redshell - An interactive command prompt for red teaming and

项目说明

RedShell

An interacti prompt for red teaming and pentesting. Automatically pushes commands through SOCKS4/5 proxies . Optional Cobalt Strike integration pulls beacon SOCKS4/5 proxies from the team server. Automatically logs acti to a local CSV file and a Cobalt Strike team server (if configured).

Note that because RedShell uses proxychains under the hood, only TCP traffic is proxied.

Installation

RedShell runs on Python > 3.8.

Install dependencies:

Install proxychains-ng ():

RedShell is no longer dependent on Cobalt Strike. However, if you're using Cobalt Strike integration, the CS client must be installed on the same host as RedShell. Also make the agscript wrapper executable:

Usage

Start RedShell:

Display help:

Set options:

Logging

RedShell automatically logs acti via the beacon_exec, proxy_exec, exec, or log commands. Logging is automatically initialized on startup, and log files are written to: ~/.redshell.

To log to Cobalt Strike, connect to a team server, select a pivot, and use the beacon_exec command.

Proxies

RedShell uses proxychains-ng and a custom proxychains configuration file. Configuration file modifications and command proxying are handled on-the-fly.

Cobalt Strike

To proxy through a Cobalt Strike, connect to a team server, select a pivot, and use the beacon_exec command. Refer to the Cobalt Strike section for details.

Custom Proxies

Custom socks 4 or 5 proxies can be set with the socks command.

SOCKS Proxy

RedShell automatically connections and authentication (where applicable) to SOCKS proxies upon selection (either using the socks or cs_use_pivot commands). This can be disabled with the following command: set check_socks false

Context

RedShell's context is a key aspect of activity logging. Context allows you to set the perspective (in activity logs) of the source host executing acti in a target network. The following context attributes can included in activity logs: IP Address, DNS Name, NetBIOS Name, User Name, and Process ID. Only IP Address is required.

Notes on context:
- Context is cleared when you set a new socks port
- Context is cleared when you connect/disconnect from a CS team server

Context - Custom Proxies

After you set a socks proxy with the socks command, add context details with the context command.

Context - Cobalt Strike

If you are using a pivot on a team server, context are automatically set based on the beacon.

Command Prompt

The command prompt is automatically updated with context (user).

Execute and Log

The following RedShell commands are captured in activity logs:
- beacon_exec - Execute a command through beacon socks proxy and simultaneously log it to the teamserver.
- proxy_exec - Execute a command through custom socks proxy and simultaneously log it to the local file.
- exec - Execute a command and log it to the local file.
- log - Add a manual log entry to the local file.

Custom Proxy Example

!alt text

Cobalt Strike

Connecting to Cobalt Strike

Set Cobalt Strike connection options:

Connect to team server (you will be prompted for the team ser):

Example:

!alt text

Or load from a config file. Note: team ser are not read from config files. RedShell will prompt for the teamser and then automatically connect.

Show a proxy pivots:

Example:

!alt text

Select a proxy pivot (note: this can only be set after a connection to the team server has been established):

Check Cobalt Strike status:

Example:

!alt text

Execute commands through the beacon socks proxy. These can be run in the context of the current user or via sudo. Specifying 'proxychains' in the command is optional. Commands are forced through proxychains. MITRE ATT&CK Tactic IDs are optional.

Example:

!alt text

Note on the Redshell and CS install directory options - the script needs to know where it lives, as well as Cobalt Strike.
If stuff blows up, be sure to set the directories accordingly:

General

Note on passwords used in *exec commands: special characters in passwords may be interpreted as shell meta characters, which could cause commands to fail. To get around this, set the password option and then invoke with '$password'. Example:

RedShell includes commands for na the file system:

Additional commands can be run via the shell command or via the '!' shortcut:

Commands are tracked and accessible via the history command:

RedShell also includes tab-completion and clearing the terminal window via ctrl + l.

CSV Log Format

Notes:

Required fields: Datetime, IP Address, Activity

Optional fields: DNS Name, NetBIOS Name, User, PID, TTPs

Datetime format: "%Y/%m/%d %H:%M:%S %z" (UTC)

Maintainers

- exfiltrata

License

This project is licensed under the terms of the Apache 2.0 open source license. Please refer to LICENSE for the full terms.

项目信息

开发语言：Python

Star 数：227

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An interactive command prompt for red teaming and pentesting. Automatically pushes commands through SOCKS4/5 proxies via proxychains. Optional Cobalt Strike integration pulls beacon SOCKS4/5 proxies from the team server. Automatically logs activities to a local CSV file and a Cobalt Strike team server (if configured).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。