Reverse TCP Listener for Built Agents

This listener creates a direct TCP connection channel between an agent (client) and the C2 (server). Unlike HTTP listeners, it transmits data immediately without delays or bandwidth restrictions, prioritizing speed over stealth.

Plugin ID: shelldot.listener.agent-reverse-tcp

Configuration

The If omitted column describes hand-written JSON sent directly to the server. The plugin's named default example explicitly supplies host localhost, port 5555, and an empty Base64 handshake value.

Parameter	Type	Required	If omitted	Description
hosts	string[]	Yes	Invalid	One or more valid IP addresses or hostnames the agent will use to connect to C2.
port	int	Yes	Invalid	TCP port (1-65535) the agent connects to. Also the listener bind port unless bindToPort is set.
bindToPort	int	No	Uses port	Port (1-65535) the listener actually binds to. Useful with redirectors.
bindAddress	string	No	All interfaces	Address the listener binds to.
handshakeBytes	Base64 string	Yes	First connection fails	Bytes used for the initial handshake between C2 and the agent. Direct JSON must supply this field; use "" to disable the handshake.
startTime	string	No	null	Optional UTC start time if the listener should not start immediately.

Operation Details

Feature	Behavior
Connection	Agent initiates TCP connection to C2
Data Flow	Immediate transmission without delays
Bandwidth	No artificial limits or throttling
Traffic Pattern	Continuous, real-time communication
Best Use Case	Scenarios prioritizing speed over stealth

Note: Due to the lack of traffic shaping, this connection type may be more detectable by network monitoring systems.