t3l3machus/Villain
Villain
Villain is a command and control framework and distributed orchestrator designed for managing reverse TCP and HoaxShell connections. It serves as a reverse shell manager and payload generation tool, allowing for the coordination of remote access across multiple target systems.
The project distinguishes itself through a distributed architecture that synchronizes active remote sessions and broadcasts messages across connected server instances for collaborative operations. It includes a fileless execution engine that runs scripts directly in remote memory over HTTP to avoid writing files to the target disk.
The framework covers payload generation for various operating systems using customizable templates and encoding. It provides session management capabilities including interactive shell upgrades to pseudo-terminals, session persistence, and stability monitoring to prevent remote shell crashes. Data transfer is handled via an automated HTTP smuggling service for uploading files to active sessions.
Features
- Concurrent Remote Session Managers - Manages multiple simultaneous network connections to remote targets through a centralized interface for parallel command execution.
- TCP Session Management - Maintains active network connections to remote targets through a centralized server interface for command execution.
- Distributed Orchestrators - Synchronizes active remote sessions and broadcasts messages across multiple connected server instances.
- Fileless Execution - Runs scripts directly in remote memory by delivering payloads over HTTP to avoid writing files to disk.
- Exploitation and Post-Exploitation - Maintains and upgrades interactive shells on remote targets while preventing session hangs and crashes.
- Collaborative Operational Data Sharing - Shares active shell sessions and broadcasts messages across multiple distributed server instances for coordinated attacks.
- Session Synchronization - Shares active shell sessions across multiple server instances to allow collaborative control of a single target.
- Pseudo-Terminal Commands - Wraps raw TCP streams in a terminal emulation layer to provide interactive command-line experiences on remote targets.
- Command and Control Frameworks - Provides a platform for managing multiple reverse TCP and HoaxShell connections to coordinate remote access across target systems.
- OS-Specific Payload Templates - Creates OS-specific shell commands by injecting user variables into predefined encoding and delivery templates.
- Shell Management - Interacts with remote terminal sessions and upgrades basic shells into fully interactive pseudo-terminals.
- Reverse Shell Payloads - Creates OS-specific reverse shell commands and delivers files via HTTP to bypass security detections.
- Security Payload Generators - Creates OS-specific reverse shell commands using customizable templates and encoding to bypass security software.
- Interactive Remote Shells - Provides an interactive pseudo-shell for real-time command execution on remote target systems.
- HTTP File Transfer Utilities - Hosts local files via a temporary internal web service for retrieval by the remote target agent.
- Inter-Component Messaging - Uses a dedicated prefix system to relay text messages across a peer network of connected server instances.
- Broadcast Messaging - Sends text messages to all connected sibling servers using a dedicated broadcast prefix for coordination.
- Interactive Integrations - Invokes pseudo-terminal processes against PowerShell sessions to provide a fully interactive command-line experience.
- Network Session Persisters - Maintains stable remote shell connections that automatically re-establish sessions after the management interface restarts.
- Stability Monitoring - Inspects outgoing commands for problematic characters or patterns that could cause a remote shell to freeze or crash.
- C2 Frameworks - C2 framework for managing multiple reverse shell sessions.
