emptymonkey / revsh

A reverse shell with terminal support, data tunneling, and advanced pivoting capabilities.
MIT License
458 stars 90 forks source link

Hiding rc from STDIN #25

Closed ghost closed 6 years ago

ghost commented 6 years ago

I was thinking if we can hide or silence the output of sending "rc" file contents to target instead of making it popup on STDIN cause I'm finding myself adding lots of shell functions and env variables to automate and script some stuff but it's a little ugly when you open a session

ghost commented 6 years ago

I tried turning off echo in do_target() but when I turn it back on before bash execve I still get rc output written

void setecho(int fd, int b)
{
    struct termios term;
    int err;
    if (tcgetattr(fd, &term) == -1){
        perror("setecho(): tcgetattr() Error\n");
        return(-1);
    }
    if (b){
        term.c_lflag = term.c_lflag | (ECHO|ICANON);
    }
    else{
        term.c_lflag = term.c_lflag & ~(ECHO|ICANON);
    }
    err = tcsetattr(fd, TCSANOW, &term);
    if (err == -1 && err == EINTR){
        perror("setecho(): tcsetattr() Error\n");
        return(-1);
    }
}

/*  - Parent: Enter broker() and broker tty. */
if(close(pty_slave) == -1){
    report_error("do_target(): close(%d): %s", pty_slave, strerror(errno));
    return(-1);
}

io->local_in_fd = pty_master;
io->local_out_fd = pty_master;

// unset tty echo
setecho(io->local_in_fd, 0);

// reset echo
setecho(STDIN_FILENO, 1);

execve(exec_argv[0], exec_argv, exec_envp);

report_error("do_target(): execve(%s, %lx, %lx): %s", exec_argv[0], (unsigned long) message->data_type, (unsigned long) exec_envp, strerror(errno));

return(-1);

but if I leave echo turned off and run "stty echo icanon" from shell or in the end of rc it gets sourced with no output except the $PS1 output if rc contents not in a single line

so anyway this foolish method of mine is not working :D maybe I should just forget about it

Edit: I just cleaned the rc file making it all in a single line with semicolons ";" so it shows up as a small justified block of text it's a little bit cleaner now