Secure Remote CLI

A small educational remote CLI project demonstrating TCP sockets, TLS encryption, token authentication, allowlisted Windows commands, logging, and PyInstaller packaging.

Educational Purpose Only: This project is created strictly for educational purposes and authorized cybersecurity testing on systems you own or have explicit permission to use.

Project Overview

Component	Details
Server	Kali Linux
Client	Windows
Protocol	TCP + TLS
Port	8443
Authentication	Shared token
Commands	Allowlisted only
Windows deployment	client.exe

The Windows client is intentionally restricted to predefined commands and does not provide an arbitrary command shell, persistence, credential theft, or security-tool evasion.

Index

• Architecture
• Repository
• Output
• 1. Project Structure
• 3. Kali Linux Setup
• 4. Generate TLS Certificate
• 5. Generate Authentication Token
• 6. Server Configuration
• 7. Client Configuration
• 8. Start the Kali Server
• 9. Test Windows Connectivity
• 10. Test the Python Client
• 11. Available Commands
• 12. Build the Windows EXE
• 13. Windows Final Lab Machine
• 14. Logging
• 15. Troubleshooting
• 16. Security Design
• 17. Security Notes
• License

Architecture

                    TLS / TCP :8443
┌──────────────┐                         ┌──────────────────┐
│ Kali Linux   │                         │ Windows          │
│ server.py    │ ──────────────────────> │ client.exe       │
│ secure-cli>  │ <────────────────────── │ allowlisted      │
└──────────────┘        output            │ commands         │
                                         └──────────────────┘

Repository

• Repository: https://github.com/arthghori/Remote-CLI
• Server: https://github.com/arthghori/Remote-CLI/blob/main/server.py
• Client: https://github.com/arthghori/Remote-CLI/blob/main/client.py

Output

Example session showing the Kali server and Windows client in action authentication, dir, and whoami executed through the command flow:

1. Project Structure

Kali Linux

secure-remote-cli/
├── server/
│   ├── server.py
│   ├── server.crt
│   └── server.key
└── logs/
    └── server.log

Windows Development

client/
└── client.py

Windows After Packaging

client/
└── dist/
    └── client.exe

3. Kali Linux Setup

mkdir -p ~/secure-remote-cli/server
mkdir -p ~/secure-remote-cli/logs
cd ~/secure-remote-cli/server

4. Generate TLS Certificate

openssl genrsa -out server.key 2048

openssl req -new -x509 -key server.key -out server.crt -days 365 -subj "/CN=SecureRemoteCLI"

Verify:

ls -l

You should have:

server.crt
server.key

Important: Never copy server.key to the Windows client.

5. Generate Authentication Token

python3 -c "import secrets; print(secrets.token_urlsafe(32))"

Use the same generated token in both server.py and client.py.

AUTH_TOKEN = "YOUR_RANDOM_TOKEN"

Do not publish the real token in GitHub.

6. Server Configuration

Keep the server listening configuration as:

HOST = "0.0.0.0"
PORT = 8443

Find the Kali IP with:

ip addr

7. Client Configuration

Set the current Kali IP in client.py:

SERVER_HOST = "YOUR_KALI_IP"
SERVER_PORT = 8443
AUTH_TOKEN = "YOUR_RANDOM_TOKEN"

Example:

SERVER_HOST = "192.168.31.251"
SERVER_PORT = 8443

Replace the example with your current Kali IP.

8. Start the Kali Server

cd ~/secure-remote-cli/server
python3 server.py

Expected:

============================================================
       SECURE REMOTE CLI SERVER
============================================================
[*] Server IP : 0.0.0.0
[*] Port      : 8443
[*] Protocol  : TCP + TLS
[*] Commands  : Allowlisted
============================================================

[*] Listening on 0.0.0.0:8443
[*] Waiting for authorized client...

Check port 8443:

sudo ss -lntp | grep 8443

9. Test Windows Connectivity

PowerShell:

ping YOUR_KALI_IP

Then:

Test-NetConnection YOUR_KALI_IP -Port 8443

Expected:

TcpTestSucceeded : True

10. Test the Python Client

Before creating the EXE:

python client.py

After successful authentication, Kali should show:

[+] TCP/TLS connection from (...)
[+] Client authenticated

secure-cli>

11. Available Commands

The implementation uses an allowlist:

whoami
hostname
ipconfig
systeminfo
dir
date

Use:

secure-cli> help

Examples:

secure-cli> hostname
secure-cli> whoami
secure-cli> ipconfig
secure-cli> systeminfo
secure-cli> dir
secure-cli> date

Exit:

secure-cli> exit

The command flow is:

Kali secure-cli
      |
      v
server.py
      |
      | TLS
      v
client.py / client.exe
      |
      v
Allowlisted Windows command
      |
      v
Command output
      |
      | TLS
      v
Kali server

12. Build the Windows EXE

Install PyInstaller:

pip install pyinstaller

Build:

pyinstaller --onefile --noconsole --clean client.py

Final executable:

dist\client.exe

13. Windows Final Lab Machine

For the authorized lab demonstration, the final Windows machine only needs:

client.exe

It does not need:

client.py
server.py
server.key
server.crt
Python
PyInstaller

14. Logging

Kali server log:

cat ~/secure-remote-cli/logs/server.log

Windows client log:

client.log

15. Troubleshooting

Check Kali IP:

ip addr

Check server port:

sudo ss -lntp | grep 8443

Check Windows IP:

ipconfig

Test connectivity:

Test-NetConnection YOUR_KALI_IP -Port 8443

If Kali's IP changes:

1. Update SERVER_HOST in client.py.
2. Rebuild the EXE.
3. Copy the new dist\client.exe to the authorized Windows test machine.

If UFW is enabled in your isolated lab:

sudo ufw status

If required:

sudo ufw allow 8443/tcp

16. Security Design

This project demonstrates:

• TCP socket communication
• TLS-encrypted communication
• Token-based authentication
• JSON message framing
• Command allowlisting
• Command output handling
• Connection and command logging
• Windows executable packaging
• Kali Linux server deployment

The implementation intentionally checks requested commands against a predefined allowlist instead of accepting arbitrary shell input.

17. Security Notes

TLS Certificate

The educational client uses a self-signed certificate and disables normal certificate verification. This is suitable only for an isolated lab demonstration.

For production use, implement proper certificate validation or mutual TLS (mTLS).

Authentication Token

Use a strong random token and never publish it in the GitHub repository.

Do not commit:

server.key
AUTH_TOKEN
client.log
server.log

License

Add the license that matches your project requirements before publishing or distributing the repository.