schich/lucky-arc

Lucky-Arc is a security research project made up of two parts: a reverse shell client and a matching command and control, or C2, server. A reverse shell is a technique where a remote machine connects back out to an operator's machine and gives them a command line on the target, and a C2 server is the operator side tool that manages these connections. What sets this project apart from a basic reverse shell, according to the README, is how the client presents its terminal. Instead of launching PowerShell with options that tend to look suspicious to security monitoring tools, it uses something called a pseudoconsole. This has a practical side effect for whoever is using it: normal terminal features like tab autocomplete, ctrl-c, and the arrow keys work the way they would in an ordinary terminal session, rather than behaving oddly the way many simple reverse shells do. Communication between the client and the C2 server happens over encrypted websockets, which is meant to make the network traffic harder to distinguish from ordinary encrypted web traffic and harder to flag through detection tools. The README is short and states plainly that the project is still under active development, with the server side in particular noted as unfinished. There is no build documentation, usage instructions, or license information included at this time. This kind of tool is typically associated with red team and penetration testing exercises, where security professionals simulate attacks against systems they have explicit permission to test.