PE-ANT
AntSword
Cross-platform GUI client for managing an authorized web shell left on a compromised host during post-exploitation.
OVERVIEW
AntSword (github.com/AntSwordProject/antSword) is an open-source, cross-platform desktop client — Windows, macOS, and Linux, built on NW.js — for administering a web shell rather than deploying one blind: once a lightweight PHP/ASP/JSP stub has been authorized and placed on a target as part of an agreed post-exploitation phase, AntSword connects to it and presents a file manager, a virtual terminal, a database browser, and a plugin marketplace, all through an encoder/decoder pipeline that obscures the raw request payloads in transit.
It ships with an official plugin ecosystem (AntSword-Loader for client-side add-ons, AntSword-Labs for practice targets) that extends it with bypass encoders, database clients for MySQL/MSSQL/Oracle, and process/file utilities, which is why it remains one of the most widely referenced webshell management clients in both offensive security write-ups and defensive detection research.
USE CASES
Practical use cases
- 01
Managing file system access, uploads, and downloads on an authorized test web shell through a GUI file manager.
- 02
Running a virtual terminal against the compromised host without hand-crafting raw HTTP requests for every command.
- 03
Browsing and querying a reachable back-end database (MySQL, MSSQL, Oracle) exposed through the shell's DB module.
- 04
Practicing webshell administration workflows safely against the official AntSword-Labs training targets before an engagement.
QUICK START
Once a test web shell has been authorized and dropped as part of an agreed post-exploitation phase, to browse files, run commands, and manage the session through a GUI instead of a raw HTTP client.
- Confirm the rules of engagement explicitly authorize placing and using a web shell during this phase, and note the agreed removal deadline.
- Download the AntSword client from the official GitHub releases and launch it on the tester's workstation.
- Add a new connection entry pointing to the already-placed, authorized shell URL and its connection password/encoder.
- Use the file manager, terminal, and database modules as needed, keeping notes for the report.
- Remove the shell and close the connection entry once the authorized window ends.
BEFORE YOU RUN IT
What to check before running it
Placing any web shell — even during an authorized test — must be logged with the client and time-boxed to the agreed window; leaving one active after the engagement ends is a serious finding in itself.
The connection payloads are a known signature for many WAFs and EDR/AV products; expect detections, and document whether the client's obfuscation options were used, for the blue-team debrief.
Treat the shell's access password and any recovered database credentials as sensitive engagement data, and remove the implant and any dropped artifacts before final reporting.