Skip to content

Latest commit

 

History

History
105 lines (82 loc) · 5.95 KB

Usage_Guide.md

File metadata and controls

105 lines (82 loc) · 5.95 KB
Raw

Usage Guide

⚠️ Villain was explicitly developed and tested on kali linux.
⚠️ This guide is a work in progress currently describing key features. Check out Villain's introduction on youtube for more info.

There’s no up-to-date presentation of Villain with its latest features, but these videos give a good overview of its functionality:

Disclaimer: Using this tool against hosts that you do not have explicit permission to test is illegal. You are responsible for any trouble you may cause by using this tool.

Table of contents

  1. News
  2. Generate Reverse Shell Commands
  3. Connect With Sibling Server
  4. Shell
  5. Upload Command
  6. Conptyshell
  7. Exec
  8. Flee
  9. Purge
  10. Chat with Sibling Servers
  11. Session Defender

Generate Reverse Shell Commands

Use the generate prompt command to generate payloads for Windows / Linux machines. In the latest Villain release, this function was redesigned to use payload templates (files). In Core/payload_templates/<OS>/<HANDLER>/ you can find these templates, edit them, make your own, etc. Ultimately, you should replace the predefined Windows reverse shell commands with obfuscated versions. That way you can create a personalized instance of Villain and deal with AV evasion in a more productive and efficient way. Here's how 📽️ -> youtube.com/watch?v=grSBdZdUya0

Main logic:

generate payload=<OS_TYPE/HANDLER/PAYLOAD_TEMPLATE> lhost=<IP or INTERFACE> [ obfuscate encode ]

Usage examples:

generate payload=windows/reverse_tcp/powershell lhost=eth0 
generate payload=linux/hoaxshell/sh_curl lhost=eth0 obfuscate
  • The ENCODE and OBFUSCATE keywords are enabled for certain templates and can be used during payload generation.
  • For info on a particular template, use "generate" with PAYLOAD being the only provided argument.
  • To catch HoaxShell https-based reverse shells you need to start Villain with SSL.
  • Ultimately, one should edit the templates and add obfuscated versions of the commands for AV evasion.

⚡Reverse TCP based shells are more stable and reliable than HoaxShell. ⚠️HoaxShell payloads are not reusable (will work only once). I will probably change that in the future.

Use the prompt commands backdoors and sessions to list info about your active shell sessions.

Connect With Sibling Server

Use the connect prompt command to connect and share your shell sessions with another machine running Villain.

connect <IP> <TEAM SERVER PORT>

By default, the Core server port is 65001 (you can change that with -p when starting Villain).

The shell Command

Use the shell prompt command to start an interactive pseudo-shell for a shell session. The effectiveness of the pseudo shell is going to vary depending on the quality and stability of the shell session. Again, you should prefer TCP socket based shells as they will always be more stable than HoaxShell.

shell <SESSION ID or ALIAS>

Press Ctrl + C or type exit to return to the main Villain prompt.

Upload

Use the upload pseudo shell prompt command to transfer a file from your system into an active session. The file will be http requested automatically from the Http File Smuggler (running by default on port 8888). The feature works regardless if the session is owned by you or a sibling server.

From an active pseudo shell prompt:

upload <LOCAL_FILE_PATH> <REMOTE_FILE_PATH>

Conptyshell

Use the conptyshell prompt command to automatically slap Invoke-ConPtyShell.ps1 against a shell session. A new terminal window with netcat listening will pop up (you need to have gnome-terminal installed) and the script will be executed on the target as a new process, meaning you get a fully interactive shell AND you get to keep your backdoor. Currently works only for powershell.exe backdoors. Because I love Invoke-ConPtyShell.

Usage:

conptyshell <IP or INTERFACE> <PORT> <SESSION ID or ALIAS>

Inject

Use the inject pseudo shell prompt command to fileless exec a local script file over http against an active session. Files are executed by being http requested from the Http File Smuggler. The script you execute should much the shell session type (e.g., a PowerShell script script should be executed against a powershell.exe session, etc).

Usage:

inject </path/to/local/file>

Flee

Use the flee prompt command to exit Villain without terminating any active sessions. If you start Villain again later and there are still victim machines sending HoaxShell beacons, the sessions will be re-established automatically.

Purge

Villain automatically stores information regarding generated implants and loads them in memory every time it starts. This way, HoaxShell generated implants become reusable and it is possible to re-establish older sessions, assuming the payload is still running on the victim(s). Use the purge prompt command to delete all session related metadata. It does not affect any active sessions you may have.

Chat with Sibling Servers

Commands starting with "#" are interpreted as messages and will be broadcasted to all connected Sibling Servers.

Session Defender

Villain has a function that inspects user issued shell commands for input that may cause a backdoor shell session to hang (e.g., unclosed single/double quotes or backticks, commands that may start a new interactive session within the current shell and more). Use the cmdinspector command to turn that feature on/off.

Usage:

cmdinspector <ON/OFF>