Squatter

// Windows payload provider

Squatter is Hovel's Windows payload-provider module for authorized lab and demonstration environments. The provider is a Go JSON-RPC stdio module that describes, generates, installs, reconnects to, and cleans up Squatter payload instances through Hovel's provider contracts.

The Windows payload is a C PE executable built with the repo-pinned MinGW toolchain. It exposes an agent session over SMB named-pipe, TCP-bind, and TCP-callback transports while keeping its wire protocol, framing, retry behavior, and target-side details inside the provider instead of Hovel core.

What's in the Box

• Payload provider -- modules/squatter/provider implements Hovel's payload_provider contract.
• Windows agent -- modules/squatter/windows/src builds a no-CRT PE payload for Windows x86.
• Transports -- SMB named pipe, TCP bind, and TCP callback, with reverse-tcp accepted as a compatibility alias.
• Payload TLS -- provider-stamped X.509 identity and a statically linked, no-CRT wolfSSL TLS 1.3 server for configured TCP-bind payloads; Mesh carries ciphertext through to the payload.
• Typed actions -- host facts, file transfer, registry and event-log queries, drive/share/ACL reads, process control, command execution, status, and cleanup.
• Client tooling -- squatterctl, SMB admin helpers, wire framing, shell, and transfer libraries.
• Durable inventory -- install steps return provider-owned reconnect and cleanup descriptors for Hovel installed-payload records.

Entry Points