Hello Kali Linux Team,
I would like to suggest adding TRON to the Kali Linux repositories. TRON is an open-source penetration testing tool designed to streamline the delivery of Windows reverse shells (cmd, PowerShell, and Meterpreter) while utilizing AMSI and AV evasion techniques.
The tool was originally developed for internal penetration tests by TwelveSec to reliably obtain reverse shells during authorized assessments, and has recently been made public for the security community.
The project is actively maintained and continuously updated with new functionality, improvements, bug fixes, tests, and analysis capabilities.
Name: TRON
Author: Aristos / TwelveSec
Repository: https://github.com/twelvesec/TRON
License: MIT License
Language: Bash, Rust, PowerShell
Why it should be included in Kali Linux:
TRON generates undetectable Meterpreter payloads (tested on an updated Windows 11 system) and simplifies the payload-staging process for penetration testers by automating the generation of encrypted payloads, AMSI-crasher scripts, and the required HTTP server infrastructure. It addresses common operational friction related to initial payload execution and AMSI bypasses during authorized engagements. Including this tool as a pre-packaged utility could be useful for authorized red-team and penetration-testing assessments by helping security professionals evaluate how effectively Windows Defender detects and responds to simulated payloads and attack techniques.
How it works (Briefly):
TRON uses a staged delivery architecture. It generates a Windows executable that, when executed on the target, reaches back to the operator's HTTP server to download a PowerShell Amsi crasher script, an encrypted PowerShell payload, and a decryption key. The payload is then decrypted and executed in memory, sending a reverse shell (or Meterpreter session) back to the listening port.
Additionally, I have provided the URL for the .deb package for easy installation on Debian-based distributions: https://github.com/twelvesec/TRON/releases/tag/v1.7.5
And I have also included a link to an updated video demonstrating the tool’s workflow and its ability to bypass Windows 11 antivirus protections in an authorized security-testing environment:
https://github.com/user-attachments/assets/7ddde090-9356-4b63-94ec-b5db7a10561e
Thank you for your time and consideration! | 