FwdSh3ll is a tiny open source framework for crafting forward shells. What is a forward shell? Have you ever been caught in a situation when looking for an approach to a CTF box you discover an RCE vulnerability in a web app but despite that you can't get a reverse shell no matter how hard you try due to strictly filtered outbound traffic? A forward shell is a scheme of shell interacting with a vulnerable Linux machine based on the named pipes mechanism. Check the description for details!
This tool does not claim to provide an all-occasions usage experience out of the box. Each pentest case involes an individual basic enumeration first, whose results may require minor code adjustment.
LEGAL DISCLAIMER: FwdSh3ll was written for use in educational purposes only. Using this tool for attacking web servers without prior mutual consistency can be considered as an illegal activity. It is the final user's responsibility to obey all applicable local, state and federal laws. The author assume no liability and is not responsible for any misuse or damage caused by this tool.
This demo is showing the HTB Stratosphere box user owning.
This method of getting a shell is described in a couple of IppSec's youtube write-ups (Sokar and Stratosphere). The main idea here is to create a named pipe with mkfifo command and tail -f its input to a bash process. The output would go into a regular text file which could be simply cat'ted. Here is how it looks like:
- python3.x (or newer) interpreter
FwdSh3ll makes use of the following external modules:
To resolve all Python dependencies create a virtual environment and run pip from within:
$ virtualenv -p python3 venv && . venv/bin/activate
(venv) $ pip install -r requirements.txt
Or let the pipenv one-liner do all the dirty work for you:
$ pipenv install && pipenv shell
usage: FwdSh3ll.py [-h] [-pp PIPES_PATH] [-b64]
non-interactive mode options
optional arguments:
-h, --help show this help message and exit
-pp PIPES_PATH, --pipes-path PIPES_PATH set remote path of the named pipes to PIPES_PATH (default: "/dev/shm")
interactive mode options
* Target URL:
Specify the vulnerable URL to attack.
* Proxy URL (optional):
Specify proxy if needed.
* Payload:
Choose required payload from the list.
* Mode (single command vs forward shell):
Choose required action.
To successfully spawn the forward shell the following stuff should be reachable on the target host:
/bin/sh/usr/bin/mkfifo/usr/bin/tail/usr/bin/base64
List of RCE vulnerabilities for which payloads are available (will be expanding):
ApacheStruts.py— Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 RCE — CVE-2017-5638 (exploit-db)NodejsExpress.py— Node.js deserialization bug for RCE — CVE-2017-5941 (exploit-db)ShellShock.py— Bash code injection RCE — CVE-2014-6271WebShell.py— Just a web shell
- If you get the
connection timeouterror when initializing the forward shell, just rerun the script. - Some Linux distributions does not support the
/dev/shmpath (shared memory, availability depends on kernel config), so if something goes wrong, try changing it to/tmpwith the-pswitch. - When setting the named pipes, the
>& file.outputsyntax for combinig stdout and stderr should be supported by bothbash/zshand(t)csh, but it's not a Bash preferable way though. So there could be issues with the redirection syntax for various shells. Keep that in mind.
Special thanks to 0xdf and IppSec for sharing the forward shell concept.
If this tool has been useful for you, feel free to buy me a coffee ☕
