kamalx06/tornadorevc2Modular post-exploitation framework managing reverse-shell sessions over TCP/TLS/mTLS with plugins for enumeration, in-memory execution, SOCKS5 pivoting, and persistence.
A lightweight, modular post-exploitation framework for authorized security research, red-team operations, and penetration testing. TornadoRevC2 manages interactive reverse shell and bind shell sessions on Linux and Windows hosts through a unified operator console, across plain TCP, server-authenticated TLS, and mutually authenticated TLS transports. Core session handling is extended by a cross-platform plugin architecture for host enumeration, situational awareness, and operational tasks.
Important: TornadoRevC2 runs two complementary session models in the same process. The shell handler prioritizes reliable interactive sessions, structured operator workflows, and on-demand plugin execution. The beacon subsystem adds a pull-based compiled agent for long-haul engagements that need scheduling, self-destruct, and network resilience rather than a live socket. Both share the operator console, TLS material, and logging infrastructure; neither requires the other. See Beacon Subsystem.
Use this software only on systems you own or on systems where you have explicit written authorization. You are solely responsible for compliance with applicable laws and organizational policies. The authors and contributors accept no liability for misuse, data loss, or legal consequences arising from the use of this project.
Quick demo: session management, plugin execution, SOCKS5 pivoting.
TornadoRevC2 is a modular post-exploitation framework that supports two session models in a single process, sharing one operator console and one set of infrastructure components (TLS certificate material, malleable profiles, session logging):
Interactive shell sessions — reverse shells (target dials the
handler over plain TCP, server-authenticated TLS, or mutual TLS with
client-certificate verification) and bind shells (the handler dials
the target, over plain TCP or TLS). Either can be moved at runtime
onto an HTTPS secondary transport (HTTP/2 or HTTP/1.1 over TLS) or an
SMB named pipe hosted on the target, and reverted with
backtoshell. All flows produce identical session objects and pass
through the same probe, plugin, transfer, and reporting pipeline.
Compiled beacon sessions — a Go agent cross-compiled from the operator machine, with no runtime configuration on disk. The agent checks in on a schedule, retrieves queued tasks, executes them via in-process native handlers or a shell, and returns to sleep. Tasks and results are ECDSA-signed end to end, transport is HTTPS with optional mutual TLS, and every behavioural property is baked in at build time.
The framework provides a unified operator console for session
management, host reconnaissance, chunked file transfer, in-memory
payload execution, SOCKS5 pivoting, plugin-driven post-exploitation,
structured reporting, and a built-in update command for automatic
Git-based updates and seamless handler restarts. Capabilities such as
firewall enumeration, credential store metadata collection, network
mapping, browser profiling, Windows domain trust analysis, and
additional post-exploitation functionality are implemented as 65
independent, modular plugins. The make_token plugin establishes new
C2 sessions over remote protocols (SSH, WinRM, SMB, WMI, MSSQL, DCOM,
and MySQL/MariaDB) from the operator side; upgrade_mtls migrates a
live session onto the mutual-TLS listener by pushing the handler's
client certificate bundle to the target.
Supported target platforms: Linux and Windows (primary), with compatibility for generic Unix and BSD environments where applicable.
