{"id":13815368,"url":"https://github.com/panagiks/RSPET","last_synced_at":"2025-05-15T07:32:57.470Z","repository":{"id":49502103,"uuid":"53592224","full_name":"panagiks/RSPET","owner":"panagiks","description":"RSPET (Reverse Shell and Post Exploitation Tool) is a Python based reverse shell equipped with functionalities that assist in a post exploitation scenario.","archived":false,"fork":false,"pushed_at":"2017-10-31T21:16:13.000Z","size":467,"stargazers_count":260,"open_issues_count":11,"forks_count":85,"subscribers_count":33,"default_branch":"master","last_synced_at":"2024-11-14T02:02:56.903Z","etag":null,"topics":["backdoor","hacking","pentesting","plug-ins","post-exploitation","reverse-shell","security","security-audit","udp-flood","udp-spoof"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/panagiks.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-03-10T14:47:13.000Z","updated_at":"2024-08-12T19:21:50.000Z","dependencies_parsed_at":"2022-09-05T17:22:14.119Z","dependency_job_id":null,"html_url":"https://github.com/panagiks/RSPET","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panagiks%2FRSPET","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panagiks%2FRSPET/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panagiks%2FRSPET/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/panagiks%2FRSPET/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/panagiks","download_url":"https://codeload.github.com/panagiks/RSPET/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225335326,"owners_count":17458259,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["backdoor","hacking","pentesting","plug-ins","post-exploitation","reverse-shell","security","security-audit","udp-flood","udp-spoof"],"created_at":"2024-08-04T04:03:23.919Z","updated_at":"2024-11-19T10:31:50.862Z","avatar_url":"https://github.com/panagiks.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# RSPET\n\n![MIT Licence](https://img.shields.io/badge/Licence-MIT_Licence-red.svg?style=plastic)\n[![Python 2.7](https://img.shields.io/badge/Python-2.7-yellow.svg?style=plastic)](https://www.python.org/)\n![v0.3.1](https://img.shields.io/badge/Release-v0.3.1-orange.svg?style=plastic)\n![Maintained](https://img.shields.io/badge/Maintained-Yes-green.svg?style=plastic)\n[![Twitter](https://img.shields.io/badge/Twitter-@TheRSPET-blue.svg?style=plastic)](https://twitter.com/theRSPET)\n\n\u003e RSPET (Reverse Shell and Post Exploitation Tool) is a Python based reverse shell equipped with functionalities that assist in a post exploitation scenario.\n\nDISCLAIMER: This software is provided for educational and PenTesting purposes and as a proof of concept. The developer(s) do not endorse, incite or in any other way support unauthorised computer access and networks disruption.\n\nNOTE: `min` folder has been removed. The added overhead of maintaining two versions lead to `min` not receiving bug-fixes and important updates. If there is interest, both in using and maintaining, a more bare-bone and simplistic version, a new branch will be created to host it.\n\nCurrent Version: `v0.3.1`\n\nFollow: [@TheRSPET](https://twitter.com/TheRSPET) on Twitter for updates.\n\nDocumentation : [rspet.readthedocs.io](http://rspet.readthedocs.io)\n\n## Features\n\n* Remote Command Execution\n* ~~Trafic masking (XORed instead of cleartext); for better results use port 443~~[1]\n* TLS Encryption of the Server-Client communication\n* Built-in File/Binary transfer (both ways) over the ~~masked~~ Encrypted traffic\n* Built-in UDP Flooding tool\n* Built-in UDP Spoofing tool[2]\n* Multiple/All Hosts management; order File/Binary transfer and UDP Flood from Multiple/All connected Hosts\n* Modular Code Design to allow easy customization\n* Client script is tested and is compatible with PyInstaller (can be made into .exe)[3]\n* Full server side Plug-in support[4]\n* Plug-in management, including the ability to Install(Download) and Dynamically Load Plug-ins.\n* RESTful API for the Server Module\n\n*[1]The idea for XORing as well as the skeleton for the client came from [primalsecurity.net](http://www.primalsecurity.net) so if you like this pack of scripts you'll probably love what they do\n\n*[2]UDP Spoofing uses RAW_SOCKETS so in order to utilize it, the client has to run on an OS that supports RAW_SOCKETS (most Unix-Based) and with root privileges. Finally, most of the ISPs have implementations in place that will either drop or re-structure spoofed packets\n\n*[3]Again check [primalsecurity.net's](http://www.primalsecurity.net) perfect blogpost about producing an .exe\n\n*[4]Detailed documentation on creating Plug-ins available in [Online Documentation](http://rspet.readthedocs.io/en/latest/dev/)!\n\n## Deployment:\n\n* `rspet_server.py` is situated at the attacker's machine and running to accept connections\n* `rspet_client.py` is situated in the infected machine(s) and will initiate the connection and wait for input.\n\n## Installation\n\nExecuting `./setup.py` while on the project's root folder will generate the required certificates and install all needed components through pip.    \n\nOf course you can manually install the pip packages required by executing `pip2 install Flask flask-cors`.\nAlso you can generate your own key-cert set (just name them `server.key` \u0026 `server.crt` and place them inside the Server folder).\n\n## Execution:\n\n* Server:\n```sh\npython rspet_server.py [-c #clients, --ip ipToBind, -p portToBind]\n```\nmax_connections defaults to 5 if left blank\n\n* RESTful API:\n    ```sh\n    python rspet_server_api.py [-c #clients, --ip ipToBind, -p portToBind]\n    ```\n\n* Client:\n```sh\npython rspet_client.py \u003cserver_ip\u003e [server_port]\n```\n\nMany changes can be made to fit individual needs.\n\nAs always if you have any suggestion, bug report or complain feel free to contact me.\n\n## ASCIICAST\n\n[![asciicast](https://asciinema.org/a/b94jozlbub4a3gir7oq6owlno.png)](https://asciinema.org/a/b94jozlbub4a3gir7oq6owlno?autoplay=1)\n\n## Distros\n\u003e A list of Distros that contain RSPET\n\n* [BlackArch Linux](http://blackarch.org/tools.html) (as of version 2016.04.28)\n* [ArchStrike](https://archstrike.org/packages/search/rspet)\n\n## As Featured in\n\n* [seclist.us](http://seclist.us/rspet-reverse-shell-and-post-exploitation-tool.html)\n* [sillycon.org](http://www.sillycon.org/stories/article/github-panagiksrspet-rspet-reverse-shell-and-post-exploitation-tool-is-a-python-based-reverse-shell-equipped-with-functionalities-that-assist-in-a-post-exploitation-scenario)\n* [digitalmunition.me](https://www.digitalmunition.me/2016/04/rspet-reverse-shell-post-exploitation-tool/)\n* [n0where.net](https://n0where.net/reverse-shell-post-exploitation-tool/)\n* [kitploit.com](http://www.kitploit.com/2016/05/rspet-python-reverse-shell-and-post.html)\n* [Hakin9 IT Security Magazine](https://www.facebook.com/hakin9mag/posts/1376368245710855)\n\n## Todo\n\n- [x] ~~Fix logic bug where if a direct command to Host OS has no output Server displays command not recognized~~\n- [ ] Fix logic bug where if a direct command's to Host OS execution is perpetual the Server deadlocks\n  - [ ] Investigate weather the issue resides in the Server logic or the linearity of the CLI.\n- [x] ~~Add client version and type (min or full) as a property when client connects and at `List_Hosts`~~\n- [x] Add TLS encryption in order to:\n  - [x] Replace XORing (and subsequently obfuscation with encryption)\n  - [ ] Verify the \"authenticity\" of clients\n    - [ ] A mechanism to issue and verify client certificates\n    - [ ] A mechanism to recognize compromised client certs\n- [ ] Add client update mechanism (initial thought was the use of execv but it acts up)\n- [x] Add a Plug-in system to client (a more compact one)\n - [ ] Add remote installation of Plug-ins to client\n - [ ] Add installed Plug-ins report from client to server\n- [ ] Add UDP Reflection functionality\n- [ ] Provide more settings via config file\n- [ ] Re-introduce multythreading when handling multiple hosts.\n- [ ] Make commands available with 'Tab' automatically generated based on loaded Plug-ins.\n- [x] ~~Fix logical bug when deleting a client. (Client still shows up on List_Hosts)~~\n- [x] ~~Create comprehensive Plug-in creation guide.~~\n- [ ] Add support for command overridding in server plugins\n- [ ] Add dependency support for server plugins\n\n## Styleguide\n\nThis project is following [Google's Python Styleguide](https://google.github.io/styleguide/pyguide.html) with a minor variation on the use of whitespaces to align \":\" tokens.\n\n## Contribution Opportunities\n\nThis project is open for contributors. If you have implemented a new feature, or maybe an improvement to the current code feel free to open a pull request. If you want to suggest a new feature open an issue. Additionally Testers are needed to run a few standard scenarios (and a few of their own maybe) to decrease the chance a bug slips into a new version. Should there be any interest about testing a `beta` branch will be created (where code to be tested will be uploaded) along with a list of scenarios. For a full guide on contribution opportunities and guides check out [the \"Contributing\" chapter on RSPET's Online Documentation](http://rspet.readthedocs.io/en/latest/contribute/)\n\n## Author - Project Owner/Manager\n\n[panagiks](https://twitter.com/panagiks)\n\n## Co-Author\n\n[dzervas](https://dzervas.gr) -- Code (Server OO-redesign, Server Plug-in system implementation, bug reports, bug fixes)\n\n## Contributors\n\n* [b3mb4m](https://github.com/b3mb4m) -- Code (tab.py and bug fixes)\n* [junzy](https://github.com/junzy) -- Docstings (udp_spoof \u0026 udp_spoof_send)\n* [gxskar](https://github.com/gxskar) -- Documentation (ASCIICAST of RSPET's basic execution)\n* [n1zzo](https://github.com/n1zzo) -- Bug Report \u0026 Fix (PR [#31](https://github.com/panagiks/RSPET/pull/31))\n\n## License\n\nMIT\n\n## Free Cake\n\n                                       i.\n                                       .7.\n                                      .. :v\n                                     c:  .x\n                                      i.::\n                                        :\n                                       ..i..\n                                      #MMMMM\n                                      QM  AM\n                                      9M  zM\n                                      6M  AM\n                                      2M  2MX#MM@1.\n                                      0M  tMMMMMMMMMM;\n                                 .X#MMMM  ;MMMMMMMMMMMMv\n                             cEMMMMMMMMMU7@MMMMMMMMMMMMM@\n                       .n@MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM\n                      MMMMMMMM@@#$BWWB#@@#$WWWQQQWWWWB#@MM.\n                      MM                                ;M.\n                      $M                                EM\n                      WMO$@@@@@@@@@@@@@@@@@@@@@@@@@@@@#OMM\n                      #M                                cM\n                      QM                                tM\n                      MM                                CMO\n                   .MMMM                                oMMMt\n                  1MO 6MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM iMM\n                 .M1  BM                                VM  ,Mt\n                 1M   @M .............................. WM   M6\n                  MM  .A8OQWWWWWWWWWWWWWWWWWWWWWWWWWWW0Az2  #M\n                   MM                                      MM.\n                    @MMY                                vMME\n                      UMMMbi                        i8MMMt\n                         C@MMMMMbt;;i.......i;XQMMMMMMt\n                              ;ZMMMMMMMMMMMMMMM@A;.\n                              \n                    The Cake is a Lie. But it has been a Year :)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpanagiks%2FRSPET","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpanagiks%2FRSPET","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpanagiks%2FRSPET/lists"}