Wp Header Logo 88

Hoaxshell – An Unconventional Windows Reverse Shell, Currently Undetected By Microsoft Defender And Various Other AV Solutions, Solely Based On Http(S) Traffic

So far, it has been tested on fully updated Windows 11 Enterprise and Windows 10 Pro boxes (see video and screenshots).

When you run hoaxshell, it will generate its own PowerShell payload for you to copy and inject on the victim. By default, the payload is base64 encoded for convenience. If you need the payload raw, execute the “rawpayload” prompt command or start hoaxshell with the -r argument. After the payload has been executed on the victim, you’ll be able to run PowerShell commands against it.

The generated PowerShell payload will be longer in length because of an additional block of code that disables the ssl certificate validation.

In case you close your terminal accidentally, have a power outage or something, you can start hoaxshell in grab session mode, it will attempt to re-establish a session, given that the payload is still running on the victim machine.

Important: Make sure to start hoaxshell with the same settings as the session you are trying to restore (http/https, port, etc).

The shell is going to hang if you execute a command that initiates an interactive session. Example:

So, if you for example would like to run mimikatz throught hoaxshell you would need to invoke the commands:

Long story short, you have to be careful to not run an exe or cmd that starts an interactive session within the hoaxshell powershell context.

I am currently working on some auxiliary-type prompt commands to automate parts of host enumeration.


Leave a Comment

Leave a Reply

Your email address will not be published.

Chinese Threat Actors Seen Planting PlugX Malware To Target Political Figures

Thousands of GitHub Repositories Cloned in Supply Chain Attack

Chinese Hackers Using New Manjusaka Hacking Framework Similar to Cobalt Strike

China Says NSA’s TAO Stole 140 GB Of Data From Various Attacks In The Country