PyVaultV2

Lightweight Remote Code Execution (RCE) Module

Author: Diwas XD

---

Features

• Raw code upload — your Python code goes as-is, no obfuscation layer
• Encrypted Session Tokens — backend URLs are hidden behind PV2-{hash}-{scrambled}
• Silent terminal — no backend service names leaked in output
• Output capture — all print() from remote code is captured and displayed
• Custom User-Agent header on every request
• Hash integrity check — tampered tokens are rejected
• GitHub Raw URL support as fallback
• Robust error handling for all failure cases

---

Installation

pip install PyVaultV2

---

Quick Start

1. Upload a local file

from pyvaultv2 import CodeManager

token = CodeManager.enc("my_script.py", expiry_days=7)
# Output:
# Upload successful!
# Encrypted Token: PV2-958cbefe45-312F6A634A3C273320

The token format: PV2-{10-char hash}-{XOR-scrambled ID}
Nobody can tell where this code is stored.

2. Execute via encrypted token

CodeManager.run("PV2-958cbefe45-312F6A634A3C273320")
# Output (whatever the remote code prints):
# Hello from PyVaultV2!
# Sum of 1 to 10 = 55

3. Execute via GitHub Raw URL

CodeManager.run("https://raw.githubusercontent.com/user/repo/main/script.py")

4. Convenience aliases

from pyvaultv2 import upload, execute

upload("my_code.py")
execute("PV2-958cbefe45-312F6A634A3C273320")

---

Token Format

PV2-{10-char SHA-256 hash}-{XOR-scrambled session ID (hex)}

Part	Description
PV2-	PyVaultV2 token prefix
958cbefe45	First 10 chars of SHA-256(raw_id + secret_key)
312F6A634A3C...	XOR-scrambled backend session ID in hex

Tampered tokens are rejected with a hash mismatch error.

---

API Reference

CodeManager.enc(file_path, expiry_days=7)

Uploads a local Python file and returns an encrypted token.

Parameter	Type	Default	Description
file_path	str	—	Path to the local .py file
expiry_days	int	7	Retention period in days

Returns: str | None — Encrypted token or None on failure.

CodeManager.run(target)

Fetches and executes remote code, returning captured output.

Parameter	Type	Default	Description
target	str	—	PV2 token, GitHub Raw URL, or session ID

Returns: str | None — Captured output from execution, or None on failure.

---

How It Works

Upload

Local .py file → POST to backend → Session ID → PV2 encrypted token

Execute

PV2 token → Verify hash → Decrypt → Fetch raw code → exec() with stdout capture

---

Error Handling

Error Type	Behaviour
Missing file	Error message, returns None
Empty file	Error message, returns None
Network failure	Error message, returns None
HTTP 404	"Remote code not found" message
Tampered token	"Token invalid or tampered" message
Syntax error	Full traceback printed
Execution exception	Full traceback printed

---

Publishing to PyPI

pip install --upgrade build twine
python -m build
twine upload dist/*

---

License

MIT License — Copyright (c) 2026 Diwas XD

---

Disclaimer

Educational and authorized testing purposes only. Never use remote code execution on systems you do not own or have permission to test.