Asynchronous reverse shell using the HTTP protocol

HTTP Asynchronous Reverse Shell

Why?

Today there are many ways to create a reverse shell in order to be able to remotely control a machine through a firewall. Indeed, outgoing connections are not always filtered.

However, security software and hardware (IPS, IDS, Proxy, AV, EDR…) are more and more powerful and can detect these attacks. Most of the time the connection to a reverse shell is established through a TCP or UDP tunnel.

I figured that the best way to stay undetected would be to make it look like legitimate traffic. The HTTP protocol is the most used by a standard user. Moreover, it is almost never filtered so as not to block access to websites.

How it works?

1. The client app is executed on the target machine.
2. The client initiates the connection with the server.
3. The server accepts the connection.

Then:
-The client queries the server until it gets instructions.
-The attacker provides instructions to the server.
-When a command is defined, the client executes it and returns the result.

And so on, until the attacker decides to end the session.

Disclaimer

This tool is only intended to be a proof of concept demonstration tool for authorized security testing. Make sure you check with your local laws before running this tool.

Features

Today, as a poc, the following functionalities are implemented:

1. Fake HTTP traffic to appear as searches on bing.com.
2. Commands are base64 encoded in the HTML response.
3. The result of the commands is encoded in base64 as a cookie by the client.
4. SSL support; by default, it is a fake bing.com certificate.
5. Random delay between each customer call to avoid triggering IDSs.
6. Random template is used for each response from the server.
7. Re-use of the same powershell process to avoid triggering EDRs.
8. Support for all Cmd and Powershell commands.
9. The client displays a fake error message at startup.
10. The client is hidden from the tasks manager.
11. The client can be run as an administrator.

AV Detection

Only 3 out of 69 products were able to detect the client as malicious, without applying any evasive or obfuscation techniques.

Download && Use

Copyright (c) 2020 onSec-fr