Initial reverse shell with basic persistance

[h3r0cybersec]

Hi this framework is really interesting mostly for the siblings part, i had a quick look at the code and I don't seem to have seen any mechanism that can reconnect reverse shells opened in previous sessions, this means that the moment Villain is terminated, then you lose access to all connected machines.

So I was wondering about adding an initial persistence mechanism to the payload, trivially for Windows after starting the reverse shell another piece of code installs in the auto startup apps for the compromised user, the reverse shell, like for linux the creation of a cronjob that does exactly the same thing.

The downside is precisely that it leaves an obvious trace of compromise, but somehow this access has to be maintained to the hacked system.

If this idea goes well then I might implement it and then open a pull request to interleave the functionality. I have already done a test with a windows-specific payload that after starting the reverse shell in the same payload creates a system task that is executed at logon, and everything works great!!!

I Look forward to updates on this aspect 🤞.