TRON: A Windows Trojan & Reverse-Shell Generator Tool

While doing some recent housekeeping in the TwelveSec internal archives, we stumbled upon an old friend: TRON.

Originally developed for our internal penetration testing team, TRON was our go-to framework for bypassing antivirus controls and getting easy, reliable reverse shells during assessments. Rather than letting it gather dust, we decided to dust it off, test it against modern defenses, and open-source it for the cybersecurity community to use for research, education, and fun.

Despite being an archived tool, our recent testing (as of late September 2026) showed that TRON’s generated payloads are still fully undetectable against a fully updated Windows 11 system running Microsoft Defender.

 

Here is a look at what TRON is, how it operates, and how you can help us test it.

📦 What is TRON?

TRON is a Windows Trojan and reverse-shell generator designed to automate the payload staging process. It leverages Bash, Rust, and PowerShell to create a seamless execution chain that crashes AMSI (Anti-Malware Scan Interface) and executes encrypted payloads entirely in memory.

The tool takes the operational friction out of initial access by handling the generation of the executable, the staging scripts, and the listener configuration all in one go. It supports simple cmd reverse shells, as well as fully functional Meterpreter shells (TCP and HTTPS).

⚙️ Under the Hood: How the Staging Works

TRON utilizes a two-port staged delivery architecture to evade static analysis and behavioural detection. When the operator configures their encryption passphrase and listening port, TRON generates four specific files to facilitate the attack chain.

To execute the attack, the operator must have two ports open on their Kali/Debian attack machine:

1. Port 80 (HTTP): Used to serve the staging files.
2. Custom TCP Port: Used to catch the incoming reverse shell.

When the generated Windows Executable is run on the target machine, the following automated chain occurs:

1. The Callout: The executable reaches out to the operator’s HTTP server (Port 80).
2. The Download: It silently downloads three files: an Amsi Crasher PowerShell script, a PowerShell script containing the heavily encrypted payload, and a text file containing the exact passphrase needed for decryption.
3. Execution: An AMSI crasher technique is deployed. The payload is then decrypted directly in memory and injected, bypassing disk-based AV scanning.
4. The Shell: A reverse shell or Meterpreter session connects back to the operator’s listener port.

🔊 Call to the Community: We Need Your Testing!

While we have confirmed that TRON plays smoothly and remains undetectable against Windows 11 Defender, the endpoint security landscape is vast.

This is where we want your help.

We strongly encourage the security community to download TRON and test it against various other AV solutions. In what environments does it shine? Where does it get caught?

• Test it out: Spin up some VMs with different security software.

• Tell us: Report bugs, open issues, or share your detection findings on our GitHub repository.

• Show us: If you have cool execution chains or if you capture it bypassing a specific AV, send us a video or tag us on social media!

Getting Started

TRON is officially available now. It is built to run on Kali Linux (ARM64 & AMD64), Debian, and Parrot OS. You can find the source code, installation instructions, and the newly added .deb package on our GitHub.

🔗 https://github.com/twelvesec/TRON

⚠️ Disclaimer: TwelveSec and the authors are not responsible for any misuse or illegal activities conducted with this tool. Always ensure you have explicit, written permission before testing on systems you do not own.