Web Remote Control 0.9

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

---

CHANGELOG:

10/07/2026
VER: 0.9

• Added: Share Link Expiry — Live Stream share links can now have a configurable lifetime. In the stream toolbar, set Hours and Minutes or enable No time limit. The backend registers sessions in ShareSessionService; ShareExpiryService expires them and notifies viewers via ShareExpired. Admin UI shows a countdown while sharing. Server validates links on JoinShare and BroadcastSharedFrame (1 min – 7 days, or unlimited).
• Added: Real-time Device Ping — DevicePingService pings connected agents every 10 s; agents respond with Pong; RTT is shown in the connected devices list (PingMs, color-coded). Cleartext ping IDs only (no sensitive payload).
• Added: Telegram Notifications — Optional global setting in Agent settings: Telegram message when a device comes online. Settings persisted in telegram-settings.json (hot-reload); REST API api/telegram/settings + test endpoint; in-modal BotFather setup help.
• Added: Telegram /Get_info Command — TelegramCommandService polls Bot API getUpdates; /Get_info requests Computer Info from an online agent (multi-device selection in chat). Responses routed via hub (SendComputerInfoRequestToAgentAsync, telegram- requestId prefix). Only the configured chat ID is accepted.
• Fixed: Share Screen anonymous join — JoinShare added to hub anonymous allow-list so public viewers can connect without dashboard JWT.
• Security: Replay Attack Protection (EncryptedPacket) — All incoming EncryptedPacket messages are now protected against replay attacks on both the BackEnd and RemoteAgent sides. A new ReplayCache (in-memory nonce-cache, BackEnd/Security/ReplayCache.cs and RemoteAgent/Security/ReplayCache.cs) registers the SHA-256 fingerprint of every received encrypted blob; an identical blob is rejected immediately. In addition, packet.Timestamp is validated against a configurable time window (default 60 seconds, tunable via ReplayProtection:MaxAgeSeconds in appsettings.json) — stale packets are dropped with a warning log. Validation runs in DeviceControlHub.ReceiveEncryptedFromAdmin, DeviceControlHub.ReceiveEncryptedFromAgent and SignalRService.HandleReceiveEncryptedPacketAsync. AES-GCM already guaranteed confidentiality and integrity; ReplayCache adds freshness so a captured valid ciphertext (e.g. a shutdown or kill-process command) cannot be replayed later.
• Security: ConnectAsDevice bypass fix — Fixed a security vulnerability in DeviceControlHub.ConnectAsDevice. When AgentSecurity:RequireConnectToken was set to true, an attacker could bypass the enforcement by sending any unknown agentKeyId — TryGetConnectToken returned false for the unknown ID, causing the code to skip token validation and allow the connection as a legacy agent. Added an else if (requireToken) branch inside the agentKeyId block: if agentKeyId is provided but not found in the AgentKeys.json registry in strict mode, the connection is now rejected with HubException("Unauthorized") and a warning is logged (ConnectAsDevice: unknown agentKeyId rejected). The attacker would still need the shared AES_MASTER_KEY_HEX to communicate, but the RequireConnectToken enforcement now correctly covers all cases.

OffCode Web Remote Control 0.8

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

---

CHANGELOG:

05/07/2026
VER: 0.8

• Security: Agent encryption & identity (v2) — Server Manager now generates a unique AES-256 key, AgentKeyId, and AGENT_CONNECT_TOKEN (256-bit random hex) for each new stub. All three are embedded in the stub trailer/.env and registered in BackEnd/AgentKeys.json (hot-reloaded via AgentKeyStore, no BackEnd restart). Per-agent keys limit blast radius: leaking one stub no longer decrypts every agent's traffic (the shared AES_MASTER_KEY_HEX remains BackEnd↔FrontEnd dashboard only). Connect token closes identity spoofing on the anonymous ConnectAsDevice hub method: the BackEnd validates the token with constant-time hex comparison before registration; new agents call ConnectAsDevice directly over TLS. Validation activates per registry entry (legacy rows without connectToken still work until updated). The encrypted ReceiveEncryptedFromAgent → ConnectAsDevice bypass is restricted when AgentSecurity:RequireConnectToken is true (false in dev, true in appsettings.Production.json). Production: rebuild all agent stubs after upgrading the BackEnd, then enable RequireConnectToken=true. Use HTTPS/WSS so the connect token is not visible on the wire. LoadTester supports direct token-based registration.
• Fixed: FrontEnd Hardcoded Dev Fallback Key Removed — The FrontEnd's encryption service previously fell back to a hardcoded AES key when ASPNETCORE_ENVIRONMENT=Development and AES_MASTER_KEY_HEX was unset. It now fails fast and refuses to start without a valid key, matching the BackEnd and RemoteAgent behavior exactly.

OffCode Web Remote Control 0.7

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

---

CHANGES:

20/06/2026
VER: 0.7

• Added: Reverse Proxy Support — Built-in support for Nginx and Cloudflare Tunnels utilizing X-Forwarded-For and X-Forwarded-Proto headers. The servers now seamlessly track real client IP addresses securely when placed behind a reverse proxy.
• Added: Auto Startup Name modal — Enabling Windows auto startup from Agent settings now opens a modal where you can choose a custom startup name (or keep default RemoteControlAgent).
• Improved: Live Stream Cursor Visibility — The real system cursor from the agent machine is now rendered directly into captured livestream frames, including scaled captures.
• Improved: Live Stream Smoothness — Streaming lag/stutter has been significantly reduced with pipeline optimizations, resulting in much smoother playback and fewer frame hiccups.
• Fixed: Remote Control Right Click — Right-click from dashboard now correctly executes as right-click on the agent side, and right mouse button no longer triggers left-button down/up drag events.

OffCode Web Remote Control 0.6

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

---

CHANGELOG:

18/06/2026
VER: 0.6

• Security: Request Timeout / Slowloris Protection — RequestTimeout middleware added (30s global, 10 min for file transfers, ∞ for SignalR). Kestrel hardened with RequestHeadersTimeout: 15s and KeepAliveTimeout: 120s. HTTP/2 stream limit set to 100 per connection.

• Security: Error Message Hardening — Internal ex.Message no longer exposed in HTTP responses across UserController, DeviceController, and FileManagerController (12 locations fixed). All 500 responses now return a safe generic message; full exception details logged server-side only. Global fallback exception handler added to BackEnd/Program.cs with correlationId for log tracing.

• Fixed: Script Execution Timeout Removed — Scripts now run indefinitely until manually stopped by the user. The previous 5-minute hard timeout (CancellationTokenSource(TimeSpan.FromMinutes(5))) has been removed from ScriptExecutionService. Output buffer size limit also removed.

• Improved: UI Modernization (Glassmorphism) — The Blazor FrontEnd has been significantly upgraded with a sleek "glassmorphism" theme featuring emerald/teal accents. This applies to LiveStream, DeviceControl, AgentSettingsPanel, and authentication pages.

• Fixed: Mobile Layout — Connected devices and history views are now fully responsive on mobile devices via a robust Flexbox layout, fixing overflowing text and stretched elements.

• Improved: Live Stream Viewer — Added dynamic zoom controls allowing users to zoom in/out with the mouse wheel while tracking the cursor position. Added support for up to 240 FPS and dynamic quality settings (10-100%) for incredibly smooth playback, with 30 FPS set as the new default.

• Fixed: Share Screen Link Copy — The "Copy Link" button in the Live Stream view now uses synchronous JavaScript logic for improved reliability across all environments.

• Added: Stealth Mode — You can now hide the agent's tray icon directly from the "Agent settings" panel. When Stealth Mode is enabled, the agent runs silently in the background and is only visible in the Windows Task Manager.

• Added: Chat — Real-time two-way chat window between the dashboard administrator and the remote agent's user, complete with customizable administrator nickname and message history.

• Added: Script Manager Enhancements (Job-based) — The Remote Agent now tracks all running and completed scripts directly in its RAM. The dashboard automatically fetches this real-time status, ensuring you never lose track of a script's progress, even if you close the browser. Includes a new "Clear Recent" functionality, safe asynchronous script stopping, and the ability to download execution output.

Web remote control system 0.5

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

---

CHANGELOG:

13/06/2026
VER: 0.5

• Added: Process Blocker — Prevent specific applications from running on the remote device. Enter the process name in the Task Manager section, and the background agent service will instantly kill it whenever it attempts to start. The blocking setting is saved directly to the Windows Registry and persists across reboots and network reconnects.
• Added: Startup Programs — Remove — Each startup program entry in Computer Info now has a Remove button. Clicking it sends an encrypted RequestRemoveStartupProgram command through the hub to the agent, which deletes the registry key (HKCU\..\Run, HKLM\..\Run, or Wow6432Node) or the startup folder shortcut. The result is returned over the same encrypted channel and displayed as a toast notification (success / error). HKLM removal requires the agent to be running as Administrator.
• Added: File Manager — Search — Search for files by name in the current directory (including subdirectories) directly from the web dashboard. Results are capped at 500 items for safety and use the encrypted SignalR tunnel for communication.

17/05/2026
VER: 0.4

• Added: Script manager tab / Scheduled Script Execution - which allows setting a specific date and time for a script to run automatically, independently managed by the backend server.
• Added: Server Manager Changelog - In-app changelog viewer that fetches and parses the latest release notes automatically, along with a quick link to download new versions.

14/05/2026
VER: 0.3

• Added: Share Screen - Share the agent's live stream with anyone via a secure, public link without requiring a dashboard login. The public viewer connects anonymously while your dashboard acts as the decryption relay.
• Added: Remote Terminal - Fully interactive PowerShell and Command Prompt terminal directly in the web dashboard.
• Added: Script Manager - Built-in code editor to write, save, and execute scripts (Python, PowerShell, Batch, VBScript) on remote agent machines. Includes

09/05/2026
VER: 0.2

• Added: Software Manager - Remotely list and uninstall applications via Windows Registry.
• Added: Power Controls - Shutdown and Restart devices remotely from the Task Manager panel.
• Added: Device History - Track and manage previously connected devices.
• Added: File Manager — dynamic drives — Quick-access buttons for all ready drives (fixed, removable, network) fetched from the agent over the encrypted SignalR channel.
• Added: File Manager — quick folders — Program Files, Program Files (x86), and Roaming AppData shortcuts (resolved on the agent via shell folder tokens, same pattern as Desktop/Documents/Downloads).
• Improved: File Manager UX — Open folders with a single click on the row; upload target automatically follows the current browse path (no separate “Set as Target” step).
• Added: File Manager — upload and run — Optional checkbox to open uploaded files automatically on the agent after transfer completes.
• Added: Desktop Screenshot — Close Image — Dismiss the screenshot preview from the device control UI.
• Added: Server Manager — log toggle — Checkbox to turn application logging on or off.
• Fixed: Server Manager — Stopping or restarting the frontend no longer stops the backend (independent service controls).
• Added: Dashboard Lock (optional) — Cookie session for the Blazor UI, lock-aware redirects, /authentication/continue when lock is disabled, safe returnUrl handling; backend stores the dashboard password as a secure hash; short-lived JWT for admin SignalR and protected REST (DeviceController, admin FileManager routes); agent HTTP file endpoints (agent-download / agent-upload) remain reachable without JWT; configure requires auth or DASHBOARD_LOCK_ADMIN_SECRET.
• Config samples: AES_MASTER_KEY_HEX default empty and example URLs use 127.0.0.1 in committed .env / appsettings templates (set real values for production).
• Added: Remove Agent — Remote uninstall flow with confirmation; offline queue in SQLite (PendingAgentCommands) until the agent reconnects.
• Added: Lock settings UI — Dashboard button on /authentication/settings opens the devices page (/devices).

08/05/2026
VER: 0.1

• Fixed: Empty secret key generation issue in Server Manager.
• Fixed: Auto-detect project path and Server Manager crashing issues.

---

Web Remote Control system 0.4

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

---

CHANGELOG:

18/05/2026
VER: 0.4

• Added: Script manager tab / Scheduled Script Execution - which allows setting a specific date and time for a script to run automatically, independently managed by the backend server.
• Added: Server Manager Changelog - In-app changelog viewer that fetches and parses the latest release notes automatically, along with a quick link to download new versions.

14/05/2026
VER: 0.3

• Added: Share Screen - Share the agent's live stream with anyone via a secure, public link without requiring a dashboard login. The public viewer connects anonymously while your dashboard acts as the decryption relay.
• Added: Remote Terminal - Fully interactive PowerShell and Command Prompt terminal directly in the web dashboard.
• Added: Script Manager - Built-in code editor to write, save, and execute scripts (Python, PowerShell, Batch, VBScript) on remote agent machines. Includes

09/05/2026
VER: 0.2

• Added: Software Manager - Remotely list and uninstall applications via Windows Registry.
• Added: Power Controls - Shutdown and Restart devices remotely from the Task Manager panel.
• Added: Device History - Track and manage previously connected devices.
• Added: File Manager — dynamic drives — Quick-access buttons for all ready drives (fixed, removable, network) fetched from the agent over the encrypted SignalR channel.
• Added: File Manager — quick folders — Program Files, Program Files (x86), and Roaming AppData shortcuts (resolved on the agent via shell folder tokens, same pattern as Desktop/Documents/Downloads).
• Improved: File Manager UX — Open folders with a single click on the row; upload target automatically follows the current browse path (no separate “Set as Target” step).
• Added: File Manager — upload and run — Optional checkbox to open uploaded files automatically on the agent after transfer completes.
• Added: Desktop Screenshot — Close Image — Dismiss the screenshot preview from the device control UI.
• Added: Server Manager — log toggle — Checkbox to turn application logging on or off.
• Fixed: Server Manager — Stopping or restarting the frontend no longer stops the backend (independent service controls).
• Added: Dashboard Lock (optional) — Cookie session for the Blazor UI, lock-aware redirects, /authentication/continue when lock is disabled, safe returnUrl handling; backend stores the dashboard password as a secure hash; short-lived JWT for admin SignalR and protected REST (DeviceController, admin FileManager routes); agent HTTP file endpoints (agent-download / agent-upload) remain reachable without JWT; configure requires auth or DASHBOARD_LOCK_ADMIN_SECRET.
• Config samples: AES_MASTER_KEY_HEX default empty and example URLs use 127.0.0.1 in committed .env / appsettings templates (set real values for production).
• Added: Remove Agent — Remote uninstall flow with confirmation; offline queue in SQLite (PendingAgentCommands) until the agent reconnects.
• Added: Lock settings UI — Dashboard button on /authentication/settings opens the devices page (/devices).

08/05/2026
VER: 0.1

• Fixed: Empty secret key generation issue in Server Manager.
• Fixed: Auto-detect project path and Server Manager crashing issues.

---

OffCode Web Remote Control 0.3

OffCode Web Remote Control System 0.3 🌐

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

CHANGELOG:

14/05/2026
VER: 0.3

• Added: Share Screen - Share the agent's live stream with anyone via a secure, public link without requiring a dashboard login. The public viewer connects anonymously while your dashboard acts as the decryption relay.
• Added: Remote Terminal - Fully interactive PowerShell and Command Prompt terminal directly in the web dashboard.
• Added: Script Manager - Built-in code editor to write, save, and execute scripts (Python, PowerShell, Batch, VBScript) on remote agent machines. Scripts are safely stored in browser's local storage for easy reuse.

09/05/2026
VER: 0.2

• Added: Software Manager - Remotely list and uninstall applications via Windows Registry.
• Added: Power Controls - Shutdown and Restart devices remotely from the Task Manager panel.
• Added: Device History - Track and manage previously connected devices.
• Added: File Manager — dynamic drives — Quick-access buttons for all ready drives (fixed, removable, network) fetched from the agent over the encrypted SignalR channel.
• Added: File Manager — quick folders — Program Files, Program Files (x86), and Roaming AppData shortcuts (resolved on the agent via shell folder tokens, same pattern as Desktop/Documents/Downloads).
• Improved: File Manager UX — Open folders with a single click on the row; upload target automatically follows the current browse path (no separate “Set as Target” step).
• Added: File Manager — upload and run — Optional checkbox to open uploaded files automatically on the agent after transfer completes.
• Added: Desktop Screenshot — Close Image — Dismiss the screenshot preview from the device control UI.
• Added: Server Manager — log toggle — Checkbox to turn application logging on or off.
• Fixed: Server Manager — Stopping or restarting the frontend no longer stops the backend (independent service controls).
• Added: Dashboard Lock (optional) — Cookie session for the Blazor UI, lock-aware redirects, /authentication/continue when lock is disabled, safe returnUrl handling; backend stores the dashboard password as a secure hash; short-lived JWT for admin SignalR and protected REST (DeviceController, admin FileManager routes); agent HTTP file endpoints (agent-download / agent-upload) remain reachable without JWT; configure requires auth or DASHBOARD_LOCK_ADMIN_SECRET.
• Config samples: AES_MASTER_KEY_HEX default empty and example URLs use 127.0.0.1 in committed .env / appsettings templates (set real values for production).
• Added: Remove Agent — Remote uninstall flow with confirmation; offline queue in SQLite (PendingAgentCommands) until the agent reconnects.
• Added: Lock settings UI — Dashboard button on /authentication/settings opens the devices page (/devices).

08/05/2026
VER: 0.1

• Fixed: Empty secret key generation issue in Server Manager.
• Fixed: Auto-detect project path and Server Manager crashing issues.

---

OffCode Web Remote Control 0.2

HOW TO USE: https://github.com/EmptyCode0x86/Web-Remote-Control-System/blob/main/README.md

CHANGELOG:

09/05/2026
VER: 0.2

• Added: Software Manager - Remotely list and uninstall applications via Windows Registry.
• Added: Power Controls - Shutdown and Restart devices remotely from the Task Manager panel.
• Added: Device History - Track and manage previously connected devices.
• Added: File Manager — dynamic drives — Quick-access buttons for all ready drives (fixed, removable, network) fetched from the agent over the encrypted SignalR channel.
• Added: File Manager — quick folders — Program Files, Program Files (x86), and Roaming AppData shortcuts (resolved on the agent via shell folder tokens, same pattern as Desktop/Documents/Downloads).
• Improved: File Manager UX — Open folders with a single click on the row; upload target automatically follows the current browse path (no separate “Set as Target” step).
• Added: File Manager — upload and run — Optional checkbox to open uploaded files automatically on the agent after transfer completes.
• Added: Desktop Screenshot — Close Image — Dismiss the screenshot preview from the device control UI.
• Added: Server Manager — log toggle — Checkbox to turn application logging on or off.
• Fixed: Server Manager — Stopping or restarting the frontend no longer stops the backend (independent service controls).
• Added: Dashboard Lock (optional) — Cookie session for the Blazor UI, lock-aware redirects, /authentication/continue when lock is disabled, safe returnUrl handling; backend stores the dashboard password as a secure hash; short-lived JWT for admin SignalR and protected REST (DeviceController, admin FileManager routes); agent HTTP file endpoints (agent-download / agent-upload) remain reachable without JWT; configure requires auth or DASHBOARD_LOCK_ADMIN_SECRET.
• Added: Remove Agent — Remote uninstall flow with confirmation; offline queue in SQLite (PendingAgentCommands) until the agent reconnects.
• Added: Lock settings UI — Dashboard button on /authentication/settings opens the devices page (/devices).

08/05/2026
VER: 0.1

• Fixed: Empty secret key generation issue in Server Manager.
• Fixed: Auto-detect project path and Server Manager crashing issues.