 2015
subshell.py readme updates Jan 15, 2016

README.md

SubShell Web Shell Framework

Author: Joe Vest

Copyright 2015 - SubShell

Written by: Joe Veat

Company: MINIS

DISCLAIMER: This is only for testing purposes and can only be used where strict consent has been given. Do not use this for illegal purposes.

Please read the LICENSE in LICENSE.md for the licensing information

  _________    ___      _________ __            __   __   
 /   _____/__ _\  |__  /   _____/|  |__   ____ |  | |  |  
 \_____  \|  |  \ __ \ \_____  \ |  |  \_/ __ \|  | |  |  
 /        \  |  / \_\ \/        \|   |  \  ___/|  |_|  |__
/_________/____/|_____/_________/|___|__/\_____>____/____/

SubShell - Webshell Console - Joe Vest - 2015

Usage: 
    subshell.py  --url=<url>
    subshell.py  --url=<url> [--useragent=<useragent] [--logdir=<logdir>] [--debug] [--mysqlu=<MySQL Username] [--mysqlp=<MySQL Password> [--mysqls=<MySQL Server>]]
    subshell.py (-h | --help) More Help and Default Settings

Options:
    -h --help                This Screen
    --url=<url>              URL source of webshell (http://localhost:80)
    --useragent=<useragent>  User-Agent String to use [default: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)]
    --mysqlu=<username>      Set MYSQL Username
    --mysqlp=<password>      Set MySQL Password
    --mysqls=<server>        Set MySQL Server IP or Hostname
    --logdir=<logdir>        Directory path to logs [default: ./logs]
    --debug                  Enable Debugging

SubShell is a python command shell used to control and execute commands through HTTP requests to a webshell. SubShell acts as the interface to the remote webshells.

SubShell has a companion project named TinyShell. TinyShell is similar and may offer benefits over SubShell in certain situations.

TinyShell - https://github.com/minisllc/tinyshell

This project was born out of the need for a consolidated webshell framework. There are numerous available, but I wanted to created backend framework that supports numerous web languages with a common backend.

This project uses the principle of hiding in plain sight (even over non-encrypted communications). The goal is minimize attention. Like numerous malicious tools, they are easy to find by defenders once they have a reason to look. This project is designed to be stealthy, not through high-tech means, but by minimizing the triggering of a defenses such as IDS, Firewall, AV etc.

How does it do this?

  • POST requests minmize data written web logs
  • Encoded traffic helps avoid clear text detection
  • Console interface forces a slow down when issuing commands. Use of a webshell should be deliberate and focused. Numerous connections may attract attention.
  • Customization of user-agent to help blend in.
  • Valid 404 errors displayed when attemped to connect to shell without 'authetnication' information

Current Features

  • Designed for used agains Windows Based servers
  • Supports shells in asp, aspx, php, jsp
  • Logging of all actions
  • Base64 encoded command sent and receivied in POST requests
  • Invalid request generates a legitimate 404 message.
  • Tracks current directory by implementing common commands (cd, pwd, ls, dir)
  • Built in helper commands
  • Simple replay attack prevention. Uses a token that is only valid +/- 12 hours of current time.
  • 'Authentication' using replay attack prevention

Python Dependencies

  • refer to requirements.txt

SubShell Console Reference

Interaction with a remote 'shell' using subshell is similar to a non-interactive shell. Non interactive commands can be submited and the results displayed.

If an interactive command is submitted, the command will not return. Command will display a timeout error. This is an HTTP timeout and not an error of whether the command executed or not.

Command Description Example
cd change directory cd c:\temp
command Optional command used to issue remote command. If no other built in command matches, then this command is assumed. command tasklist
config Show current settings config
dir directory command dir c:\temp
download download remote file. Files stored in ./downloads. The original file structure is created. download c:\temp\myfile.txt
exit exit command shell exit
help Display help for commands help
history show command history history
ls alias for dir ls c:\temp
mysql Issue SQL command to MySQL Server base on MySQL configuration mysql show databases
mysql_db Select MySQL databse mysql_db mysql
mysql_password Select MySQL password mysql_password password
mysql_server Select MySQL server mysql_server localhost
mysql_username Select MySQL username mysql_username root
ps List processes ps
pwd show current directory pwd
python drop to interactive python shell python
shell submit command to local shell shell ifconfig
status Show status for Uploads and Downloads status
timeout display or set the command timeout setting in seconds timeout 120
upload upload file to remote server. upload myfile.txt c:\windows\temp\myfile.txt

API Used to Communicate to web shells

All command submitted to the shell are POST request with a minimum of 2 parameters (sessionid,command)

POST Parameters

Parameter Description
sessionid Used to 'authenticate' requests and minimized replay attacks. Based on current time. Any request +/- 12hrs will not be allowed. If the time is off an HTTP 408 will be sent with the HTTP header expires:'timevalue'. SubShell can use this value to adjust its authentication it sends.
apikey used to submit OS commands
apikeyd Download file from remote host
apikeyu Upload file to remote host
feed stores Base64 encoded file. Used for upload

Features Support by Shell Type

Feature jsp aspx asp php
Replay Protection x x x x
Issue command x x x x
Upload x x
Download x x x x
MySQL connector x
404 on GET x x x x

Initial Thought and Requirements to build project

  • Single command and control server
  • Web shell payloads (3 versions)
    • .jsp, .asp, .aspx
  • Requests/Responses must be obfuscated or encrypted
    • SubShell is currently using base64
  • Web shell features
    • File browsing – (track current directory)
    • File Upload/Download
    • Command execution
    • HTTP POST Requests used for C2 traffic
    • Non-POST Requests render a valid 404 response