---
id: 6314
title: "In Plain Sight: Uncovering SuperShell & Cobalt Strike from an Open Directory"
source_domain: hunt.io
source_url: "https://hunt.io/blog/uncovering-supershell-and-cobalt-strike-from-an-open-directory"
published_at: "2024-04-16T00:00:00Z"
tags: ["linux", "c2", "cobalt-strike", "open-directories", "supershell", "goreverse"]
phying_url: "https://phying.com/item/6314"
lang: en
---

# In Plain Sight: Uncovering SuperShell & Cobalt Strike from an Open Directory

## Summary

While hunting IOX copies, Hunt found an open directory holding two SuperShell/GOREVERSE payloads and a Linux ELF Cobalt Strike beacon, and shows how /supershell/login panels can be tracked.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2024-04-16T00:00:00Z
- **Original:** https://hunt.io/blog/uncovering-supershell-and-cobalt-strike-from-an-open-directory
- **Phying News:** https://phying.com/item/6314