Suo5 Documentation

Suo5 provides remote scripts for various programming environments. You can access specific implementation details and guides for the following runtimes:

• Java
• .NET
• PHP
• Node.js

You can convert Suo5 into a memory shell by following the pattern used in the SharpMemshell project. The file Suo5VirtualPath.cs in the current directory serves as a reference implementation.

Critical Step: Before compiling, you must modify line 242 of Suo5VirtualPath.cs. Change if (false) to your own trigger logic (e.g., checking for a specific User-Agent). If you do not change this, the processing logic will never be triggered.

To run the Suo5 Node.js standalone version, ensure you have Node.js 18 or higher installed. The suo5.js script has no third-party npm dependencies and can be executed directly. By default, it listens on port 8080 and supports full-duplex, half-duplex, and short-connection modes with automatic detection.

node suo5.js

To use the .Net version of Suo5, ensure the target environment meets the following requirements:

• Dependency: .Net Framework >= 2.0
• Middleware Support: IIS (6+) supports Automatic Detection, Half-duplex, and Short-connection modes. It does not support Full-duplex mode.

Once the Node.js standalone server is running (defaulting to port 8080), connect your Suo5 client using the -t flag pointing to the target URL.

./suo5 -t http://target:8080/

Follow these steps to compile the Suo5VirtualPath.cs implementation, convert it to Base64, and deploy it via an installer file.

1. Compile to DLL: Use the .NET C# compiler (csc.exe).
2. Convert to Base64: Use PowerShell to generate a Base64 string of the DLL.
3. Prepare Installer: Replace the %%base64%% placeholder in your install.aspx template with the generated Base64 string.
4. Deploy: Upload the modified install.aspx to the target server and access it via a browser to install the memory shell. Once installed, any subsequent access to .aspx files in that directory will trigger the memory shell logic.

For targets vulnerable to CVE-2025-55182 or CVE-2025-66478, use the next_payload.http request. You must modify the Host header and the request path within the payload before sending it. Upon successful execution, a /test route will be mounted onto the target's existing Node.js HTTP Server. Connect the client to this new route.

./suo5 -t http://target:3000/test

Suo5 supports various Java middleware implementations that follow the Java Servlet specification. For generating memory shells and performing injections, it is recommended to use the MemshellParty project.

Environment Requirements:

• Java 6 or higher.

Supported Middleware Compatibility:

The following middleware versions have been verified via CI testing to support automatic detection, full-duplex, half-duplex, and short-connection modes:

Use the --auth parameter to set authentication for the local SOCKS5 proxy. The format must be username:password. This is used to prevent unauthorized local access to the proxy and is independent of the server-side configuration.

To use the authenticated proxy with curl, include the credentials in the proxy URL: socks5h://username:password@127.0.0.1:1111.

When using Suo5 with PHP services running via FastCGI (e.g., Nginx + PHP-FPM or Apache + mod_fcgid), each Suo5 connection occupies one Worker process and holds it until the connection is closed.

Warning: If the number of Suo5 connections exceeds the available PHP-FPM workers, the target server will become unresponsive and block all other requests (including normal web traffic) until connections time out.

Before deployment, ensure the target's worker count is sufficient for your expected Suo5 connection load.