From 1298be49c723ba2997b012eb4e8b30dd8e36541e Mon Sep 17 00:00:00 2001
From: kmanc <kmancxc@gmail.com>
Date: Wed, 29 Dec 2021 01:33:55 -0800
Subject: [PATCH] Documentation (#7)

* updated tcp rev shell documentation

* missed a line

* missed another line

* updating documentation for process migration
---
 process_migration/README.md | 40 +++++++++++++++++++++++++--------
 tcp_reverse_shell/README.md | 45 +++++++++++++++++++++++++++++--------
 2 files changed, 67 insertions(+), 18 deletions(-)

diff --git a/process_migration/README.md b/process_migration/README.md
index cc8b36e..3a0ed15 100644
--- a/process_migration/README.md
+++ b/process_migration/README.md
@@ -1,13 +1,35 @@
 # RCO: Process Migration
 
-Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/process_migration/src/config.rs) and change the shellcode to your desired payload before compiling
+## What it is
 
-#### Build for Unix target
-```commandline
-cargo build -p process_migration --release
-```
+RCO's process migration is a technique used to hide malicious code running on a victim machine. It has the added benefit
+of making it less likely the the malicious code is accidentally closed by a user on a victim machine by moving the payload
+to a process that is unlikely to be terminated.
 
-#### Build for Windows target
-```commandline
-cargo build --target x86_64-pc-windows-gnu -p process_migration --release
-```
\ No newline at end of file
+## How it works
+
+RCO's Windows process migration works by obtaining a handle to the target process and writing the shellcode to it. Then it
+spawns a remote thread within the process whose starting point is the newly written shellcode. At the time of this writing,
+RCO's Unix process migration is not yet written.
+
+## Using it
+
+1. Generate shellcode for the desired end result (for example, use [msfvenom](http://127.0.0.1) to generate a reverse TCP
+shell shellcode for the target operating system)
+
+2. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/process_migration/src/config.rs) 
+and change the shellcode to the shellcode generated in step 1
+
+3. Compile the executable
+
+    #### Build for Unix target
+    ```commandline
+    cargo build -p process_migration --release
+    ```
+
+    #### Build for Windows target
+    ```commandline
+    cargo build --target x86_64-pc-windows-gnu -p process_migration --release
+    ```
+   
+4. Execute the payload on the victim machine
diff --git a/tcp_reverse_shell/README.md b/tcp_reverse_shell/README.md
index c8c71a4..2c4a3e0 100644
--- a/tcp_reverse_shell/README.md
+++ b/tcp_reverse_shell/README.md
@@ -1,13 +1,40 @@
 # RCO: TCP Reverse Shell
 
-Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/tcp_reverse_shell/src/config.rs) and change the IP address and port to match your listener before compiling
+## What it is
 
-#### Build for Unix target
-```commandline
-cargo build -p tcp_reverse_shell --release
-```
+RCO's TCP reverse shell is a no-frills [reverse shell](http://127.0.0.1). This means it allows you to run Terminal (Unix)
+or Command Prompt (Windows) commands _on the victim machine_ from the attacking machine. Getting a remote shell on a
+victim machine usually allows much more control over the victim than other attacks. 
 
-#### Build for Windows target
-```commandline
-cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell --release
-```
\ No newline at end of file
+## How it works
+
+Both RCO's Unix and Windows TCP reverse shells work by establishing a [TCP session](http://127.0.0.1) from the victim machine
+to the attacking machine. Then a Terminal (Unix) or Command Prompt (Windows) process is spun up with its [standard input](http://127.0.0.1),
+[standard output](http://127.0.0.1), and [standard error](http://127.0.0.1) all assigned to the TCP session. This means that
+input commands and output results are read from and written to (respectively) a TCP stream.
+
+## Using it
+
+1. Start a listener on the attacking machine
+    ```commandline
+    nc -nlvp 4444
+    ```
+
+2. Open [the config file](https://github.com/kmanc/remote_code_oxidation/blob/master/tcp_reverse_shell/src/config.rs) 
+and change the IP address and port to match your attacking machine and listener, respectively
+
+3. Compile the executable
+
+    #### For Unix targets
+    ```commandline
+    cargo build -p tcp_reverse_shell --release
+    ```
+
+    #### For Windows targets
+    ```commandline
+    cargo build --target x86_64-pc-windows-gnu -p tcp_reverse_shell --release
+    ```
+
+4. Execute the payload on the victim machine
+
+5. Return to the listener and enter desired commands for the victim machine to run