[OffCode]

The Web Remote Control System is a high-performance, completely free, and self-hosted platform that lets you manage Windows devices directly from any web browser. Combining a lightweight Windows Agent with a Blazor-based control panel, you can monitor and control remote computers in real time without being physically present.

AES-256 GCM Encryption: The system is built with security as its absolute foundation. All sensitive payloads and communication between the Agent and the Backend are encrypted end-to-end using AES-256 GCM. This guarantees that even if your connection is intercepted using packet sniffers like Wireshark, the data remains completely unreadable and protected. A dedicated Server Manager tool securely generates cryptographic Master Keys and directly embeds them into the Agent executables, ensuring zero-configuration deployment without compromising security.

---

Video:

https://youtu.be/_gMLGK7DUUI

---

✨ Features

AES-256 GCM Encryption: Sensitive hub payloads are encrypted at the application layer; use HTTPS/WSS in production. Each agent stub gets its own AES-256 key (AgentKeyId) plus a per-stub connect token.

Live Stream & Interactive Control: View the remote desktop and interact with the mouse/keyboard in real time.

Chat: Real-time two-way chat between the dashboard administrator and the remote agent user, with a customizable admin nickname and message history.

Share Screen (Public Viewer): Generate a public, anonymous link to securely share the live stream without giving dashboard access. Custom expiry (hours + minutes) or No time limit; expired links stop relaying frames automatically.

Streaming File Manager: Transfer large files efficiently without hitting memory limits; browse all ready drives (fixed, removable, network) and jump to common folders (e.g. Desktop, Documents, Downloads, Program Files, AppData); click-to-open navigation with upload target following the current path; optional Upload and run toggle; File Search by name with wildcard and recursive subdirectory support.

Desktop Screenshot: Capture preview in the control panel; Close Image dismisses the preview without leaving the page.

Task Manager & Process Blocker: View and manage active processes from the web interface. Block specific applications by name so the remote agent kills them on startup; setting persists even if the dashboard is closed.

Power Controls: Shut down or restart the remote device from the Task Manager panel.

Software Manager: List installed applications and uninstall them remotely using Windows Registry data.

Remote Process Execution: Instantly run commands, open files, or launch software on the remote machine.

Remote Terminal & Script Manager: Interactive PowerShell/CMD terminal in the browser, plus a built-in script editor for Python, PowerShell, Batch, and VBScript. Includes Stop Script, Download Output, and Scheduled Script Execution (managed by the backend even if the browser dashboard is closed).

System Telemetry: Monitor hardware and software metrics (CPU, RAM, OS version, network info) through the Computer Info dashboard. Startup Programs includes a Remove button (Registry HKCU/HKLM or startup folder; admin required for HKLM).

Device History: Track and manage previously connected devices for quicker reconnection.

Real-time Device Ping: Connected devices list shows live round-trip latency (ms) between the backend and each online agent, updated about every 10 seconds with color-coded indicators.

Telegram Notifications (Optional): Receive a Telegram message when any device comes online. Configure bot token and chat ID from Agent settings; includes setup help and a test message button.

Telegram Bot Commands: Send /Get_info in the configured Telegram chat to fetch Computer Info from an online device (device selection when multiple devices are connected).

Agent Settings: Windows auto startup with a custom startup name (default: RemoteControlAgent), configurable from the dashboard.

Dashboard Lock: Password gate for the admin panel (/authentication/login), with settings at /authentication/settings. Cookie session plus short-lived JWT for SignalR and protected REST APIs.

Remove Agent: Disconnect a device from the dashboard and trigger remote uninstall of the agent executable on the target PC; if the agent is offline, the request is queued in SQLite and runs when it reconnects.

Server Manager: Configure ports, start the backend and frontend independently (stopping Frontend does not stop Backend, and vice versa), generate secure client agents (stubs), toggle optional file logging, and view the latest project changelog directly within the application.


Download: https://www.dev-offcode.com/RemoteControl.html

[DramaKing]

So it's free except for the source code?

[OffCode]

So it's free except for the source code?

Yes! I will upload more pictures tomorrow!

[5chn4pp]

It's based on the Blazor framework? That's hilarious.

Since you embed keys into the agent, is it mTLS based? I may be reading that wrong.

[OffCode]

It's based on the Blazor framework? That's hilarious.

Since you embed keys into the agent, is it mTLS based? I may be reading that wrong.

Yes, the dashboard uses Blazor Server because its seamless integration with SignalR makes real-time, bi-directional communication incredibly smooth when sharing C# models across the stack.

Regarding the keys: It's actually not mTLS. The system uses Application-Layer Payload Encryption. The embedded keys inside the agent consist of an API Key (used to authenticate and fetch a JWT Bearer token) and a shared AES-256 GCM key.

The actual payload data (commands, telemetry, inputs) is encrypted at the application layer using AES-256 before being sent over SignalR. The transport layer just relies on standard HTTPS/WSS via a reverse proxy (like Nginx), but even if the TLS is terminated at the proxy, the payloads remain completely unreadable without the AES key.

[5chn4pp]

Yes, the dashboard uses Blazor Server because its seamless integration with SignalR makes real-time, bi-directional communication incredibly smooth when sharing C# models across the stack.

Regarding the keys: It's actually not mTLS. The system uses Application-Layer Payload Encryption. The embedded keys inside the agent consist of an API Key (used to authenticate and fetch a JWT Bearer token) and a shared AES-256 GCM key.

The actual payload data (commands, telemetry, inputs) is encrypted at the application layer using AES-256 before being sent over SignalR. The transport layer just relies on standard HTTPS/WSS via a reverse proxy (like Nginx), but even if the TLS is terminated at the proxy, the payloads remain completely unreadable without the AES key.

Sounds decent, as long as the agent key isn’t the same for everyone.

Otherwise one key could decrypt everyone else’s traffic. :)

[OffCode]

Sounds decent, as long as the agent key isn’t the same for everyone.

Otherwise one key could decrypt everyone else’s traffic. :)

Yeah!

The AES-256 GCM key is completely unique per installation. When the user opens the Server Manager for the first time, the system generates unique key

I might actually add a button in the future to let the user manually regenerate and change the key themselves too!

[jason123]

The Web Remote Control System is a high-performance, completely free, and self-hosted platform that lets you manage Windows devices directly from any web browser. Combining a lightweight Windows Agent with a Blazor-based control panel, you can monitor and control remote computers in real time without being physically present.

AES-256 GCM Encryption: The system is built with security as its absolute foundation. All sensitive payloads and communication between the Agent and the Backend are encrypted end-to-end using AES-256 GCM. This guarantees that even if your connection is intercepted using packet sniffers like Wireshark, the data remains completely unreadable and protected. A dedicated Server Manager tool securely generates cryptographic Master Keys and directly embeds them into the Agent executables, ensuring zero-configuration deployment without compromising security.




✨ Features

• AES-256 GCM Encryption: All sensitive data is encrypted end-to-end.
  


• Live Stream & Interactive Control: View the remote desktop and interact with the mouse/keyboard in real time.
  


• Streaming File Manager: Transfer large files efficiently without hitting memory limits.
  


• Task Manager: View active processes and manage them directly from the web interface.
  


• Remote Process Execution: Instantly run commands, open files, or launch software on the remote machine.
  


• System Telemetry: Monitor detailed hardware and software metrics (CPU, RAM, OS version) through the Computer Info dashboard.
  


• Server Manager: A built-in tool to easily configure ports, launch the server, and generate secure client agents (stubs).
  

Download: https://www.dev-offcode.com/RemoteControl.html

Hey MAGU, thanks for this software, it worth testing to see the effect. Does it need to be crypted or it bypasses WD?

[ServersFxcked]

Hey MAGU, thanks for this software, it worth testing to see the effect. Does it need to be crypted or it bypasses WD?

Really make a output and go test it, brother doesnt have to wipe your ass facepalm*

[OffCode]

Hey MAGU, thanks for this software, it worth testing to see the effect. Does it need to be crypted or it bypasses WD?

It doesn’t need to be an crypted stub at the moment. As time goes on and downloads increase, antivirus software may start flagging it anyway, even if the program itself doesn’t contain any particularly dangerous or harmful features.

---

Added more pictures to our website

[jason123]

Really make a output and go test it, brother doesnt have to wipe your ass facepalm*

You shoud not have responded to what you do not know much about. There is no harm in asking question! Fair enough OP responded gently

---

It doesn’t need to be an crypted stub at the moment. As time goes on and downloads increase, antivirus software may start flagging it anyway, even if the program itself doesn’t contain any particularly dangerous or harmful features.

---

Added more pictures to our website

Noted with thanks 👍.

[ServersFxcked]

[quote="jason123" pid='62950902' dateline='1777978522']

You shoud not have responded to what you do not know much about. There is no harm in asking question! Fair enough OP responded gently

---

I sell my Own Rat and Crypter so I do but algood, I waas just making a point saying you could've done it yourself instead of waiting for a response

[ColdBoot]

Program doesn't work and requires .net sdk which isn't mentioned in the readme

[OffCode]

Program doesn't work and requires .net sdk which isn't mentioned in the readme

Program works fine, Yes its requires .net SDK i write it to readme.

You did portforwarding?

[ColdBoot]

Program works fine, Yes its requires .net SDK i write it to readme.

You did portforwarding?

Has nothing to do with port forwarding. The services for front and backend can't even start.

Code

[13:53:23] Log cleared by user
[13:53:25] [Frontend Only] Starting frontend server...
[13:53:25] AES_MASTER_KEY_HEX not found in appsettings or .env; key will not be written to .env.
[13:53:25] Frontend configuration synced (appsettings.json + .env).
[13:53:25] launchSettings.json not found at FrontEnd\Properties\launchSettings.json
[13:53:25] [Frontend Only] Frontend started successfully (Published DLL mode)
[13:53:26] [Frontend Error] Could not execute because the specified command or file was not found.
[13:53:26] [Frontend] Possible reasons for this include:
[13:53:26] [Frontend]   * You misspelled a built-in dotnet command.
[13:53:26] [Frontend]   * You intended to execute a .NET program, but dotnet-FrontEnd\FrontEnd.dll does not exist.
[13:53:26] [Frontend]   * You intended to run a global tool, but a dotnet-prefixed executable with this name could not be found on the PATH.
[13:53:26] [Frontend Only] Frontend process exited unexpectedly

---

By the way just running the manager as extracted doesn't even work, I have to move the other folders into Manager folder just so it doesn't crash.

Code

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.InvalidOperationException: No process is associated with this object.
   at System.Diagnostics.Process.EnsureState(State state)
   at System.Diagnostics.Process.get_HasExited()
   at ServerManager.Form1.UpdateUI() in C:\Users\35844\Desktop\RemoteControl Open\ServerManager\Form1.cs:line 1091
   at ServerManager.Form1.btnStart_Click(Object sender, EventArgs e) in C:\Users\35844\Desktop\RemoteControl Open\ServerManager\Form1.cs:line 250
   at System.Threading.Tasks.Task.<>c.<ThrowAsync>b__128_0(Object state)
   at System.Windows.Forms.Control.InvokeMarshaledCallbackHelper(Object obj)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
--- End of stack trace from previous location ---
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Windows.Forms.Control.InvokeMarshaledCallbacks()