SharPyShell is a tiny and obfuscated ASP.NET web shell that executes commands received by an encrypted channel compiling them in memory at runtime. SharPyShell supports only C# web applications that run on .NET Framework >= 2.0. SharPyShell is a post-exploitation framework written in Python. The main aim of this framework is to provide the penetration tester with a series of tools to ease the post-exploitation phase once exploitation has been successful against an IIS webserver. This tool is not intended as a replacement for the frameworks for C2 Server (i.e. Meterpreter, Empire, etc..) but this should be used when you land on a fully restricted server where inbound and outbound connections are very limited. In this framework, you will have all the tools needed to privesc, net discovery, and lateral movement as you are typing behind the cmd of the target server.
Features
- SharPyShell supports only C# web applications that runs on .NET Framework >= 2.0
- VB is not supported atm
- Requires Python version >= 2.7
- Generate obfuscated webshell (generate)
- Simulate a windows terminal as an interaction for the webshell (interact)
- This framework aim to be stealthy as much as possible
Project Samples
