search

brightio / penelope

Penelope Shell Handler
GNU General Public License v3.0
705 stars 93 forks source link
bind-shell ctf ctf-tools pty python rce reverse-shell shell-handler tty

readme

Logo

Penelope is a shell handler designed to be easy to use and intended to replace netcat when exploiting RCE vulnerabilities. It is compatible with Linux and macOS and requires Python 3.6 or higher. It is a standalone script that does not require any installation or external dependencies, and it is intended to remain this way.

penelope

Among the main features are:

Penelope can work in conjunction with metasploit exploits by disabling the default handler with set DisablePayloadHandler True

One useful feature regarding Windows shells is that they can be automatically upgraded to meterpreter shells by running the "meterpreter" module.

meterpreter

Usage

Sample Typical Usage

./penelope.py                   # Listening for reverse shells on 0.0.0.0:4444
./penelope.py -a                # Listening for reverse shells on 0.0.0.0:4444 and show reverse shell payloads based on the current Listeners
./penelope.py 5555              # Listening for reverse shells on 0.0.0.0:5555
./penelope.py 5555 -i eth0      # Listening for reverse shells on eth0:5555
./penelope.py 1111 2222 3333    # Listening for reverse shells on 0.0.0.0:1111, 0.0.0.0:2222, 0.0.0.0:3333
./penelope.py -c target 3333    # Connect to a bind shell on target:3333

Demonstrating Random Usage

As shown in the below video, within only a few seconds we have easily:

  1. A fully functional auto-resizable PTY shell while logging every interaction with the target
  2. Execute the lastest version of Linpeas on the target without touching the disk and get the output on a local file in realtime
  3. One more PTY shell in another tab
  4. Uploaded the latest versions of LinPEAS and linux-smart-enumeration
  5. Uploaded a local folder with custom scripts
  6. Uploaded an exploit-db exploit directly from URL
  7. Downloaded and opened locally a remote file
  8. Downloaded the remote /etc directory
  9. For every shell that may be killed for some reason, automatically a new one is spawned. This gives us a kind of persistence with the target

https://github.com/brightio/penelope/assets/65655412/7295da32-28e2-4c92-971f-09423eeff178

Main Menu Commands

Some Notes:

Main Menu

Command Line Options

positional arguments:
  ports                 Ports to listen/connect to, depending on -i/-c options. Default: 4444

Reverse or Bind shell?:
  -i , --interface      Interface or IP address to listen on. Default: 0.0.0.0
  -c , --connect        Bind shell Host

Hints:
  -a, --hints           Show sample payloads for reverse shell based on the registered Listeners
  -l, --interfaces      Show the available network interfaces
  -h, --help            show this help message and exit

Verbosity:
  -Q, --silent          Be a bit less verbose
  -d, --debug           Show debug messages

Session Logging:
  -L, --no-log          Do not create session log files
  -T, --no-timestamps   Do not include timestamps in session logs
  -CT, --no-colored-timestamps    Do not color timestamps in session logs

Misc:
  -r , --configfile     Configuration file location
  -m , --maintain       Maintain NUM total shells per target
  -H, --no-history      Disable shell history on target
  -P, --plain           Just land to the main menu
  -S, --single-session  Accommodate only the first created session
  -C, --no-attach       Disable auto attaching sessions upon creation
  -U, --no-upgrade      Do not upgrade shells

File server:
  -s, --serve           HTTP File Server mode
  -p , --port           File Server port. Default: 8000
  -pass , --password    URL prefix

Debug:
  -N , --no-bins        Simulate binary absence on target (comma separated list)
  -v, --version         Show Penelope version

Extras

There are also included two sample exploit simulation scripts in the extras folder to demonstrate how penelope can be imported and get shell on the same terminal. The illustration below shows how Penelope is imported in a python3 exploit for the Quick machine of Hack The Box.

exploit

Furthermore, a bash script is included which automatically upgrades Unix shells to PTY using the xdotool.

tty

Contribution

If you want to contribute to this project please report bugs, unexpected program behaviours and/or new ideas.

TODO

Features

Known Issues

Limitations

Trivia

Penelope was the wife of Odysseus and she is known for her fidelity for him by waiting years. Since a characteristic of reverse shell handlers is waiting, this tool is named after her.

Thanks to