Communication Protocol

NesterShell uses an HTTP cookie-based communication protocol to exchange encrypted commands and responses between the client and server, making the traffic appear as normal web traffic.

Tip

Because all communication happens through cookies, you can inject a generated web shell at the start of any existing server page without modifying the visible content of that page. The web shell processes cookie-based commands before the page content is rendered, remaining completely invisible to users viewing the page.

1. Protocol Structure

1.1 Request Structure (Client → Server)

Request Structure Diagram

Field	Size	Description
Initialization Vector	16 bytes	Randomly generated IV for AES-CBC encryption
Transit Password	16 bytes	Encrypted session authentication
Command Payload	16+ bytes	Encrypted command structure
Command Code	2 digits	Operation identifier
Primary Parameter	Variable	Main command data
Secondary Parameter	Variable	Additional command data

1.2 Response Structure (Server → Client)

Response Structure Diagram

Field	Size	Description
Response Payload	16+ bytes	Encrypted response structure
Response Code	4 digits	Status identifier
Primary Data	Variable	Main response data
Secondary Data	Variable	Additional response data

2. Authentication and Key Derivation

When you enter your password, NesterShell creates a Transit Password by hashing it with SHA256 and taking the first 15 bytes. This Transit Password is then encrypted with the Shared Key (AES-256-CBC), adding padding to make it 16 bytes. The server verifies it using bcrypt before executing any commands.

Session Key Derivation

The Session Key is created by padding the 15-byte Transit Password with 17 null bytes to reach 32 bytes for AES-256 encryption.

3. Command and Response Codes

Request Command Codes

Code	Description	Primary Parameter	Secondary Parameter
`00`	Execute shell command	Command string	Current working directory
`01`	Connection test	—	—
`02`	Change working directory	Target directory path	—

Response Status Codes

Success Codes

Code	Description	Primary Data	Secondary Data
`0000`	Operation completed successfully	Command stdout	Command stderr
`0100`	Ping test successful	—	—
`0200`	Working directory changed successfully	New working directory path	—

Error Codes

Code	Description
`0010`	Command string was empty
`0011`	Path parameter was empty
`0012`	Specified path was not reachable
`0013`	Specified path was not executable
`0014`	Process failed to start
`0210`	Path was empty for cd command
`0211`	Path was not reachable for cd command
`0212`	Path was not executable for cd command

Keyboard shortcuts