Hoaxshell is a command and control system for Windows remote command execution. It provides a framework for generating and managing reverse shell payloads that utilize an HTTP beaconing protocol, where victim clients periodically poll a handler to receive and execute instructions.
The project distinguishes itself through its ability to bypass PowerShell Constrained Language Mode using specialized payload generation. It supports encrypted command and control via TLS certificate injection and provides mechanisms for remote session recovery, allowing a handler to reestablish control over active payloads after a disconnection or system crash.
The system covers a broad range of capabilities including the generation of both PowerShell and cURL-based payloads, the use of custom HTTP headers to obfuscate traffic, and the integration of public tunnel routing to bypass NAT and firewall restrictions.
The tool is implemented in Python.