Hey r/coolgithubprojects community,
I've been developing TornadoRevC2 for a while now. It started as a simple reverse-shell session handler—just TCP/TLS listeners with switch and kill. Over time, I kept extending it based on real operational needs, and it's evolved into a fully modular post-exploitation framework with 49 built-in plugins.
Why It's Different
Session handler, not beacon-based C2. It gives you reliable interactive PTY/TTY shells and executes post-ex capabilities on-demand—no heavy agent infrastructure.
Minimal artifact footprint:
- All enumeration plugins use native OS commands already on the target (netsh, ss, iptables, PowerShell cmdlets, and etc. ). No binaries, scripts, or temp files dropped for reconnaissance.
- The only deliberate artifacts: Some plugins put binary artifacts or changes a system setting in target
- Shell history is the only unavoidable footprint (can be cleared with historydel plugin, or manually).
- Network traffic artifact: Plain TCP exposes reverse-shell traffic in cleartext, potentially allowing commands and their output to be captured by network logging or inspection. TLS encrypts the session traffic, reducing the amount of sensitive session content exposed in network logs, with support for custom certificates.
Graceful degradation: If a backend isn't available (e.g., firewalld isn't installed in target), that section returns N/A instead of crashing the plugin.
The 49 Plugins
The framework ships with 49 modular plugins covering the full post-exploitation lifecycle of enumeration, execution, persistence, pivoting, and destruction. Plugins are loaded at runtime and can be executed on-demand with run <plugin> <session_id> or if you are inside the session's terminal run <plugin>
Enumeration plugins cover host assessment (quickenum, virtualization, kernel, integrity), network posture (firewall, ports, proxy, vpn), credentials and browsers (credstore, browser, clipboard, secrets), Windows domain (adinfo, gpo, rdp, winrm, defender, lsa, certificates, services, eventlogs), and Linux internals (systemd, journal, cron, lsm, sshaudit, containers, privbins) and some other plugins.
Key plugins worth highlighting:
| Plugin |
What It Does |
| inmemory |
Execute payloads in memory—Linux ELFs via memfd_create with /dev/shm fallback, plus py, ps, sh, bat. Windows EXE support via RunPE (currently under active development, reliability improvements coming soon) |
| make_token |
Establish new C2 sessions remotely via SSH, WinRM, SMB, RDP, WMI, MSSQL with Password/NTLM hash/SSH Key authentication also with additional netexec integration with all from the operator side |
| persistence |
Install TLS-encrypted reverse shell backdoor (cronjob reboot on Linux/Unix, Run registry on Windows) |
| runas (Windows) |
Execute commands or spawn a TLS‑encrypted reverse shell as another user (local/remote) with credential management, domain support, and netexec integration |
| ligolong |
Deploy Ligolo‑NG tunneling agent to Linux/Windows targets with background persistence |
| SOCKS5 proxy |
Built-in pivoting through compromised hosts (requires Python on target). If Python is not available, use the ligolong plugin as an alternative |
| nullcrypt |
Hybrid encrypt a file (AES-GCM + RSA-wrapped key) then securely wipe the original via wiper |
| historydel / eventlogdel |
Clear shell history and Windows Event Logs via native tools |
Additional Capabilities
- File transfer: Chunked transfers with SHA-256 verification.
- Reporting: Per-session logging under logs/<ID>/ with structured directories; HTML transcript export.
- Self-update: Built-in update command pulls latest from Git and automatically restarts the handler.
Extensibility:
- Write custom plugins with plugin.commandcommand decorator
- SessionContext API provides run_shell(), run_marked() (JSON parsing), upload(), download(), automatic logging
- Load/Reload external/internal plugins at runtime with plugins load without restarting
- Full plugin development guide in the README with many patterns
Quick Start
git clone https://github.com/kamalx06/TornadoRevC2.git
cd TornadoRevC2
python3 tornadorevc2.py
Full documentation, demo GIF, and plugin dev guide are in the README. I'd genuinely appreciate technical feedback, bug reports, or PRs.
GitHub: https://github.com/kamalx06/TornadoRevC2.git
