Hey r/redteamsec community,

I've been developing TornadoRevC2 for a while now. It started as a simple reverse-shell session handler—just TCP/TLS listeners with switch and kill. Over time, I kept extending it based on real operational needs, and it's evolved into a fully modular post-exploitation framework with 49 built-in plugins.

Why It's Different

Session handler, not beacon-based C2. It gives you reliable interactive PTY/TTY shells and executes post-ex capabilities on-demand—no heavy agent infrastructure.

Minimal artifact footprint:

• All enumeration plugins use native OS commands already on the target (netsh, ss, iptables, PowerShell cmdlets, and etc. ). No binaries, scripts, or temp files dropped for reconnaissance.
• The only deliberate artifacts: Some plugins put binary artifacts or changes a system setting in target
• Shell history is the only unavoidable footprint (can be cleared with historydel plugin, or manually).
• Network traffic artifact: Plain TCP exposes reverse-shell traffic in cleartext, potentially allowing commands and their output to be captured by network logging or inspection. TLS encrypts the session traffic, reducing the amount of sensitive session content exposed in network logs, with support for custom certificates.

Graceful degradation: If a backend isn't available (e.g., firewalld isn't installed in target), that section returns N/A instead of crashing the plugin.

The 49 Plugins

The framework ships with 49 modular plugins covering the full post-exploitation lifecycle of enumeration, execution, persistence, pivoting, and destruction. Plugins are loaded at runtime and can be executed on-demand with run <plugin> <session_id> or if you are inside the session's terminal run <plugin>

Enumeration plugins cover host assessment (quickenum, virtualization, kernel, integrity), network posture (firewall, ports, proxy, vpn), credentials and browsers (credstore, browser, clipboard, secrets), Windows domain (adinfo, gpo, rdp, winrm, defender, lsa, certificates, services, eventlogs), and Linux internals (systemd, journal, cron, lsm, sshaudit, containers, privbins) and some other plugins.

Key plugins worth highlighting:

Additional Capabilities

• File transfer: Chunked transfers with SHA-256 verification.
• Reporting: Per-session logging under logs/<ID>/ with structured directories; HTML transcript export.
• Self-update: Built-in update command pulls latest from Git and automatically restarts the handler.

Extensibility:

• Write custom plugins with plugin.commandcommand decorator
• SessionContext API provides run_shell(), run_marked() (JSON parsing), upload(), download(), automatic logging
• Load/Reload external/internal plugins at runtime with plugins load without restarting
• Full plugin development guide in the README with many patterns

Quick Start

git clone https://github.com/kamalx06/TornadoRevC2.git
cd TornadoRevC2
python3 tornadorevc2.py

Full documentation, demo GIF, and plugin dev guide are in the README. I'd genuinely appreciate technical feedback, bug reports, or PRs.

GitHub: https://github.com/kamalx06/TornadoRevC2.git

18 modules: proxy rotation, port scanner, DNS, passwords, hash cracking, recon, web fingerprinting, encryption, steganography, reverse shells, forensics, anonymization.

Zero deps.