reverse-ssh - Statically-linked ssh server with reverse shell fu

项目说明

Re

A statically-linked ssh 服务端 with a reverse connection feature for simple yet powerful remote access. Most useful during HackTheBox challenges, CTFs or similar.

Has been de and was extensively used during OSCP exam preparation.

Get the latest Release

!Showcase

Features

Catching a reverse shell with _netcat_ is cool, sure, but who hasn't accidentally closed a reverse shell with a keyboard interrupt due to muscle memory?
Besides their fragility, such shells are also often missing con features such as fully interacti, TAB-completion or history.

Instead, you can go the way to simply deploy the lightweight ssh server (<1.5MB) re onto the target, and use additional commodities such as file transfer and port forwarding!

Re tries to bridge the gap between initial foothold on a target and full local pri escalation.
Its main strengths are the following:

* Fully interacti access (check caveats for old windows below)
* File transfer via sftp
* Local / remote / dynamic port forwarding
* Can be used as bind- and re
* Supports Unix and Windows operating systems

Windows caveats

A fully interacti on windows relies on Windows Pseudo Console ConPTY and thus requires at least Win10 Build 17763.
On earlier you can still get an interacti shell that can't handle terminal codes such as arrow keys or keyboard interrupts.
In such cases you have to append the cmd command, i.e. ssh <OPTIONS> <IP> cmd.

You can achieve full interacti access for older windows by dropping ssh-shellhost.exe from OpenSSH for Windows in the same directory as re and then use flag -s ssh-shellhost.exe.
This will pipe all traffic through ssh-shellhost.exe, which mimics a pty and transforms all terminal codes such that windows can understand.

Requirements

Simply executing the provided binaries only relies on golang system requirements.

In short:

* Linux: kernel 2.6.23 and higher
* Windows: Windows Ser and higher or Windows 7 and higher

Compiling additionally requires the following:

* golang 1.15
* optionally upx for compression (e.g. apt install upx-ucl)

Usage

Once re is running on the , you can connect with any username and the default password letmeinbrudipls, the ssh key or whatever you specified during compilation.
After all, it is just an ssh server:

Running Re as bind shell

Running Re as reverse shell

Note: you can compile Re with parameters for LHOST and LPORT to ease execution on the target, see below

In the end it's plain ssh, so you could catch the remote port forwarding call coming from the 's machine with your openssh daemon listening on port 22.
Just prepend <USER>@ and provide the password once asked to do so.
Dialling home currently is password only, because I didn't feel like baking a private key in there as well yet...

For even more con, add the following to your ~/.ssh/config, copy the ssh private key to ~/.ssh/ and simply call ssh target or sftp target afterwards:

Full usage

Build instructions

Make sure to install the abo such as golang in a matching and set it up correctly.
Afterwards, you can compile with make, which will create static binaries in bin.
Use make compressed to pack the binaries with upx to further reduce their size.

Build tricks

You can also specify one or more of the following en when compiling to customize Re to your use case:

* RS_SHELL to change the default shell
* RS_PASS to provide your personalized password
* RS_PUB to provide your personalized an authorized key
* LUSER to change the default username of the ssh connection attempt
* LHOST to provide a default LHOST value and make Re default to the reverse scenario
* LPORT to change the default listening port or port where an ssh connection attempt is sent to
* BPORT to change the default listening port of reverse connections on the attacker machine; 0 means any free port is taken
* NOCLI with any value removes all user-facing interaction (the binary ignores all supplied flags or arguments)

Building for different operating systems or architectures

By default, re is compiled for your current OS and architecture, as well as for linux and windows in x86 and x64.
To compile for other architectures or another OS you can provide en which match your target, e.g. for linux/arm64:

A list of a targets in format OS/arch can be obtained via go tool dist list.

Contribute

Is a mind-blowing feature missing? Anything not working as intended?

Create an issue or pull request!

项目信息

开发语言：Go

Star 数：1065

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Statically-linked ssh 服务端 with reverse shell functionality for CTFs and such展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。