Villain

Villain serves as a command and control (C2) framework designed for handling multiple reverse shells simultaneously. It supports both TCP socket-based and HoaxShell-based connections, allowing operators to manage and enhance these shells with extra capabilities. The framework enables sharing of shells across connected sibling servers, facilitating distributed C2 operations.

Use cases include post-exploitation scenarios where maintaining persistent access to compromised systems is critical. Operators can centralize control of multiple implants, apply enhancements like file smuggling or encryption, and scale operations across multiple servers. This makes it suitable for red team engagements requiring robust shell management.

The tool integrates seamlessly into Kali Linux environments, relying on Python libraries for networking, cryptography, and clipboard operations to support its features.

Villain operates as a server-based C2 framework listening on configurable TCP ports for reverse shell connections. It handles TCP socket shells on a specified reverse TCP port (default 4443) and HoaxShell connections via HTTP/HTTPS on hoax ports (default 8080 or 443). Additional listeners for file smuggling are supported. Connections are enhanced with features like encryption using certificates, quiet mode operation, and sharing across sibling servers via team server ports (default 6501). Internals leverage Python dependencies for network interfaces, cryptography, clipboard access, and HTTP requests.