$ show iss4cf0ng/DuplexSpyCS
DuplexSpyCS is a full-featured Remote Access Trojan (RAT) command-and-control (C2) framework written in C# (.NET WinForms). It consists of a server-side management console and multiple payload variants (winClient48, winClient48DLL, Tipoff, etc.) that provide comprehensive post-exploitation capabilities: file manager, remote desktop, keylogger, webcam/microphone streaming, registry editor, process/task manager, remote shell (including xterm via WebView2), SOCKS5 proxy, and a plugin system for credential theft (Chrome, Edge, Firefox, MobaXterm). Communication uses a custom binary protocol (clsDSP) over TCP, TLS, or HTTP with RSA-AES hybrid encryption. The payloads employ persistence via registry/startup, UAC bypass, process injection (APC, EarlyBird, CreateRemoteThread, etc.), and fileless execution. The codebase is extensive but exhibits significant code duplication across payload projects, many incomplete or stub features, and outdated dependencies (AForge, NAudio, SharpPcap). It is explicitly designed for offensive security research and learning, but carries high risk of misuse.
The LLM identified 3 files worth highlighting for reuse:
Implements a binary protocol with a 6-byte header (command type, parameter, payload length) followed by an AES-encrypted payload. Designed for two-way communication between server and payload. The class is self-contained, uses no internal state beyond the methods, and can be extracted for any C# network application needing a lightweight, encrypted framing layer. Demonstrates a clean separation of concerns: reading/writing headers, encrypting/decrypting payloads, and base64 wrapper for transport.
Implements a SOCKS5 proxy server that relays traffic through a connected victim. Handles the full SOCKS5 handshake (no authentication, IPv4/domain), then sends commands to the victim to open corresponding connections and pump data. This is a standalone proxy pattern that could be reused in any C2 or tunnel project. The class is decoupled from the rest of the server, communicating via a stream ID and command interface.
Abstract base class for browser credential dumping plugins. Provides a template for extracting and decrypting saved passwords, history, cookies, bookmarks, and downloads from Chromium-based browsers (Chrome, Edge, Opera, Brave) and Firefox. Uses SQLite parsing, DPAPI, and AES-GCM/ChaCha20-Poly1305 decryption. While tightly coupled to the plugin infrastructure, the dumper logic (SQLite reading, key extraction from LocalState, decryption) is highly reusable in any credential recovery tool. Demonstrates a clean subclass pattern for targeting multiple browsers.