hoaxshell is an unconventional Windows reverse shell, currently undetected by Microsoft Defender and possibly other AV solutions, solely based on http(s) traffic. The tool is easy to use, it generates it's own PowerShell payload and it supports encryption (ssl).
So far, it has been tested on fully updated Windows 11 Enterprise, Windows Server 2016 Datacenter and Windows 10 Pro boxes (see video and screenshots).
![[Image: 68747470733a2f2f7261772e6769746875622e63...322e706e67]](https://camo.githubusercontent.com/05bcd11f17e4aaebb754221364f910a1821f2f1b5e6cc3a118dff1ec89a4ea70/68747470733a2f2f7261772e6769746875622e636f6d2f74336c336d61636875732f686f61787368656c6c2f6d61737465722f73637265656e73686f74732f686f61787368656c6c2d77696e31312d76322e706e67)
Important: As a means of avoiding detection, hoaxshell is automatically generating random values for the session id, URL paths and name of a custom http header utilized in the process, every time the script is started. The generated payload will work only for the instance it was generated for. Use the -g option to bypass this behaviour and re-establish an active session or reuse a past generated payload with a new instance of hoaxshell.
Check it out here: https://github.com/t3l3machus/hoaxshell
So far, it has been tested on fully updated Windows 11 Enterprise, Windows Server 2016 Datacenter and Windows 10 Pro boxes (see video and screenshots).
Important: As a means of avoiding detection, hoaxshell is automatically generating random values for the session id, URL paths and name of a custom http header utilized in the process, every time the script is started. The generated payload will work only for the instance it was generated for. Use the -g option to bypass this behaviour and re-establish an active session or reuse a past generated payload with a new instance of hoaxshell.
Check it out here: https://github.com/t3l3machus/hoaxshell
