Skip to content

Reverse TCP Listener for Built Agents

This listener creates a TCP connection channel between the agent (client) and the C2 server. The agent connects to the C2 listener by using one or more specified hosts and port. All data is transmitted immediately without sleep or bandwidth limits.

Plugin ID: shelldot.listener.agent-reverse-tcp

Configuration Reference

The If omitted column describes hand-written JSON sent directly to the API. The plugin's named default example explicitly supplies host localhost, port 5555, and an empty Base64 handshake value.

Parameter Type Required If omitted Description
hosts string[] Yes Invalid One or more valid IP addresses or hostnames the agent will use to connect to C2.
port int Yes Invalid TCP port (1-65535) the agent connects to. Also the listener bind port unless bindToPort is set.
bindToPort int No Uses port Port (1-65535) the listener actually binds to. Useful with redirectors.
bindAddress string No All interfaces Address the listener binds to.
handshakeBytes Base64 string Yes First connection fails Bytes used for the initial handshake between C2 and the agent. Direct JSON must supply this field; use "" to disable the handshake.
startTime string No null Optional UTC start time if the listener should delay its start (e.g. 2025-04-10T11:02:09Z).

Configuration Scenarios

Scenario 1 - Basic TCP Reverse Connection

The minimal configuration for an agent connecting back over TCP to a single C2 host.

1
2
3
4
5
{
  "port": 5555,
  "hosts": ["192.168.32.135"],
  "handshakeBytes": ""
}

Scenario 2 - Multi-Host with Delayed Start

The agent connects to one of multiple hosts and the listener activates at a scheduled time.

1
2
3
4
5
6
7
8
9
{
  "port": 5555,
  "hosts": [
    "192.168.32.135",
    "10.0.0.50"
  ],
  "handshakeBytes": "QUFBQQ==",
  "startTime": "2025-04-10T11:02:09Z"
}

Example (POST Request)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
POST /api/v1/listeners HTTP/1.1
Authorization: Bearer {JWT_TOKEN}
Content-Type: application/json

{
  "plugin": "shelldot.listener.agent-reverse-tcp",
  "name": "my-tcp-reverse-listener",
  "configuration": {
    "hosts": [
      "192.168.32.135"
    ],
    "port": 5555,
    "handshakeBytes": "QUFBQQ==",
    "startTime": "2023-04-10T11:02:09Z"
  }
}