Skip to main content

Kusanagi - 草薙

TL;DR: kusanagi is a major, bind- and reverse shell payload generator.

PyPI PyPI - Python Version PyPI - Format PyPI - Implementation PyPI - License

At its core, it is just a collection of Yaml files that define various shell commands, code snippets, file specifications and obfuscators. It combines and permutates all of them to generate payloads according to someone's need.

Payloads are highly searchable and filterable in order to generate a code-, file- or command injection with correct binaries for the target architecture and removed bad chars that might get filtered/denied by certain mechanisms which are in between you and the target (e.g.: web application firewall). Additional output encoding can be applied on your generated payloads (See list of encoders).

Disclaimer: It does have a copy-to-clipboard function to eliminate heavy mouse gestures.

:tada: Install

pip install kusanagi

:exclamation: Requires Python >= 3.6

:hourglass: Current state

Build Status Build Status Build Status

Build Status Build Status Build Status Build Status Build Status

kusanagi is currently at most an alpha version and in a very early state of development.

Feel free to use it, but expect drastic changes in ui and available command line arguments.

If you want to support this project, drop me all your payloads and obfuscators you know about.

:star: Features

You can find current features here:

  • Automated Quote escaping
  • Quote swapping
  • Obfuscation
  • Permutation
  • Badchar elimination
  • Output encoder
  • Copy to clipboard
  • Command injection
  • Code injection
  • File injection
  • Payload: Persistence wrapper
  • Payload: reverse shell
  • Payload: bind shell
  • Payload: port forwarding
  • BYOY: Bring your own yaml - and have custom payloads

Usage

General

Kusanagi is separated into different usage section. To start off, you will have to choose between a shell command for command injection (cmd), a code snippet from a programming language for code injection (code) and a generated file for various exploits injected into it (file).

usage: kusa <payload> [options] addr [host]
       kusa <payload> -h
       kusa -v, --version
       kusa -h, --help

Kusanagi is a bind and reverse shell payload generator with obfuscation and badchar support.

positional arguments:
  <payload>
    cmd          Generate a command to be executed on a shell.
    code         Generate source code (e.g.: php).
    file         Inject source code in a file (e.g.: php in jpeg).

misc arguments:
  -v, --version  Show version information and exit
  -h, --help     Show this help message and exit

Injectable commands (cmd)

Options for command injection/execution module.

Click here to expand full usage
usage: kusa cmd [options] addr [port]
       kusa cmd -h, --help

positional arguments:
  addr                  Address to listen or connect to.

  port                  (Optional) Port to listen or connect to
                        Default: 4444


query arguments:
  -e EXE [EXE ...], --exe EXE [EXE ...]
                        Command that will execute the payload
                        (e.g.: perl, python, php, nc, sh, bash, cmd, PowerShell, etc)
                        Default: do not filter by underlying command.

  -s SHELL [SHELL ...], --shell SHELL [SHELL ...]
                        Shell on which the command (specified via -e)
                        will be executed. Some payloads use crazy output
                        redirections or pipes that will only work on certain
                        underlying shells.
                        (e.g.: dash, sh, bash, zsh, cmd, PowerShell)
                        Default: do not filter by underlying shell.

  -b BADCHARS, --badchars BADCHARS
                        Exclude any payloads that contain the specified bad chars.
                        This comes in handy if you encounter a Web Application Firewall
                        that prohibits certain characters.
                        Default: Ignore badchars

  -o {bsd,linux,mac,solaris,windows}, --os {bsd,linux,mac,solaris,windows}
                        Only fetch payloads which work on a specific operating system.
                        Default: fetch for all OS.

  -m bytes, --maxlen bytes
                        Exclude any payloads exceeding the specified max length.


mutate arguments:
  --obf                 Run the fun. This switch will apply obfuscator to all
                        payloads to get a different set of badchars.

  --enc name [name ...]
                        Encode the output with one or more encoders.
                        When encoding multiple times, pay attention to the
                        order of specifying encoders.
                        Note that any filtering (-b, -o, etc) is not done on the
                        encoded payload. Filtering is done before.
                        To view available encoders, use --list-encoders.

helper arguments:
  -q, --quick           Show quick payload results (less detail).

  -c [index], --copy [index]
                        Copy last shown payload to clipboard or specify index
                        of payload to copy to clipboard.
                        (indices are shown in square brackets next to payload)


misc arguments:
  -h, --help            Show this help message and exit

Examples

# List reverse shells connecting to 10.0.0.1 (port 4444 by default)
kusa cmd 10.0.0.1
# List reverse shells connecting to 10.0.0.1:1337
kusa cmd 10.0.0.1 1337
# Copy last reverse shell payload to clipboard
kusa cmd 10.0.0.1 -c
# Copy reverse shell with index 2 to clipboard
kusa cmd 10.0.0.1 -c 2
# URL encode reverse shell
kusa cmd 10.0.0.1 --enc url
# Base64 encode and then url encode reverse shell
kusa cmd 10.0.0.1 --enc base64 url
# Obfuscate payloads
kusa cmd 10.0.0.1 --obf
# Obfuscated and filter away '/' and '$' characters in payload
kusa cmd 10.0.0.1 --obf -b '/$'

Injectable code (code)

Options for code injection/execution module.

Click here to expand full usage
usage: kusa code [options] addr [port]
       kusa code -h, --help

positional arguments:
  addr                  Address to listen or connect to.

  port                  (Optional) Port to listen or connect to
                        Default: 4444


query arguments:
  -l LANG [LANG ...], --lang LANG [LANG ...]
                        The payload language to query.
                        (e.g.: perl, python, php, etc)
                        Default: do not filter language.

  -s SHELL [SHELL ...], --shell SHELL [SHELL ...]
                        Shell on which the command (specified via -e)
                        will be executed. Some payloads use crazy output
                        redirections or pipes that will only work on certain
                        underlying shells.
                        (e.g.: dash, sh, bash, zsh, cmd, PowerShell)
                        Default: do not filter by underlying shell.

  -b BADCHARS, --badchars BADCHARS
                        Exclude any payloads that contain the specified bad chars.
                        This comes in handy if you encounter a Web Application Firewall
                        that prohibits certain characters.
                        Default: Ignore badchars

  -o {bsd,linux,mac,solaris,windows}, --os {bsd,linux,mac,solaris,windows}
                        Only fetch payloads which work on a specific operating system.
                        Default: fetch for all OS.

  -m bytes, --maxlen bytes
                        Exclude any payloads exceeding the specified max length.


mutate arguments:
  --obf                 Run the fun. This switch will apply obfuscator to all
                        payloads to get a different set of badchars.

  --enc name [name ...]
                        Encode the output with one or more encoders.
                        When encoding multiple times, pay attention to the
                        order of specifying encoders.
                        Note that any filtering (-b, -o, etc) is not done on the
                        encoded payload. Filtering is done before.
                        To view available encoders, use --list-encoders.

helper arguments:
  -q, --quick           Show quick payload results (less detail).

  -c [index], --copy [index]
                        Copy last shown payload to clipboard or specify index
                        of payload to copy to clipboard.
                        (indices are shown in square brackets next to payload)


misc arguments:
  -h, --help            Show this help message and exit

Examples

# List reverse shells connecting to 10.0.0.1 (port 4444 by default)
kusa code 10.0.0.1
# List reverse shells connecting to 10.0.0.1:1337
kusa code 10.0.0.1 1337
# Copy last reverse shell payload to clipboard
kusa code 10.0.0.1 -c
# Copy reverse shell with index 2 to clipboard
kusa code 10.0.0.1 -c 2
# Select only PHP code (-l/--language)
kusa code 10.0.0.1 -l php
# URL encode reverse shell
kusa code 10.0.0.1 --enc url
# Base64 encode and then url encode reverse shell
kusa code 10.0.0.1 --enc base64 url
# Obfuscate payloads
kusa code 10.0.0.1 --obf
# Obfuscated and filter away '/' and '$' characters in payload
kusa code 10.0.0.1 --obf -b '/$'

:lock: cytopia sec tools

Below is a list of sec tools and docs I am maintaining.

Name Category Language Description
offsec Documentation Markdown Offsec checklist, tools and examples
header-fuzz Enumeration Bash Fuzz HTTP headers
smtp-user-enum Enumeration Python 2+3 SMTP users enumerator
urlbuster Enumeration Python 2+3 Mutable web directory fuzzer
pwncat Pivoting Python 2+3 Cross-platform netcat on steroids
kusanagi Payload Generator Python 3 Bind- and Reverse shell payload generator
badchars Reverse Engineering Python 2+3 Badchar generator
fuzza Reverse Engineering Python 2+3 TCP fuzzing tool
docker-dvwa Playground PHP DVWA with local priv esc challenges

:octocat: Contributing

See Contributing guidelines to help to improve this project.

:exclamation: Disclaimer

This tool may be used for legal purposes only. Users take full responsibility for any actions performed using this tool. The author accepts no liability for damage caused by this tool. If these terms are not acceptable to you, then do not use this tool.

:page_facing_up: License

MIT License

Copyright (c) 2021 cytopia

Release files for kusanagi 0.0.5

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for kusanagi 0.0.5
File Size Uploaded
kusanagi-0.0.5.tar.gz 25.1 kB Details

Built distribution (wheel)

Table of built distributions (wheels) for kusanagi 0.0.5
File Interpreter ABI Platform
kusanagi-0.0.5-py2.py3-none-any.whl Python 3, Python 2 none any Details

Total release size: 62.9 kB

Release files / kusanagi-0.0.5.tar.gz

Download URL kusanagi-0.0.5.tar.gz
Size 25.1 kB
Tags Source
SHA-256 checksum
How to use checksums
892091da501c471607f7169ad3466b0be7ede8e084b250c502bf900e271563d3
BLAKE2b-256 checksum
How to use checksums
ff81e170483db5640ae535cf735ff625dbfbad20f9fb3f7fd0180ead38279213
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.4.1 importlib_metadata/4.0.0 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.60.0 CPython/3.6.13

Release files / kusanagi-0.0.5-py2.py3-none-any.whl

Download URL kusanagi-0.0.5-py2.py3-none-any.whl
Size 37.7 kB
Tags Python 2 Python 3
SHA-256 checksum
How to use checksums
7a6ad91e5e9383fd31ac94c2a18d8af21ae09cfc44521360b0f184cee0833aae
BLAKE2b-256 checksum
How to use checksums
28a845b548d3e06323ab6cad36f218052b7633e540a3a2f7cb8eee1086aa20d1
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/3.4.1 importlib_metadata/4.0.0 pkginfo/1.7.0 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.60.0 CPython/3.6.13

Release history Release notifications | RSS feed

This release

0.0.5 This release

2 release files

0.0.4

2 release files

0.0.3

2 release files

0.0.2

2 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page