Penelope Shell Handler

Related tags

Miscellaneouspenelope
Overview

penelope

Penelope is an advanced shell handler. Its main aim is to replace netcat as shell catcher during exploiting RCE vulnerabilities. It works on Linux and macOS and the only requirement is Python3. It is one script without 3rd party dependencies and hopefully it will stay that way.

Among the main features are:

  • Auto-upgrade shells to PTY (auto-resize included)
  • Logging interaction with the targets
  • Download files from targets
  • Upload files to targets
  • Upload preset scripts to targets
  • Spawn backup shells
  • Multiple sessions
  • Multiple listeners
  • Can be imported by exploits and get shell on the same terminal.

Sample basic usage

penelope.py                   # Listening for reverse shells on 0.0.0.0:4444
penelope.py 5555              # Listening for reverse shells on 0.0.0.0:5555
penelope.py 5555 -i eth0      # Listening for reverse shells on eth0:5555

penelope.py -c target 3333    # Connect to a bind shell on target:3333

Demonstrating random usage (1)

  1. Executing penelope without parameters and getting a reverse shell
  2. Pressing F12 to detach the session and go to the main menu
  3. Run 'recon' command to upload preset privesc scripts to the target
  4. Interacting again with the session, confirming that scripts are uploaded
  5. Detaching again with F12 and downloading /etc directory from the target
  6. Kill the session and exiting with Ctrl-D

sample_usage

Demonstrating random usage (2)

  1. Adding an extra listener and show all listeners
  2. Interacting with session 1
  3. Spawning 2 extra backup sessions
  4. Showing all sessions

sample_usage2

Command line options

positional arguments:
  PORT                  Port to listen/connect to depending on -i/-c options. Default: 4444

Reverse or Bind shell?:
  -i , --address        IP Address or Interface to listen on. Default: 0.0.0.0
  -c , --connect        Bind shell Host

Hints:
  -a, --hints           Show sample payloads for reverse shell based on the registered listeners
  -l, --interfaces      Show the available network interfaces
  -h, --help            show this help message and exit

Verbosity:
  -Q, --silent          Show only errors and warnings
  -X, --extra-silent    Suppress all logging messages

Logging:
  -L, --no-log          Do not create session log files
  -T, --no-timestamps   Do not include timestamps on logs

Misc:
  -H, --no-history      Disable shell history on target
  -P, --plain           Just land to the menu
  -S, --single-session  Accommodate only the first created session
  -C, --no-attach       Disable auto attaching sessions upon creation
  -U, --no-upgrade      Do not upgrade shells

Debug:
  -d, --debug           Show debug messages
  -NP, --no-python      Simulate python absense on target
  -NB, --no-bash        Simulate bash absense on target

Menu options

use [sessionID|none]
  Select a session

sessions [sessionID]
  Show active sessions. When followed by <sessionID>, interact with that
  session

interact [sessionID]
  Interact with a session

kill [sessionID|all]
  Kill a session

download <glob>...
  Download files and folders from the target

open <glob>...
  Download files and folders from the target and open them locally

upload <glob|URL>...
  Upload files and folders to the target. If URL is specified then it is
  downloaded locally and then uploaded to the target

recon [sessionID]
  Upload preset reconnaissance scripts to the target

spawn [sessionID]
  Spawn a new session. Whether it will be reverse or bind, depends on
  the current session.

upgrade [sessionID]
  Upgrade the session's shell to "PTY". If it fails attempts to upgrade
  it to "Advanced". If this fail too, then falls back to "Basic" shell.

dir|. [sessionID]
  Open the session's local folder. If no session is selected, opens the
  base folder.

listeners [<add|stop> <Interface|IP> <Port>]
  Add or stop a Listener. When invoked without parameters, it shows the
  active Listeners.

connect <Host> <Port>
  Connect to a bind shell

hints
  Show sample commands to run on the targets to get reverse shell, based
  on the registered listeners

reset
  Reset the local terminal

history
  Show menu history

help [command]
  Show menu help or help about specific command

DEBUG
  Open debug console

SET [<param> <value>]
  Set options. When invoked without paramaters it shows current options

exit|quit|q|Ctrl+D
  Exit penelope

Bonus

There are also included two sample exploit simulation scripts to demonstrate how penelope can be imported and get shell on the same terminal. Furthermore, one bash script is included that automatically upgrades Unix shells to PTY using xdotool.

TODO

Features

  • currenly download/upload/spawn/upgrade commands are supported only on Unix shells.
  • port forwarding
  • persistence
  • edit command: open the remote file locally, make changes and upon saving, upload it to target
  • ability to specify a list of commands to run automatically on target and/or the main menu
  • execute a local script on target and get the output on a local file
  • main menu autocompletion for short commands
  • download/upload progress bar
  • download/upload autocompletion
  • IPv6
  • encryption
  • UDP

Bugs

  • Ctrl-C on main menu has not the expected behaviour yet. However can still stop commands like 'download'.
  • Session logging: when executing commands with alternate buffers like nano on target, then when cat the log it seems corrupted. However the data are still there.

Misc

  • apply some PEP8
  • consider autorunning bash -l on new shells
  • better way to handle duplicate downloads

Limitations

  • emojis don't appear on mate-terminal (parrot OS)
  • download command: path links are not clickable on qterminal (Kali Linux)
  • penelope menu commands and PTY autoresize operate on the same socket. This could be an advantage but it has a side effect that for example if nano is open on target, then detaching the session and attempt a download, penelope copes with that by sending Ctrl-Z -> Ctrl-E -> Ctrl-U. Then must run fg to get the process back. Maybe consider to spawn extra socket for controling the session in the future. However, if before executing a menu command, the target's terminal if left on a clear state, then there is no problem.
Comments
  • Upload not working

    Upload not working

    Hello, just found this tool last night and it looks amazing. Just starting to play around with it this evening and I have a great reverse shell (multiple shells with the maintain function) and I have tried to upload files unsuccessfully multiple times.

    Here's what one session looks like when trying to use the run upload_privesc_scripts command

    image

    The session gets disconnected and then says the upload was successful and then tells you there there are no sessions.

    Here's another time when I tried to upload the linpeas.sh script from my system to the remote machine and the session was disconnected again but I had enabled the maintain function and a new shell was spawned. None of the file are visible on the remote system. I have validated that I can write files to the location that I am trying to upload to

    image

    I was able to do a download. I downloaded the entire /etc/ directory without any issue.

    The system is running CentOS release 5.6 (Final) Linux version 2.6.18-238.12.1.el5 ([email protected]) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-50)) #1 SMP Tue May 31 13:23:01 EDT 2011

    Great tool even without the upload, but I will definitely have an even bigger ear to ear grin if I can get the upload working.

    Thanks for an excellent tool!

    opened by robertstrom 4
  • multiple session break console output

    multiple session break console output

    Hi,

    First of all, this tool is amazing. Right now i facing weird issue is that the console just simply messed up after receiving more than 2 connection.

    I attached screenshot to visually describe the issue Capture

    thank you!

    bug 
    opened by RamadhanAmizudin 4
  • Use

    Use "script /dev/null" instead of relying on Python for PTY upgrade

    The shell command "script /dev/null" (and some variations) work without spawning a Python process to launch a PTY shell.

    I'd recommend doing this before trying to do the better known Python method, as it is more reliable.

    enhancement 
    opened by darrenmartyn 4
  • Invalid shell from *

    Invalid shell from *

    Hi When I am trying to connect to the shell through Linux ubuntu 5.11.0-34-generic (using fish shell), it is writing to me: "Invalid shell from"

    opened by NirLevy98 3
  • More privesc scripts

    More privesc scripts

    It would be awesome if you added deepce (Docker enumeration ) , PrivescCheck (Fancy script)

    options.recon_scripts = {
    'Unix':[
    	'https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh',
    	'https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh',
    	'https://raw.githubusercontent.com/stealthcopter/deepce/main/deepce.sh'
    ],
    'Windows':[
    	'https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1',
    	'https://raw.githubusercontent.com/itm4n/PrivescCheck/master/PrivescCheck.ps1'
    ]}
    
    enhancement 
    opened by zAbuQasem 2
  • new feature: Interact console

    new feature: Interact console

    I'm glad to see the creation of this tool,During my use, I came up with a new idea: Can I connect to the current penelope console at another terminal by running the same command again? This makes it easy for me to connect and manage multiple sessions at the same time

    enhancement 
    opened by WAY29 2
  • TERM=xterm-256color for all connection is a slight issue with old Linux versions

    TERM=xterm-256color for all connection is a slight issue with old Linux versions

    Hello,

    I'm working on a very old version of Red Hat (Linux tophat.acme.com 2.4.20-8 #1 Thu Mar 13 17:54:28 EST 2003 i686 athlon i386 GNU/Linux) and I noticed this when using penelope and trying to clear the screen it would not work and you would get an error about unknown terminal xterm-256color

    image

    Trying to clear the terminal

    image

    Environment

    image

    Setting the TERM variable to TERM=xterm image

    The clear command works now

    image

    Not a huge deal by any means, not sure if you were aware or had experienced this or not and not sure if you can check for something like this and set the TERM variable to a standard xterm if xterm-256color is not possible.

    Thanks for the great tool! I'm loving using it and cannot wait to, hopefully, see some updates in the not too distant future (Windows multiple sessions , etc. ;-) )

    opened by robertstrom 1
  • Appreciation

    Appreciation

    I loved your script I have a question can you do some type of stuff like if its windows shell instead of aborting the shell it starts the shell with non tty mode

    bug good first issue 
    opened by root-tanishq 1
  • Questions about v0.9.2

    Questions about v0.9.2

    Hello, I'm about to pull down v0.9.2 and was wondering if you could elaborate on what these two statements translate to.

    • Removed Unix 'advanced' shell support
    • Removed PTY Windows shell support temporarily

    I'm particularly interested in the Windows shell support. Does this mean that using v0.9.2 of penelope no longer supports any Windows reverse shells, or no longer supports some subset of Windows reverse shells?

    What does the removal of Unix 'advanced' shell support mean as far as reduced functionality?

    Thanks again for an excellent tool!! Very glad to see some development updates.

    opened by robertstrom 1
  • Download files /folders

    Download files /folders

    Hi, great work with penelope! My target machine is windows client, so it is not possible to upgrade shell to PTY. When I try do download a file / folder it does not show up "download sucsseful" and the file is not stored on the penelope location it should be. So, is it because the shell is not PTY? Isn t it possible to download files with the simple shell? And, if it isn t, Is there any command to see contents of files on targest system, instead of downloading them? Thanks

    opened by darkness2020 2
Releases(v0.9.2)
  • v0.9.2(Dec 18, 2022)

    Features added:

    • Added PEASS-ng module
    • Introduced tasks (execute remote command from file/memory in background and get the output in a local file)
    • Introduced 'exec' menu command
    • Introduced progress bar for download/upload

    Improvements

    • Enriched Unix shell PTY upgrade process
    • Changed terminal resize functionality from auto to realtime
    • Improved download and upload functionalities
    • Fixed several bugs

    Changes

    • Introduce 'agent' mode (needs python on target) for smoother interaction with the targets
    • Introduce 'control session' concept when python is not available
    • Removed PTY Windows shell support temporarily
    • Removed Unix 'advanced' shell support
    Source code(tar.gz)
    Source code(zip)
  • v0.8.5(May 11, 2022)

    Features added:

    • Configuration file
    • Interfaces command
    • Multiple listeners at once via command line

    Changes

    • Removed 'recon' command and implemented 'run' command
    Source code(tar.gz)
    Source code(zip)
  • v0.8.4(Jan 24, 2022)

    Features added:

    • Maintain X active sessions
    • Spawn to another port and/or host
    • Compatibility with Python >= 3.6
    • Upload exploitdb exploit from URL

    Changes

    • No detaching or PTY resize while on alternate buffer
    Source code(tar.gz)
    Source code(zip)
  • v0.8.0(Jan 24, 2022)

    Initial release

    Features

    • Auto-upgrade shells to PTY (auto-resize included)
    • Logging interaction with the targets
    • Download files from targets
    • Upload files to targets
    • Upload preset scripts to targets
    • Spawn backup shells
    • Multiple sessions
    • Multiple listeners
    • Can be imported by exploits and get shell on the same terminal
    Source code(tar.gz)
    Source code(zip)
Python scripts to interact with Upper Deck ePack online trading card platform

This script should connect to the Upper Deck ePack API using your browser cookies and download a list of your current collection and save it as a CSV.

Adrian Kent 1 Nov 22, 2021
NeoInterface - Neo4j made easy for Python programmers!

Neointerface - Neo4j made easy for Python programmers! A Python interface to use the Neo4j graph database, and simplify its use. class NeoInterface: C

15 Dec 15, 2022
A 3D Slicer Extension to view data from the flywheel heirarchy

flywheel-connect A 3D Slicer Extension to view, select, and download images from a Flywheel instance to 3D Slicer and storing Slicer outputs back to F

4 Nov 05, 2022
Localization and multifractal properties of the long-range Kitaev chain in the presence of an Aubry-André-Harper modulation

This repository contains the code for the paper Localization and multifractal properties of the long-range Kitaev chain in the presence of an Aubry-André-Harper modulation.

Joana Fraxanet 2 Apr 17, 2022
Consolemenu on python with pynput

ConsoleMenu Consolemenu on python 3 with pynput Powered by pynput and colorama Description Модуль позволяющий сделать меню выбора с помощью стрелок дл

KrouZ_CZ 2 Nov 15, 2021
Calculatrix is a project where I'll create plenty of calculators in a lot of differents languages

Calculatrix What is Calculatrix ? Calculatrix is a project where I'll create plenty of calculators in a lot of differents languages. I know this sound

1 Jun 14, 2022
Experiments with Tox plugin system

The project is an attempt to add to the tox some missing out of the box functionality. Basically it is just an extension for the tool that will be loa

Volodymyr Vitvitskyi 30 Nov 26, 2022
Free Vocabulary Trainer - not only for German, but any language

Bilderraten DOWNLOAD THE EXE FILE HERE! What can you do with it? Vocabulary Trainer for any language Use your own vocabulary list No coding required!

Hans Alemão 4 Jan 02, 2023
Wrapper for the undocumented CodinGame API. Can be used both synchronously and asynchronlously.

codingame API wrapper Pythonic wrapper for the undocumented CodinGame API. Installation Python 3.6 or higher is required. Install codingame with pip:

Takos 19 Jun 20, 2022
Repository, with small useful and functional applications

Repositorio,com pequenos aplicativos uteis e funcionais A ideia e ir deselvolvendo pequenos aplicativos funcionais e adicionar a este repositorio List

GabrielDuke 6 Dec 06, 2021
HashDB Binary Ninja Plugin

HashDB Plugin (v0.1) Author: Vector 35 Inc Plugin for interacting with the OALABS HashDB service. Description: Plugin that can be used to lookup hashe

Jordan 3 Jul 30, 2022
HOWTO: Downgrade from nYNAB to YNAB4

HOWTO: Downgrade from nYNAB to YNAB4 This page explains how to move from nYNAB to YNAB4 while retaining as much information as possible. See Appendix

Tobias Kunze 10 Dec 29, 2022
A script that will warn you, by opening a new browser tab, when there are new content in your favourite websites.

web check A script that will warn you, by opening a new browser tab, when there are new content in your favourite websites. What it does The script wi

Jaime Álvarez 52 Mar 15, 2022
A Python utility belt containing simple tools, a stdlib like feel, and extra batteries. Hashing, Caching, Timing, Progress, and more made easy!

Ubelt is a small library of robust, tested, documented, and simple functions that extend the Python standard library. It has a flat API that all behav

Jon Crall 638 Dec 13, 2022
Extract gene length based on featureCount calculation gene nonredundant exon length method.

Extract gene length based on featureCount calculation gene nonredundant exon length method.

laojunjun 12 Nov 21, 2022
The Ultimate Widevine Content Ripper (KEY Extract + Download + Decrypt) is REBORN

NARROWVINE-REBORN ** UPDATE 21.12.01 ** As expected Google patched its ChromeCDM Whitebox exploit by Satsuoni with a force-update on the ChromeCDM. Th

Vank0n 104 Dec 07, 2022
Check is a integer is even

Is Even Check if interger is even using isevenapi. https://isevenapi.xyz/ Main features: cache memoization api retry handler hide ads Install pip inst

Rosiney Gomes Pereira 45 Dec 19, 2022
Make pack up python files easier.

python-easy-pack make pack up python files easier. 目前只提供了中文环境 如何使用? 将index.py复制到你的项目文件夹,或者把.py文件拷贝到这个文件夹。 打开你的cmd或者powershell 切换到程序所在目录,输入python index

2 Dec 15, 2021
This is a program for Carbon Emission calculator.

Summary This is a program for Carbon Emission calculator. Usage This will calculate the carbon emission by each person on various factors. Contributor

Ankit Rane 2 Feb 18, 2022