Villain C2 Framework Documentation

Villain is a high-level Stage 0/1 Command and Control (C2) framework designed to handle multiple reverse TCP and HoaxShell-based shells.

Key Capabilities:

• Payload Generation: Supports default, customizable, or user-defined payload templates for Windows and Linux.
• Session Management: Features a dynamically engaged pseudo-shell prompt for quick switching between sessions.
• File Operations: Supports file uploads via HTTP and fileless execution of scripts against active sessions.
• Shell Enhancement: Automatically invokes ConPtyShell against PowerShell r-shell sessions to gain fully interactive Windows shells.
• Multiplayer Mode: Allows sharing sessions among connected sibling servers (multiple Villain instances).
• Session Defender: Inspects user-issued commands to prevent unintentional input that might cause a shell to hang.

Villain is developed and tested on Kali Linux. You can install it via the official repositories using apt, or manually from the source to ensure you have the latest version.

Prerequisites You must install gnome-terminal as it is required for one of the framework's commands.

Installation via apt

apt install villain

Manual Installation

git clone https://github.com/t3l3machus/Villain
cd ./Villain
pip3 install -r requirements.txt

Install gnome-terminal

sudo apt update && sudo apt install gnome-terminal

Villain should be run with root privileges. The CLI accepts several flags to configure ports and security certificates.

Command Syntax

villain [-h] [-p PORT] [-x HOAX_PORT] [-n NETCAT_PORT] [-f FILE_SMUGGLER_PORT] [-i] [-c CERTFILE] [-k KEYFILE] [-u] [-q]

Arguments/Flags

• -h: Help
• -p PORT: Port
• -x HOAX_PORT: HoaxPort
• -n NETCAT_PORT: NetcatPort
• -f FILE_SMUGGLER_PORT: FileSmugglerPort
• -i: (Interactive/Internal flag)
• -c CERTFILE: CertFile
• -k KEYFILE: KeyFile
• -u: (User/Update flag)
• -q: (Quiet flag)