{"id":17244634,"url":"https://github.com/kost/httpexec","last_synced_at":"2025-04-14T04:07:39.217Z","repository":{"id":43624812,"uuid":"71660071","full_name":"kost/httpexec","owner":"kost","description":"RESTful interface to your operating system shell","archived":false,"fork":false,"pushed_at":"2017-11-08T15:35:48.000Z","size":38,"stargazers_count":19,"open_issues_count":1,"forks_count":9,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-27T18:01:37.318Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kost.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-10-22T19:11:14.000Z","updated_at":"2023-09-19T07:08:25.000Z","dependencies_parsed_at":"2022-07-12T18:19:21.503Z","dependency_job_id":null,"html_url":"https://github.com/kost/httpexec","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kost%2Fhttpexec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kost%2Fhttpexec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kost%2Fhttpexec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kost%2Fhttpexec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kost","download_url":"https://codeload.github.com/kost/httpexec/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248819403,"owners_count":21166477,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-15T06:26:26.068Z","updated_at":"2025-04-14T04:07:39.187Z","avatar_url":"https://github.com/kost.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/kost/httpexec.png)](https://travis-ci.org/kost/httpexec)\n[![Circle Status](https://circleci.com/gh/kost/httpexec.svg?style=shield\u0026circle-token=:circle-token)](https://circleci.com/gh/kost/httpexec)\n\n# httpexec\nRESTful interface to your operating system shell.\nSwiss knife for your OS shells over the Web.\n\n(Yes, it's dangerous if you don't know what you're doing.)\n\nFeatures\n========\n\n- Single executable (thanks to Go!)\n- Linux/Windows/Mac/BSD support\n- Standalone HTTP Server or CGI mode\n- (optional) JSON support (in requests and responses!)\n\nModes of operation\n==================\n\n- Standalone HTTP(S) server (just run the binary)\n- CGI mode (just put it somewhere where your CGI-BIN is served)\n- Reverse client mode (aka reverse shell - in development)\n\n# Examples\n\nHere is quick example, just to get idea what you can do with it.\n\n## Quick Examples\n\nStart server:\n```\n$ ./httpexec -listen 127.0.0.1:8080 -verbose 5\n2016/10/22 21:20:18 Starting to listen at 127.0.0.1:8080 with URI / with auth\n```\n\nRun whoami command on server:\n```\n$ curl http://127.0.0.1:8080/ -d 'whoami'\nuser\n```\n\n# Usage\n\nhttpexec can be useful to different types of people. Just few ideas how it can\nbe useful(and dangerous) for you.\n\n## Sysadmin/Devops\n\nYou need easy way to send commands to your virtualization guests.\nYou need to run many commands on multiple machines behind many firewalls.\nYou can use it as rudimentary configuration management tool as well.\n\n## Hacker/Pentester\n\nYou can use it to keep access to machine.\nYou need to run many commands on multiple machines you owned behind many firewalls.\n\n## Note\n\nhttpexec can be quite useful, but it also can be quite dangerous if you don't know what you're doing.\nYou should run httpexec inside safe network/environment. By default it listens on\nall interfaces as user who executed it.\n\nIn short, it is quite dangerous to run on the internet exposed server as any user (especially root). You have been warned!\n\n# Download\n\nYou can find binary and source releases on Github under \"Releases\". Here's the [link to the latest release](https://github.com/kost/httpexec/releases/latest)\n\n# HTTP method mapping\n\n- HEAD request = launch command specified as query (everything behind ?) and don't care about output (blind)\n- GET request = launch command specified as query (everything behind ?) and display output\n- POST request = launch command specified as POST data and display output\n- POST request with query = launch command specified as query (everything behind ?), treat POST data as stdin and display output\n\n# Large set of examples\n\nHere is large set of examples\n\n## Server Examples\n\n### Start Server (Linux/Mac)\n\n    $ ./httpexec -verbose 5\n\n### Start Server (Windows)\n\n    httpexec.exe -verbose 5\n\n### Start Server on 127.0.0.1 with SSL cert and key\n\n    $ ./httpexec -listen 127.0.0.1 -tls -cert server.cert -key server.key -verbose 5\n\n# Client Examples\n\n### Simple Example: run whoami\n\n    $ curl 'http://127.0.0.1:8080/' -d 'whoami'\n    user\n\n### Simple Example: run id\n\n    $ curl 'http://127.0.0.1:8080/' -d 'id'\n    uid=1000(user) gid=1000(user) groups=1000(user)\n\n### Simple Example - GET request: run id\n\n    $ curl 'http://127.0.0.1:8080/?id'\n    uid=1000(user) gid=1000(user) groups=1000(user)\n\n### Simple Example - GET request: run ifconfig -a\n\n    $ curl 'http://127.0.0.1:8080/?ifconfig+-a'\n    [ifconfig output]\n\n### Simple Example - POST request: run ifconfig -a\n\n    $ curl 'http://127.0.0.1:8080/' -d 'ifconfig -a'\n    [ifconfig output]\n\n### Simple Example - POST request: run tr [a-z] [A-Z] on POST body as stdin\n\n    $ curl 'http://127.0.0.1:8080/?tr+a-z+A-Z' -d 'data'\n    DATA\n\n### Simple Example - POST JSON request: run tr [a-z] [A-Z] on Stdin as JSON field\n\n    $ curl http://127.0.0.1:8080/ -d '{\"cmd\":\"tr [a-z] [A-Z]\",\"Stdin\":\"data\"}' -H 'Content-Type: application/json'\n    {\"Cmd\":\"tr [a-z] [A-Z]\",\"Stdout\":\"DATA\",\"Stderr\":\"\",\"Err\":\"\"}\n\n### Simple Example - POST JSON request: run tr [a-z] [A-Z] on Stdin as JSON field and do not return JSON:\n    $ curl \"http://127.0.0.1:8080/test\" -d '{\"cmd\":\"tr a-z A-Z\",\"NoJSON\":true,\"Stdin\":\"data\"}' -H \"Content-Type: application/json\"\n    DATA\n\n# Security options\n\nThese are security options you have:\n\n- custom URI/URL (security through obscurity, attacker have to guess URI) - low security\n- basic authentication (username/password authentication) - low security if http (not https)\n- SSL/TLS tunneling (attacker cannot MiTM) - moderate security\n- SSL/TLS client/server verification (depends on security of the keys) - moderate security\n\nYou can combine options above for higher security. It is encouraged to combine SSL/TLS with different options above. \nFor highest security - combine all with SSL/TLS (custom URI, basic authentication and client certs).\n\n## Example with SSL client certs\n\nYou need to generate CA/server/client certificates and specify verification in command line:\n```\ntools/gencerts.sh\n./httpexec -tls -verify ca.pem\n```\n\nYou can then issue curl request as following:\n```\ncurl --cert client.crt --key client.key --cacert ca.pem https://127.0.0.1:8080/ -d 'whoami'\n\n```\n\n\nOptions explained\n=================\n```\n$ ./httpexec -h\nUsage of ./httpexec:\n  -auth string\n    \tbasic auth to require - in form user:pass\n  -cert string\n    \tSSL/TLS certificate file (default \"server.crt\")\n  -cgi\n    \tCGI mode\n  -key string\n    \tSSL/TLS certificate key file (default \"server.key\")\n  -listen string\n    \tlisten address and port (default \":8080\")\n  -realm string\n    \tBasic authentication realm (default \"httpexec\")\n  -silentout\n    \tSilent Output (do not display errors)\n  -ssl\n    \tuse TLS/SSL\n  -tls\n    \tuse TLS/SSL\n  -uri string\n    \tURI to serve (default \"/\")\n  -verbose int\n    \tverbose level\n  -verify string\n    \tClient cert verification using SSL/TLS (CA) certificate file\n```\n\n\nBuilding\n========\n\n### Linux/Mac/POSIX builds\n\nJust type:\n\n    go build httpexec.go\n\nStatic compiling:\n\n    CGO_ENABLED=0 go build -ldflags \"-extldflags -static\"\n\n### Windows builds:\n\nJust type:\n\n    go build httpexec.go\n\n## Design goals\n\n- prefer builtin go packages over 3rd party packages\n- small as possible\n- self-contained static executable\n\n### ToDo\n- [ ] Implement http client\n- [ ] Implement logging of failed basic auth\n- [ ] Switch to CGI mode automatically if REQUEST_METHOD env is found\n\n### Done\n- [X] Implement TLS client auth\n\nCredits\n=======\n\nVlatko Kosturjak\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkost%2Fhttpexec","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkost%2Fhttpexec","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkost%2Fhttpexec/lists"}