REVSH(1)

NAME
revsh - A reverse shell and data tunnelling tool for pentesters.

SYNOPSIS
revsh [[-c CONTROL_OPTIONS] | [TARGET_OPTIONS]] [MUTUAL_OPTIONS] [ADDRESS[:PORT]]

DESCRIPTION
revsh is a connect-back remote access tool with advanced data tunnelling capabilities designed for pentesters and other security professionals. Among it's notable high level features are:

•   Full terminal support.

•   In-band asynchronous tunnelling of abstract data.

•   Full tunnel encryption (with Perfect Forward Secrecy available for custom builds.)

•   SOCKS proxy support.

•   Tun / Tap support, allowing for a full reverse VPN onto the target network.

The revsh binary operates in one of two modes: control or target. When run in control mode revsh will act as the command and control node and issue commands to any target node that it connects with. (In the traditional case of a reverse shell the control node is the listener and the target host is performing the connect back.) The same binary is used for both control and target operations, allowing for rapid movement and binary reuse in reasonably homogeneous target environments.

  CONTROL_OPTIONS

-c  Run in "command and control" mode. -l will also function as expected.

-a  Enable Anonymous Diffie-Hellman mode. (In the GENERIC_BUILD, this will be the only option available. For access to Ephemeral Diffie-Hellman mode you will need to build from source and manage your own certs.)

-d KEYS_DIR
    Reference the keys / certificates in an alternate directory. The certs in this directory will be used during the authentication phase of the Ephemeral Diffie-Hellman TLS handshake. (Default is "~/.revsh/keys/".)

-f RC_FILE
    Reference an alternate rc file. (Default is "~/.revsh/rc".)

-s SHELL
    Invoke SHELL as the remote shell. (Default is "/bin/bash".)

-F LOG_FILE
    Log general use and errors to LOG_FILE.

  TARGET_OPTIONS

-t SEC
    Set the connection to timeout after SEC seconds and self terminate. (Default is "3600".)

-r SEC1[,SEC2]
    Set the retry time to be SEC1 seconds, or to be random in the range from SEC1 to SEC2. The random value in this range will be used as a nonperiodic retry timer for connect-back. Every attempt at connect-back will cause the random value to be recalculated. (Default is "600,1200".)

  MUTUAL_OPTIONS

ADDRESS
    The address of the control listener. (Default is "0.0.0.0".)

PORT
    The port of the control listener. (Default is "2200".)

-k  Run in keep-alive mode. Node will neither exit normally, nor self-terminate from timeout.

-L [LHOST:]LPORT:RHOST:RPORT
    Static socket forwarding with a local listener at LHOST:LPORT forwarding to RHOST:RPORT.

-R [RHOST:]RPORT:LHOST:LPORT
    Static socket forwarding with a remote listener at RHOST:RPORT forwarding to LHOST:LPORT.

-D [LHOST:]LPORT
    Dynamic socket forwarding with a local listener at LHOST:LPORT. (Socks 4, 4a, and 5. TCP connect only.)

-B [RHOST:] RPORT
    Dynamic socket forwarding with a remote listener at LHOST:LPORT. (Socks 4, 4a, and 5. TCP connect only.)

-x  Disable automatic setup of proxies. (Defaults: Proxy D2280, L2290:127.0.0.1:2291, R2290:127.0.0.1:2291, and tun/tap devices.)

-b  Start in bind shell mode. (Default is reverse shell mode.) Note: The -b flag must be invoked on both ends or the binary must be named "bindsh".

-n  Non-interactive data broker. No tty. Useful for copying files. (Default is interactive w/remote tty.)

-v  Verbose. -vv and -vvv increase verbosity.

-V  Print the program and protocol versions.

-h  Print the help.

-e  Print out some usage examples.

  Escape Sequences
revsh supports several of the same '~' escape sequences as SSH. These tilde escapes must be preceded by a newline in order to be recognized. These sequences can also be sent down multiple connected hops by using an additional '~' for each hop. Because revsh uses the same notation as SSH, these multi-hop sequences can be used even when SSH and revsh connections are intermingled in the same command chain. The escape sequences supported by revsh are as follows:

~.  Close the connection. This is particularly useful for killing an unresponsive connection. Note, if you are SSH'd into your C2 node, you launch revsh and the target connects back, you can then kill the revsh connection by issuing the "~~." command, without killing your SSH session.

~#  Print statistics about all active listeners and connections. This is generally useful to see what activity is being forwarded down the tunnel. This is particularly useful when using a point-to-point proxy connection bound to localhost for in-band asynchronous file transfer. You can see when such a transfer has completed by viewing the total data read / written across that connection and terminate the transfer when the desired file size has been reached. (See the EXAMPLES section for more information.)

~?  List the supported escape sequences.

  Tun / Tap Support
revsh has built in support for tun / tap devices. Tun / tap devices are virtual ethernet cards. They are capable of sending and receiving raw IP packets / ethernet frames. The packets / frames received by a tun / tap device will be handed by the kernel to the listening application, which in this case is revsh . revsh then forwards these packets / frames down its encrypted tunnel. On the remote node, revsh takes the newly received packets / frames and hands them to the tun / tap device on it's end. This turns them over to the remote kernel to handle and route appropriately. This means that with either an Iptables NAT rule or by bridging a remote network card you can turn revsh into a full Reverse VPN. This method will give you a fully routable IP address on the target network.

  Proxy Support
revsh has built in support for SOCKS proxy tunnels. By default revsh will run a local listener for a dynamic SOCKS proxy on port 2280. revsh will understand requests for the following proxy types:

Local
    A point-to-point socket forwarding proxy with a listener on the local control node.

Remote
    A point-to-point socket forwarding proxy with a listener on the remote target node.

Dynamic
    A dynamic SOCKS proxy with a listener on the local control node.

Bypass
    A dynamic SOCKS proxy with a listener on the remote target node.

The supported SOCKS protocol versions are 4, 4a, and 5. However, it should be noted that only a subset of the full SOCKS command set has been implemented. In each case, only simple TCP connect requests are supported.

  File Transfers
revsh supports in-band asynchronous arbitrary data transfers. This means that you can copy any kind of file, using the the same crypto tunnel as your terminal, without it blocking the terminal, the vpn, the socks proxies, or any other active connection. When approaching the problem of file transfer, the decision was made to keep the interface simple. As such, by default, both the control node and the target node will setup a point-to-point socket forwarder bound to localhost. This will have localhost port 2290 as an input socket on both ends, and 2291 as an output socket on both ends. With this default setup you can quickly and easily move files either using netcat or revsh to send the data on one end and another netcat or revsh to receive the data on the other. When combined with the "~#" escape sequence for stats on active connections you will be able to see when the file transfer is complete and close the connection.

ENVIRONMENT
The variables TERM and LANG are automatically exported to the remote session to ensure a reasonable terminal experience. The default rc file will also set PS1 and PATH to sane defaults. It will also unset the HISTFILE variable. You will also want to set a sane HOME variable in your rc file or "~" won't act in a sane manner.

FILES

/usr/local/bin/revsh
    Install location for the binary.

~/.revsh/
    The revsh user's directory for personal customization.

~/.revsh/rc
    The user's revsh rc file, whose commands are executed remotely upon connection.

~/.revsh/keys/
    The user's main keys directory. The certs for a particular build are stored here. Custom key directories set up on a per target basis can be separately managed and invoked with the -d option.

EXAMPLES
revsh -e

DIAGNOSTICS
revsh exits with 0 on success and -1 on error.

COMPATIBILITY

  Libraries
revsh was written with portability in mind. Unfortunately there are issues innate to moving a complex binary onto a target platform whose libraries are in an unknown state. The only compatabile libraries that revsh requires on the target host are libssl and libcrypto from OpenSSL. OpenSSL library compatability represents the single greatest challenge to revsh portability. When faced with a library incompatability (or total absence) your options are:

Static Build
    A compilation option to build the libraries in statically exists in the Makefile. This will result in a slight increase in the binary size, but add great portability. If the host continues to present compatibility issues, it may be old enough that these issues are in the libc networking library themselves.

Dynamic Build to Era
    Fingerprint the target host, install a VM with that version in your lab environment, and build a custom revsh binary on it. As long as OpenSSL is present on the target host, this option will resolve all known library issues.

Compatibility Build
    The Makefile also offers a compatibility build. This build does *NOT* have encryption, so there is no OpenSSL dependency. (Your traffic will *NOT* be encrypted!) Additionally, this build uses the older suite of libc networking calls and should resolve any issues with targeting an older libc install.

  Ephemeral Diffie-Hellman
revsh is built with Anonymous Diffie-Hellman as the TLS handshake in the GENERIC_BUILD. While offering compatibility with other revsh binaries, the lack of authentication allows for the potential of a malicious connection. Due to the timing aspect of a normal interaction (the operator is sitting at the terminal waiting for the connect back which they launch manually) such a counter-hack event is unlikely. However, to add authentication to the TLS handshake, revsh offers Ephemeral Diffie-Hellman support with Perfect Forward Secrecy. This is the default mode when the binary is built from source by the operator. The first step of compilation is to generate the appropriate certs. The second step then embeds the target certs in the binary! This is done purposefully so that a credential recovery / reuse isn't as simple as grabbing the certs from disk or pulling a password out of the binary. The challenge for a counter-hack has then been upped to the level of reverse-engineering. While baking crypto into a programs binary is very sub-optimal for the enterprise, it is useful in reducing exposure in a network penetration scenario. This is mentioned in the COMPATIBILITY section because it inherently implies that a control node will be unable to authenticate a target node with EDH if it doesn't have access to the certs from the target binaries build. (This is what is referred to as the "keys" directory.) If the build of the target and the control are different, and the control doesn't know the targets certs, EDH will not work and the binaries are incompatible. The binaries will still work with ADH, thus disabling the authentication piece of the TLS handshake entirely.

  SOCKS
revsh supports SOCKS 4, 4a, and 5 TCP Connect calls. Neither TCP Bind calls, nor UDP calls are supported. Adding such capabilities would have significantly increased the complexity and size of the program without any real gain in modern functionality. SOCKS is powerful and easy to use, but I would suggest using the reverse VPN feature of revsh to bridge networks if a more complex network interaction is required.

SEE ALSO
netcat(1) ssh(1)

STANDARDS
p1003.1-2001

HISTORY
revsh started life as a simple reverse shell with a tty. Many features have been added over the last several years. I've done my best to keep out features that are superfluous while adding in ones that seem helpful. My main happiness is in knowing that I have deleted far more of this codebase than exists today.

AUTHORS
@emptymonkey - github.com/emptymonkey

BUGS
Obviously. Report them, please, and I'll try to fix them.