Post-Exploitation

Stratum C2 is a cloud persistence framework designed to maintain command-and-control (C2) communication through trusted cloud storage providers like Dropbox and OneDrive, thus avoiding detection by traditional security defenses. Its notable features include end-to-end encryption with RSA and AES, the ability to switch between multiple cloud providers seamlessly, and a structurally unblockable channel that makes it difficult for security operations centers to intercept. The framework supports multiple agent formats for both Windows and Linux without requiring additional dependencies.

FlareVM MCP is a Model Context Protocol server that facilitates remote access to a suite of over 48 Windows malware analysis tools within an isolated FlareVM environment, allowing seamless integration for AI agents and security analysts. Its notable features include remote file operations, comprehensive static and dynamic analysis capabilities, debugger integration, and a standardized interface for automatized workflows. This architecture enables enhanced malware examination while maintaining the security of the analysis environment.

Awesome Malware Persistence is a curated repository that compiles tools and resources related to malware persistence techniques across various platforms, including Windows, Linux, macOS, and cloud systems. Its primary use case is to provide cybersecurity professionals with insights into how adversaries maintain system access through various persistence methods, as well as strategies for detection, prevention, and removal of these threats. Notable features include a comprehensive categorization of persistence techniques and relevant forensic tools, linked to established frameworks such as MITRE ATT&CK.

PwnRM is an advanced WinRM post-exploitation tool designed for conducting authorized security assessments in Windows Active Directory environments. It features an interactive PowerShell runspace, support for various authentication methods, stealthy payload delivery, and a built-in Active Directory triage engine, enabling users to perform a wide range of assessment tasks through a command-line interface as well as via a Python library. Notable functionalities include file transfer capabilities, remote command execution, and comprehensive AD enumeration and session management features.

Offensive File Transfer Techniques is an extensive guide designed for transferring files to and from target systems during security engagements, emphasizing staging payloads and exfiltrating data. It covers a diverse range of transport mechanisms, including HTTP, SMB, FTP, TFTP, and more obscure methods like base64 encoding, while also providing detection and defense mappings for each technique. The tool features organized notes with ready-to-use commands for both client and server setups, ensuring comprehensive coverage of file transfer methods in offensive security contexts.

Offensive Windows Privilege Escalation is a comprehensive guide designed for escalating privileges from a low-privileged Windows environment to Administrator or SYSTEM level, utilizing various techniques such as service misconfigurations, registry exploits, UAC bypass, and token-privilege abuse. The tool emphasizes an offensive security methodology, offering over 75 structured notes complete with hands-on exploitation and detection guidance, alongside ready-to-use commands and methodology checklists. It serves as an educational resource exclusively for authorized testing scenarios, ensuring ethical use in cybersecurity practices.

Consortium is a modern, extensible command and control (C2) framework that supports both asynchronous multi-client interactions and language-agnostic listener-agent designs, enabling users to develop custom agents and listeners efficiently. Key features include a robust REST API for automation, role-based access control for user management, and modular architecture that allows for extensive customization and collaboration among users. Currently in the alpha phase, the framework emphasizes a high degree of flexibility while still under rapid development.

AWINRM is an advanced WinRM post-exploitation framework designed specifically for red teams and offensive research, implemented in Ruby. Its primary use case revolves around facilitating efficient post-exploitation activities with features like built-in tool staging, automated AMSI/ETW bypasses, stealth file transfers, and automatic loot extraction, addressing common challenges encountered in traditional WinRM tools. The framework provides a streamlined operator-centric workflow that enhances operational security and supports automated reconnaissance and credential gathering.

Zombieland is a browser-based command and control (C2) dashboard frontend designed for educational and authorized penetration testing research. It features mock agent management with grid and list views, a global console for broadcasting commands, and a modular UI that supports customization and enhanced visual effects. The tool is currently in development for backend and agent components, aiming for cross-platform compatibility and improved user management in future releases.

The A-Pythonic-Keylogger is a Python-based keylogger designed for educational purposes that captures keystrokes, logs them to a local file, and can send the logs via email. Notable features include robust email retry handling, automatic session restart after key capture, and platform compatibility with both Linux and Windows. The tool incorporates local log management by clearing logs after the session ends, ensuring data retention only during active capture.

This tool is a Python-based keylogger designed for educational purposes, capable of capturing keystrokes and sending the recorded logs via email. It features local log management, an email retry mechanism for reliable delivery, and automatic startup configurations for both Linux and Windows systems. Users are cautioned to run the script only on systems they own or have explicit permission to test, as it demonstrates sensitive functionality.

OBLITERATUS is an advanced red teaming framework designed for post-exploitation research and defensive evasion in Windows environments. It features a multi-layered stealth architecture for evasion, low-level syscall execution, and identity correlation through its Identity Nexus module, allowing for the bypassing of MFA and efficient credential management. Key capabilities include memory hardening, automatic UAC elevation, and a sophisticated operational interface that facilitates real-time process management and forensic analysis.

IDA-minsc is a plugin for IDA Pro designed to streamline the scripting of the IDAPython plugin, allowing reverse engineers to execute scripts with minimal effort. It introduces a simplified structure for the IDAPython API, featuring a tagging system, support for multicased functions, and filtering capabilities, enabling users to perform search and annotation tasks efficiently with concise code. The installation process is straightforward, requiring the user to clone the repository and install necessary Python dependencies before utilizing its enhanced functionality directly within IDA Pro.

RobustPentestMacro is a versatile Visual Basic macro designed for penetration testing, allowing testers to embed sophisticated post-exploitation techniques into Microsoft Office documents. Key features include platform detection for Windows and MacOS, sandbox evasion mechanisms, WMI persistence for automatic execution at startup, and social engineering tactics to obscure malicious behavior. The macro facilitates easy customization by enabling users to insert tailored payloads through defined functions for both operating systems.

DynastyPersist is a Linux persistence tool designed for use in King of the Hill (KoTH), Battlegrounds, and penetration testing operations. Notable features include automated SSH key generation, cronjob setup for scheduled tasks, custom user creation with root privileges, remote code execution capabilities, and manipulation of system services for covert access. This multi-faceted tool streamlines the establishment and maintenance of persistence in compromised systems.

pickleDB is an in-memory Python key-value store designed for high performance and asynchronous operations, leveraging the `orjson` module. It provides a simple interface for storing and retrieving data, making it suitable for applications requiring fast access to key-value pairs. Notable features include its ease of use, lightweight design, and support for JSON file persistence.

The `ios_persistence_mapping` tool enables the mapping of iOS persistence attack surfaces using data extracted from mounted iOS filesystems. Its primary use case is to facilitate analysis for security researchers by generating a unique operations list, which is then imported into Neo4J for visual representation and querying. Notable features include support for custom configurations, integration with Neo4J databases, and the ability to analyze iOS firmware by processing root filesystem contents.

PotatoDB is a lightweight, JSON-based NoSQL database for Python, designed for simple data management tasks such as creating, inserting, querying, updating, and deleting records. Its notable features include a user-friendly setup with no external dependencies, in-memory operations for improved performance, automatic data persistence, and a dynamic schema allowing flexible data models. Ideal for small projects and educational purposes, PotatoDB utilizes Python's built-in JSON module for seamless data handling.

`mimikittenz` is a post-exploitation PowerShell tool designed for extracting sensitive data, including plain-text passwords and various types of private information, from the memory of running processes using the Windows `ReadProcessMemory()` function. It supports a wide range of data extraction, including webmail credentials, financial application data, and more, employing customizable regular expressions for targeted information retrieval. Notable features include the ability to target specific processes and the flexibility for users to add custom regex patterns for further data extraction needs.

SharpStay is a .NET-based tool designed for maintaining persistence on Windows systems through various techniques, including elevated and non-elevated registry keys, scheduled tasks, and WMI event subscriptions. Its notable features include the ability to create services, manipulate shortcuts, and perform tasks such as listing scheduled tasks and running services, making it effective for both administrative and security testing purposes. It is a component of the larger StayKit framework, enabling users to effectively manage persistence mechanisms in their environments.

nysm is an eBPF stealth container designed to facilitate the post-exploitation of systems by making offensive tools undetectable to system administration utilities. It achieves this by obscuring new eBPF programs, audit logs, PIDs, and sockets from tools like bpftool, ps, and auditd. Key features include the ability to run commands in a hidden context, with options for background execution and self-destruction after use.

TripleCross is a Linux eBPF rootkit designed to illustrate the offensive capabilities of eBPF technology, developed as part of an academic thesis. Its primary use case involves demonstrating various malicious functionalities including library injection, execution hijacking, local privilege escalation, and stealth operations, all while maintaining a backdoor with command-and-control capabilities. Notable features include persistence across reboots and multiple methods for remote command execution, showcasing advanced techniques for evasion and control.

Active-Directory-Exploitation is a comprehensive PowerShell-based toolkit designed for conducting penetration testing and security assessments on Active Directory environments. Its primary use case is to enumerate domains, escalate privileges, enable lateral movement, and achieve persistence through various methodologies, including Kerberos ticket manipulation and exploitation of SQL Server trusts. Notable features include extensive modules for local and domain privilege escalation, detailed methods for lateral movement and persistence, and capabilities for cross-forest attacks.

Flanders-Trojan is a Windows-based trojan developed for academic purposes that employs C++ and consists of three main components: a Loader for initial setup and privilege escalation, a Payload for executing various malicious actions (such as file encryption, keylogging, and DDoS attacks), and a Server that functions as the command and control center for managing infected devices. Notable features include VM detection, UAC bypass, and real-time communication with a C2 server, highlighting its capabilities in orchestrating cyberattacks and gathering sensitive information.

Golden dMSA is a cybersecurity tool that facilitates the exploitation of delegated Managed Service Accounts (dMSAs) through the "Golden DMSA" attack, allowing unauthorized password generation for dMSAs offline. Key features include the ability to extract KDS Root keys, enumerate dMSA accounts, guess ManagedPasswordIDs, and generate valid passwords, making it a potent tool for penetration testing and security assessments of systems with vulnerabilities in dMSA authentication. The tool is built for .NET Framework 4.7.2 and includes functionalities for password conversion, information gathering on dMSAs and KDS keys, as well as brute force password attacks.

AIX-for-Penetration-Testers is a comprehensive enumeration guide designed for penetration testers and red team operators focusing on AIX systems. Its primary use case is to facilitate the security assessment of AIX environments through detailed methodologies and tools for effective system enumeration. The repository serves as a collaborative platform for knowledge sharing, allowing users to contribute to the evolving guide.

Apollo is a lightweight Remote Access Tool (RAT) developed in Python, designed for post-exploitation tasks, enabling remote code execution and system information retrieval across multiple platforms including Windows, Linux, FreeBSD, and macOS. Key features include AES-256 encrypted communication, support for handling multiple clients simultaneously, basic port scanning capabilities, and functionality to eradicate traces of its presence on the client system.

Auto-PostXploit is a Windows post-exploitation tool designed for Red Team operations, facilitating immediate system reconnaissance following an exploit. Its primary use case involves executing post-exploitation actions on compromised systems using Meterpreter, enabling security professionals to gather critical system information efficiently. Notable features include the ability to upload and execute scripts on target systems and automate information gathering, aiding in the assessment of security postures.

Credit-Card-Bruteforcer is a security testing tool designed to exploit vulnerabilities in credit card systems by attempting to generate valid Primary Account Numbers (PAN) using partial hashes and a set of random PINs. The tool's primary use case is to assess the strength of credit card security measures, while its intentionally incomplete functionality indicates it is intended for educational or testing purposes rather than practical exploitation.

DNS-Persist is a post-exploitation agent utilizing DNS for command and control, primarily designed for persistence in compromised systems. It features multiple persistence mechanisms including LogonScript, RunKey, and Excel Addin persistence, as well as the ability to execute commands via a pseudo-interactive shell and inject 32-bit shellcode. The tool is built with a Python server-side and a C++ agent, with plans for future enhancements including additional persistence options and encryption capabilities.

Ed is a tool designed for identifying and exploiting accessible UNIX Domain Sockets, particularly useful for locating exposed Docker.sock instances that may not be mounted in their default locations. Notable features include the ability to hunt for various types of UNIX domain sockets, perform autopwn actions, and return output in JSON format, making it suitable for both security testing in DevOps processes and integration into CI/CD pipelines.

Efes is a proof-of-concept tool that utilizes built-in speech recognition to detect and record specific keywords from spoken audio, saving the snippets for potential exfiltration. Its primary use case is in post-exploitation scenarios where capturing high-value data passively is critical. Notably, it records only short audio segments to minimize file size while focusing on relevant information.

A flexible cross-platform post-exploitation agent written in Go with basic functionalities

The LDAP-credentials-collector-backdoor-generator is a malicious tool designed to create backdoor scripts that log LDAP user credentials during HTTP basic authentication. Its primary use case involves injecting the generated backdoor into a target web application to capture sensitive username and password information from users who access the site. Notable features include customizable backdoor filename generation and the ability to store captured credentials in a file for easy retrieval by the attacker.

LinPwn is an interactive post-exploitation tool designed for enumerating information and facilitating privilege escalation on compromised Linux machines. Key features include executing shells, reading files, running scripts like LinEnum.sh for enumeration, downloading files, and extracting system password hashes and saved Wi-Fi credentials. This tool is essential for security professionals conducting penetration tests to assess vulnerabilities post-exploitation.

MacOS-WPA-PSK is a proof-of-concept script that demonstrates how macOS stores the wireless network key in plaintext within NVRAM, rendering it accessible without root privileges. This tool highlights the risks associated with the management of sensitive credentials in macOS, serving as a reminder that users should be aware of the non-secure treatment of such information. The script operates using Python and has been tested across specific versions of macOS.

The msf-auxiliarys repository contains a collection of custom Metasploit auxiliary post-modules designed for post-exploitation tasks. Its primary use case is to enhance the capabilities of Metasploit by providing additional functionalities that facilitate common post-exploitation procedures. Notable features include ease of installation and integration with the Metasploit database, making it a valuable resource for security professionals.

Poet is a post-exploitation tool that facilitates remote control and management of compromised machines through a client-server architecture. It allows attackers to perform various operations on the target, such as reconnaissance, file exfiltration, remote execution, and self-destruction of the client. Notable features include a control shell for executing commands, automatic reconnection capabilities, and the ability to remove traces post-exploitation.

The Post-Exploitation tool facilitates advanced post-exploitation tasks within PowerShell environments, primarily aimed at improving threat actor capabilities during penetration testing and red teaming exercises. Notable features include modular payload execution, session management, and comprehensive system enumeration capabilities to leverage discovered information effectively.

PostShell is a post-exploitation tool designed to facilitate advanced shell access through both bind and backconnect methods, enabling attackers to maintain an interactive TTY session with job control while remaining stealthy. Notably, it features cloaked process names to minimize detection, a compact stub size of less than 14kb for easy deployment on Unix-like systems, and built-in anti-debugging mechanisms to enhance resilience against analysis. The tool's design allows for operation in environments with limited dependencies, improving post-exploitation flexibility.

A modular pentesting framework implemented in C

The "presentations" repository contains a collection of PDF files showcasing various presentations. Its primary use case is to serve as a portfolio of educational content, presumably focused on cybersecurity topics. Notable features include accessibility as PDFs, allowing for easy distribution and review of the material.

punk.py is a post-exploitation tool designed for network pivoting from compromised Unix systems, facilitating the collection of usernames, SSH keys, and known hosts to establish SSH connections across discovered combinations. It supports both Python 2 and 3, features options for custom execution, password bypass, command execution with sudo, and the capability to crack hashed known hosts, making it versatile for penetration testing and exploitation scenarios.

RSPET (Reverse Shell and Post Exploitation Tool) is a Python-based framework designed for executing remote commands and facilitating post-exploitation activities in penetration testing scenarios. Notable features include TLS encryption for secure server-client communication, built-in file and binary transfer capabilities, support for managing multiple hosts, and a modular code design that allows for extensive customization and plug-in management through a RESTful API.

Soapy is a post-exploitation tool designed to facilitate stealthy operations within a compromised system by creating a container that hosts a root terminal shell while monitoring and scrubbing log files. Its primary use case involves executing commands to extract sensitive information such as hashes and IP addresses, map the network, and perform other tasks without detection. Notable features include the ability to specify custom log file paths, delete files from specified directories post-session, and operate with minimal user prompts.

Zombie Ant Farm is a toolset designed for offensive security practitioners to enhance evasion techniques against Linux Endpoint Detection and Response (EDR) systems. Its primary use case involves facilitating the development of custom offensive strategies through features such as distributed payload warehousing, in-memory payload delivery, and ASLR weakening shims, making it suitable for advanced penetration testing and research. The kit includes various components such as preloaders, evasion primitives, and a warehouse service, providing a modular approach to offensive operations.

AdbNet is an exploitation tool designed for identifying and compromising vulnerable Android devices across the globe. Key features include post-exploitation modules, device scanning functionalities, IP address management, and integration with APIs from Censys and Shodan for discovering susceptible devices. Users can connect to these devices through common ports, execute commands, and utilize various exploits to gain control over the target systems.

AtlasC2 is a C# command and control (C2) framework designed for Stage 1 operations, primarily used for establishing footholds within Windows environments and executing C# payloads through HTTP-based implants. Notable features include the ability to manage listeners, connect to multiple implants, execute system commands via PowerShell or CMD, and dynamically load C# assemblies into memory, making it a potent tool for post-exploitation scenarios despite current OPSEC limitations.

autoMetasploit is a Ruby script designed to streamline the processes of scanning, exploiting, and conducting post-exploitation activities with Metasploit. It automates key tasks by requiring configuration of plugins and supports report generation by integrating with external templates and email functionalities. Notable features include customizable brute force scripts, LDAP user enumeration capabilities, and the ability to send PDF reports via email.

Awesome Malware is a curated repository of various malware, botnets, and post-exploitation tools designed for research and educational purposes. It offers extensive categories such as analysis tools, banking trojans, C2 frameworks, credential stuffing checkers, and more, enabling users to explore and understand malicious software dynamics. Noteworthy features include a focus on free software projects and the inclusion of both historical and contemporary malware resources for comprehensive analysis.

AWSATT&CK is a modified version of the open-source AWS exploitation framework, Pacu, designed to add MITRE ATT&CK context to its tactics and enhance logging capabilities. This tool is primarily used for post-exploitation within AWS environments, featuring quick execution functions, event logging to SIEM solutions, and scalability enhancements to streamline security operations. Notable features include the integration of MITRE ATT&CK techniques, agile deployment options, and a focus on flexibility for security professionals tackling diverse IT and cloud-native challenges.

Bella is a potent post-exploitation and remote administration tool designed specifically for macOS, leveraging Python for high-level automation and ease of use. Its primary use case involves establishing SSL/TLS encrypted reverse shells to facilitate comprehensive data extraction, including passwords, system information, and iCloud services, while offering features like multi-user support, reverse VNC connections, and extensive logging capabilities. Notably, Bella can gain root access to expand its functionalities and maintain persistent control over the target system, all while operating undetectably.

Bifrost is an open-source command and control (C2) tool implemented as a Discord bot, allowing users to manage and communicate with compromised clients through the Discord API. It supports multiple platforms and provides features such as keylogging, antivirus enumeration, real-time encrypted communication, and file management capabilities. Designed for educational and authorized security testing purposes, Bifrost leverages the Discord infrastructure to maintain a stealthy connection with clients.

The C2 Server is a Command and Control framework that enables attackers to manage compromised target machines through a reverse shell connection. It supports various commands for file management, directory navigation, and even malicious functions like keylogging and credential spoofing, enhancing the attacker's ability to interact with the victim's system. Written in Python, it provides a user-friendly interface for executing predefined commands and extracting sensitive information from infected devices.

The Cobalt Strike Aggressor Script Collection provides a set of scripts designed to enhance post-exploitation capabilities within the Cobalt Strike framework. Key features include techniques for privilege escalation, persistence, and situational awareness, along with accessible notes that facilitate streamlined operations during engagements. This tool is primarily used by security professionals for advanced exploitation and operational efficiency in red team scenarios.

Covermyass is a post-exploitation tool designed for penetration testers to securely delete log files across multiple operating systems, including Linux, macOS, and Windows. It enables users to identify and overwrite log files with random data to obscure their activities before exiting a compromised server. Notable features include multiple overwrite iterations and the ability to handle file permissions, ensuring thorough data eradication.

Coyote is a C# post-exploitation implant designed for maintaining access to compromised Windows systems during red team operations. Its notable features include bypassing application whitelisting through InstallUtil.exe, utilizing a recursive DNS tunnel to retrieve encrypted commands, and maintaining a small footprint on both memory and network resources. The tool leverages a DLL that periodically polls a DNS TXT record for remote instructions, allowing operators to execute various payloads, such as spawning a reverse shell, while potentially evading detection.

Crowbar is a comprehensive Windows post-exploitation tool designed to facilitate various tasks such as privilege escalation and system command execution via PowerShell. It includes an extensive range of scripts and utilities, notably the 'Hail Mary' feature for launching multiple scripts simultaneously, and checks for the presence of Windows Subsystem for Linux on the target machine. The tool is actively maintained, with regular updates that introduce new scripts and enhancements to improve functionality.

DeathNote is a penetration testing cheat sheet tool that provides a collection of resources and techniques essential for conducting security assessments. Its primary use case is to streamline the penetration testing process by offering organized references for various attack vectors, including reverse shells, PowerShell exploits, Active Directory, brute-forcing, and persistence methods. Notable features include compatibility with both Python 2.7 and 3.7, straightforward installation, and customizable configurations.

DecryptRDCManager is a .NET tool designed to decrypt credentials stored in Remote Desktop Manager (.rdg) files, leveraging the functionality of RDCMan.DLL. Its primary use case is to extract and read encrypted user credentials, particularly those contained within the more reliable `<credentialsProfile>` section, while also providing an option to automate file detection via user settings. Notable features include the ease of building the tool and its ability to handle paths for .rdg files seamlessly, along with a focus on credential profile extraction for enhanced reliability.

Enumy is a high-performance enumeration tool designed for penetration testing and Capture The Flag (CTF) challenges, facilitating the identification of common security vulnerabilities on target Linux machines. Its features include configurable scan options, the ability to output results in various formats, and support for multithreaded operations to optimize scan speed and efficiency. Suitable for both professional pentesters and hobbyists, Enumy assists users in uncovering security issues during post-exploitation phases.

Evasor is an automated security assessment tool designed for Windows that identifies executables with potential vulnerabilities for bypassing Application Control rules. It offers features such as locating processes vulnerable to DLL Injection and DLL Hijacking, as well as generating detailed assessment reports inclusive of descriptions, screenshots, and mitigation suggestions. This tool caters to both blue and red teams, enhancing efficiency during the post-exploitation assessment phase.

FudgeC2 is a PowerShell-based command and control (C2) platform that enhances collaborative red teaming by providing an organized structure for managing campaigns and implants. It features a web-based interface that allows operators to easily deploy and control various implants, execute commands, and gather system information, with support for custom modules and a range of built-in commands such as persistence and file manipulation. Designed for active development, FudgeC2 aims to improve understanding of adversarial techniques through detailed reporting and campaign timelines.

HackingComm is a user-friendly penetration testing tool designed for individuals with limited terminal command knowledge. It simplifies common pentesting tasks on Kali Linux through a straightforward interface, allowing users to easily input required parameters while executing commands. Notable features include an installation script, guided prompts for user inputs, and reliance on Python for functionality, making it accessible for beginners in cybersecurity.

iPwn is a framework specifically designed for the exploitation of jailbroken iOS devices, enabling users to gain access and extract sensitive information. It incorporates a post-exploitation tool named 'iSteal', which offers various modules for information harvesting and management, including SSH brute-forcing capabilities using common credential wordlists. Notably, the framework is still under development, with ongoing enhancements for easier payload management and integration with existing iOS tweaks.

Leprechaun is a penetration testing tool that facilitates the identification of valuable targets within an internal network by aggregating netstat results from multiple hosts. Its primary use case involves analyzing network traffic connections to uncover potential vulnerabilities and traffic patterns, and it features command-line options to specify output files, ports of interest, and IP address types. Notable features include the ability to output detailed connection statistics organized by server and traffic destination ports, enhancing visibility for security assessments.

mOrc is a post-exploitation framework specifically designed for macOS, developed in Bash. Its primary use case is to facilitate post-exploitation activities by providing a shell environment that minimizes traceable artifacts, such as disabling the history file and preventing core dumps. Notable features include its integration as an ENV script and its capability to execute various post-exploitation commands securely.

mythic-crate is a development environment for the Mythic Command and Control (C2) framework, designed to run on Ubuntu 18.04 using VirtualBox and Vagrant. It automates the setup of Mythic dependencies, facilitates port forwarding, and enables folder sharing between the host and guest systems. Notable features include SSH access, streamlined administration via host commands, and the ability to customize VM disk size.

NTLMX is a post-exploitation tool designed for extracting local NTLM user password hashes from the Windows registry, supporting both modern AES-128-CBC techniques introduced in Windows 10 and traditional MD5/RC4 methods for earlier versions. The tool requires SYSTEM privileges to operate and can be easily installed via PowerShell Gallery or from the GitHub repository. It has been validated on multiple Windows versions, ensuring compatibility across various PowerShell environments.

OffensiveAutoIt is a collection of proof-of-concept scripts leveraging AutoIt v3 for offensive security purposes, focusing on UI automation and the execution of external code. The repository includes features for compiling scripts into standalone executables, decompiling AutoIt binaries, and obfuscating scripts, facilitating the development of malware and tradecraft research. Its notable use cases involve executing PowerShell and .NET assemblies while bypassing security mechanisms like AMSI and ETW.

OffensivePH is a post-exploitation tool designed to bypass user-mode access controls using an outdated Process Hacker driver. Its primary use case is to execute shellcode or terminate processes, enabling actions such as process hijacking and API call redirection through DLL injection. Notable features include a standalone executable for process management, integration for shellcode injection, and automatic cleanup of its driver after execution.

Orc is a post-exploitation toolkit designed for Linux environments, implemented in Bash. It provides a variety of functions for privilege escalation, system enumeration, and network analysis, while ensuring output is concealed by using a temporary directory that is auto-deleted on exit. Notable features include functionalities to check Docker access, list D-Bus services, and exploit known vulnerabilities, making it a versatile component for offensive security operations.

PEH (Post Exploitation Helper) is a script designed to facilitate the downloading of common post-exploitation tools onto a target machine with minimal commands. Its primary use case is to operate on machines lacking internet access, allowing users to specify tool files and network interfaces for resource acquisition. Key features include flexible file input, configurable network interface and port options, and straightforward usage through command-line commands.

PentaDrone is an asynchronous PowerShell post-exploitation agent designed for red teaming and penetration testing, utilizing the Mitre Att&ck framework for automation through an autopilot mode. It allows security researchers to simulate HTTP loader-style botnets, facilitating malware research while providing extensive configurability for command-and-control server connections and agent behavior. Notable features include various persistence methods, USB spreading options, and customizable operational parameters.

Powerexploit is a PowerShell-based exploitation framework designed to facilitate offensive post-exploitation tasks in Windows environments. It enables security professionals to automate the process of gaining and maintaining access to targets, quickly exfiltrating sensitive information, and leveraging vulnerabilities within the system. Notable features include a modular architecture for plugins, support for various attack vectors, and inherent obfuscation techniques to evade detection by security tools.

PXEnum is a shell script designed for automated post-exploitation enumeration on *NIX systems, facilitating the collection of essential system and network information to aid security assessments. It executes a comprehensive set of checks related to user, hardware, BIOS, network activity, and permissions, providing an organized output of findings, while ensuring compatibility across various Unix-like environments. Notable features include the ability to read directly from system files for improved reliability and the streamlined output format for enhanced readability.

rpc2socks is a client-server solution designed to establish a SOCKS5 proxy tunnel through a custom RPC and SMB connection for remote execution and communication between Unix or Windows hosts and Windows targets. The tool leverages a dedicated named pipe for communication, supports DNS resolution, and operates without authentication by default, making it suitable for establishing secure tunnels on networks where direct connectivity may be restricted. Notably, the client is a Python package while the server is a statically-linked C++ console application compatible with both 32-bit and 64-bit Windows environments.

SBD is a script designed to provide users with access to essential Linux utilities on compromised systems, including the ability to deploy BusyBox and download static binaries for various networking tools like Ncat, Socat, Nmap, and Ngrok. Its primary use case is to enhance functionality on a limited or compromised environment by offering a menu-driven interface for managing these utilities. Notable features include the ability to set output directories for downloads, clean up downloaded files, and a straightforward installation process using available commands like `wget` or `git`.

Sharp Login Prompt is a cybersecurity tool designed to create a phishing login interface that captures the username and password of the current user without interacting with lsass or requiring administrative credentials. Its primary use case is for red team assessments, allowing security professionals to simulate phishing attacks. Notable features include customizable headings and subheadings for the login interface, enhancing the deception in social engineering scenarios.

Shennina is an automated host exploitation framework that leverages Artificial Intelligence for comprehensive scanning, vulnerability analysis, and exploitation of target systems. Integrated with Metasploit and Nmap, it features a self-learning AI engine for identifying exploits, supports post-exploitation capabilities, and automates data exfiltration while covering over 40 techniques from the MITRE ATT&CK framework. Notable features include heuristics mode for exploit recommendations, high concurrency performance, and cross-platform support for various operating systems.

sudo_sniff is a discreet tool designed for post-exploitation scenarios to capture user passwords when executing the sudo command by manipulating the user's `$PATH`. It functions by hijacking the sudo execution to record both successful and failed password entries, storing them in a specified temporary file. Notable features include the ability to adapt to different system configurations for sudo and potential enhancements for stealthier operation.

swap_digger is a Bash script designed for automating the analysis of Linux swap space for post-exploitation and forensic purposes. It extracts sensitive information such as user credentials, web form credentials, and WiFi keys from the swap area, and offers extensive options for customization, including extended searches and optional logging. The tool is especially useful in penetration testing scenarios and can operate on local or mounted swap devices.

TokenPlayer is a tool designed for manipulating and abusing Windows access tokens, focusing on the Win32 API. Its primary use case includes stealing and impersonating tokens, bypassing User Account Control (UAC) via token duplication, and creating new tokens for network authentication without elevated privileges. Notable features include the ability to execute applications under an impersonated context, spoof parent process IDs, and operate within non-interactive environments, making it suitable for various privilege escalation and security testing scenarios.

Ghost Framework is an Android post-exploitation tool that leverages the Android Debug Bridge for remote device administration. It provides a user-friendly interface to execute various remote management tasks such as accessing the device shell, installing applications, capturing screenshots, and managing device settings. Notable features include password removal capabilities and comprehensive system information retrieval.

Agent Loader is a modular command-and-control (C2) tool designed to facilitate the deployment of in-memory payloads and covert operations through a DNS-over-HTTPS channel. Its notable features include dynamic function encryption, a reverse-shell module, and extensive file system management capabilities, alongside a customizable CLI builder for creating tailored implants via Python. The tool also offers a Node.js web panel for interactive management, showcasing a bot list and persistence mechanisms through OneDrive and Task Scheduler.

Alan Framework is a post-exploitation framework designed for red-team activities, enabling advanced functionality such as in-memory tool execution and encrypted communication. It supports multiple agent types including Powershell, DLL, and executable formats across different architectures and operating systems, with a powerful command shell and real-time agent configuration updates. Notable features include a fully compliant SOCKS5 proxy, JavaScript execution capabilities, and a lack of external dependencies, making it suitable for stealthy operational tasks.

Ant is a post-exploitation tool designed to automate the deployment of tunnels and port forwarding over a specified network topology using configuration files. Key features include support for WMI, WinRM, and SMB protocols, along with four main commands—deploy, desinfect, redeploy, and probe—that facilitate topology management. The tool also includes validation for configuration file accuracy and allows comments for better user guidance.

AntiForensic.NET is a lightweight library designed for Windows that facilitates the eradication of forensic trace logs from a computer system. Its primary use case involves implementing various anti-forensic techniques to ensure user privacy by removing artifacts such as application logs, event logs, and cached data. Notable features include the automatic deletion of numerous types of logs and cache files, including Recycle Bin contents, recent items, and compatibility logs, thereby aiding users in evading potential tracing.

awesome-cyber is a curated repository that aggregates a diverse range of cybersecurity tools catering to red, blue, and purple team operations. This resource aims to provide an up-to-date collection of tools across various cybersecurity domains, including offensive and defensive techniques, forensics, and incident response. Notable features include organized categories for easy navigation and an open invitation for community contributions to keep the toolset relevant.

C_keylogger is a stealthy keylogging tool developed in C for Windows that utilizes a traditional approach to log keystrokes without relying on WinAPI hooks. It features persistence, remote activation, a stealth handler to hide the Command Prompt window, and efficient memory management through variable reuse. The tool is designed for educational purposes in a controlled lab environment, requiring specific amendments before compilation to ensure connectivity.

C2KepExec is a Command and Control (C2) server designed to manage a BotNet of machines running a Remote Administration Trojan and is developed for educational purposes. Its notable features include remote keylogging, file management capabilities (uploading and downloading), integrated session control for multiple targets, and persistent infection techniques on Windows systems. The tool also allows for advanced monitoring functions such as screen captures and webcam access.

C2PE is a tool designed for Red Team operations, focusing on Command and Control (C2) capabilities and post-exploitation activities. It features experimental code implementations suitable for hacking scenarios, allowing users to deploy C2 infrastructures and manage compromised systems effectively. The tool is developed in Python and Go, ensuring cross-platform compatibility and adherence to PEP8 code standards.

Clipboard-Hijacker is a post-exploitation payload designed for penetration testing that monitors and captures clipboard data on a target machine. It automatically sends captured clipboard contents, which may include sensitive information, to a specified web server or webhook every 10 seconds, while also optionally logging data locally. Notable features include the ability to modify clipboard contents and error handling mechanisms for reliable data transmission.

The csharp_reverse_shell is a proof-of-concept tool for executing reverse shell operations in C# that supports SSL/TLS encryption and various evasion techniques. Its primary use case includes providing a stealthy command execution environment with features such as a no-visible-window mode, dual operation modes for interactive shell and shellcode execution, and advanced evasion strategies like AMSI and ETW bypassing. Notable functionalities include silent error handling and selective unhooking of system calls to avoid detection.

DFEX is a tool designed for DNS-based data exfiltration, leveraging the DNS protocol to transmit files across networks while circumventing traditional firewalls. Its primary use case is in post-exploitation scenarios, employing unique tactics to outsmart advanced firewalls, including techniques that disguise data transfers in plain sight. Notable features include a dual-client and server architecture, and compatibility with Python environments to facilitate easy installation and setup.

DNS Tunnel Keylogger is a post-exploitation tool designed to covertly exfiltrate keystrokes via DNS tunneling, allowing for lightweight and persistent data exfiltration while minimizing detection risks. The tool features separate components for Linux and Windows, employing bash scripts and a compiled executable respectively, along with a server setup that listens on UDP port 53 by default. Notably, it can send keystrokes silently and can be configured for automatic startup in interactive shells to maintain persistence.

ExtractBitlockerKeys is a post-exploitation script designed for system administrators to automate the extraction of BitLocker recovery keys from a domain. It features multithreaded LDAP connections to retrieve data from domain controllers, supports pagination for large domains, and allows for exporting results in various formats, including JSON, XLSX, and SQLite3. This tool is essential for managing BitLocker recovery information in a secure and efficient manner.

GOD-OF-RAT is an advanced Python Remote Access Trojan (RAT) framework designed for authorized penetration testing, offering extensive control over compromised systems. Its notable features include live screen controlling, credentials harvesting from various sources, an interactive agent builder with encryption capabilities, and advanced evasion techniques. The framework also supports remote shell access, file system management, and a suite of fun modules for additional functionalities.

GTFOBins CLI is a command-line tool designed for security professionals to quickly access and search for Unix binary exploitation techniques. It features capabilities such as fuzzy searching, filtering exploitation types, and an interactive mode for ease of navigation, all while providing an offline database for fast, local access. The tool supports cross-platform usage and enhances readability with syntax highlighting, allowing for efficient identification of security bypass methods.

The Hacker Road Map repository provides a comprehensive overview of resources and tools necessary for learning penetration testing and practicing ethical hacking. It features a categorized collection of UNIX-compatible, free, and open-source tools, along with guidance on essential concepts, basic steps of penetration testing, and additional educational materials to support newcomers in the field of information security. Notably, the project has been archived, indicating that the content may be outdated as a new initiative is anticipated to replace it.

HVNC is a remote administration toolkit designed for red-team operators, enabling covert access to an invisible Windows desktop without user awareness. Its primary use case is to facilitate stealthy remote operations by creating a hidden session that processes actions off-screen and communicates with the operator via VNC-like commands, supporting functionalities such as file transfers, keylogging, and launching applications. Notable features include simultaneous session handling in separate console windows and a clean-up script for system hygiene post-usage.

KitsuneC2 is a pure-Go adversary emulation framework designed for security testing, providing both a web and CLI interface for user interaction with implants. Its notable features include dynamic implant generation, in-memory execution of shellcode, and malleable C2 traffic, making it a versatile tool for organizations aiming to evaluate their cybersecurity defenses. However, it is not intended for professional engagements as there are more mature frameworks available.

LOLSpoof is an interactive shell program designed to spoof command line arguments of spawned processes, specifically targeting 64-bit LOLBins. Its primary use case is to obscure such processes from detection by telemetry solutions used by antivirus, endpoint detection and response (EDR) systems, and security analysts. Notable features include the ability to craft a spoofed command line, the manipulation of process creation telemetry, and the handling of suspended processes to override command line parameters.

MagikIndex is an advanced keylogger designed for stealthy data capture, boasting a low detection rate and various persistence mechanisms. It retrieves logged information via email, supports clipboard monitoring, and can capture screenshots with configurable modes while encrypting logs for security. Notable features include an auto-update capability, extensive system information logging, and a customizable architecture for tailored functionality.

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

The Metasploit-Tutorial repository provides comprehensive guidance on utilizing the Metasploit framework, a robust open-source toolset designed for network enumeration, vulnerability identification, and exploit development. Users can learn key functionalities such as exploit execution, payload creation, and post-exploitation techniques through detailed sections covering various components and workflows of Metasploit. Notable features of the tutorial include practical exercises with modules, sessions, and Meterpreter commands, enabling hands-on experience with real-world cybersecurity tasks.

MsfMania is a Python-based payload obfuscation framework primarily aimed at evading endpoint detection and antivirus systems on Windows platforms. It boasts notable features such as dynamic code generation, multi-layer encryption using RC4, local memory injection, and extensive metadata spoofing, making it suitable for authorized security testing and research activities.

pE is a comprehensive post-exploitation framework designed for offensive security operations, focusing on practical techniques and tool development across multiple programming languages including Bash, Python, C, and Go. It offers a structured roadmap for activities such as credential access, lateral movement, persistence techniques, and data exfiltration, alongside custom script creation and defense evasion strategies. Key features include detailed sections on host enumeration, Active Directory abuse, and environmental setup, aimed at enhancing the effectiveness and efficiency of post-exploitation efforts.

PivotSuite is a network pivoting toolkit designed for Red Teamers and penetration testers, enabling the movement within a compromised network using either forward or reverse connections. Notable features include support for TCP tunneling, SOCKS5 proxies, and various network enumeration functions, all without requiring administrative access on the compromised host. The tool operates independently of installation requirements, utilizing only Python's standard libraries, making it versatile across different platforms and environments.

Powtel is a remote system control tool designed for Windows environments, utilizing PowerShell and Telegram as its communication interface. Its primary use case is for authorized security testing and post-exploitation activities, providing features such as task scheduling, file upload/download capabilities, and screenshot functionality. The tool emphasizes ethical usage, aiming to aid cybersecurity professionals and researchers in controlled settings.

PyADRecon is a Python-based tool designed for gathering comprehensive information from Microsoft Active Directory environments, catering to the needs of penetration testers and blue teams. It supports NTLM and Kerberos authentication methods, can generate XLSX reports, and offers an HTML dashboard for visualizing collected data, making it a versatile resource for Active Directory reconnaissance. Additionally, it provides options for standalone report generation from CSV files, enhancing its usability in various assessment scenarios.

PyExfil is a Python-based tool designed for stress testing the detection capabilities of security systems against various exfiltration and communication techniques employed by threat actors. It allows users to deploy multiple experimental and stable exfiltration methods, such as DNS queries, HTTP cookies, and ICMP packets, enabling organizations to evaluate their defenses. Notable features include a wide array of techniques for data exfiltration and communication, with the ability to configure and run tests across different operating systems.

PyIris is a modular remote access trojan (RAT) toolkit implemented in Python, designed for the dynamic creation, encoding, and encryption of RAT payloads to facilitate the remote control of compromised systems. Its notable features include cross-platform compatibility for both Windows and Linux, robust error handling, dynamic payload generation, and advanced functionalities such as keylogging, webcam access, and file manipulation, making it a versatile tool for malicious actors. The ongoing development aims to enhance its capabilities further with improved encryption methods and operational persistence techniques.

PythonRAT is a Command and Control (C2) server that orchestrates multiple machines infected with a Remote Administration Trojan (RAT), enabling the formation of a botnet cluster. Its primary use case is for educational purposes in cybersecurity training, allowing users to remotely control, monitor, and manipulate target sessions. Notable features include an integrated keylogger, screenshot and webcam capture, file transfer capabilities, privilege checking, and the ability to issue commands to all active sessions simultaneously.

Reave is a post-exploitation framework developed for hypervisor endpoints, designed to facilitate automated penetration testing in heavily virtualized environments. This Python-based tool operates on a listener/agent model, offering features such as real-time interactive terminal sessions, automatic hypervisor enumeration, and modular payloads for tasks including exfiltration and persistence. Notably, Reave supports versatile configurations for agents, enabling comprehensive control over operations and network interactions.

Redpill is a post-exploitation tool designed to facilitate various tasks following initial access via reverse TCP shells, particularly for red team engagements. It comprises a collection of PowerShell scripts, with the main script, redpill.ps1, serving as a central hub to download, configure, and execute these scripts, offering functionalities similar to the meterpreter environment. Notable features include system enumeration, remote process management, web server deployment, and a keystroke logger, all intended to enhance the capabilities of shell access in compromised systems.

RedVision is a collection of custom-designed HTML user interfaces specifically intended for Command & Control (C2) systems. Its primary use case is to enhance the operational efficiency of security professionals by providing a visually appealing and functional interface for managing C2 capabilities. Notable features include an array of templates, each visually distinct, allowing for flexible customization to suit various C2 deployment scenarios.

ReHTTP is a PowerShell-based HTTP shell that features a web user interface, designed primarily for remote management and control of clients on a Windows platform. Key functionalities include executing PowerShell commands, managing client connections, and creating custom modules and variables, along with sophisticated event handling capabilities for connection management. This tool also supports scheduled tasks and offers a history feature for command execution, enhancing its usability in system administration and penetration testing contexts.

Rogue is a bash script that automates penetration testing workflows by integrating tools such as Nmap, Metasploit, and John the Ripper. It streamlines the scanning, exploiting, and reporting phases of pentesting, providing a modular and customizable experience for security professionals. Notable features include automated scans, exploitation configuration, credential harvesting, and structured report generation, all initiated with a simple input of a target IP address.

RustVersary is a comprehensive toolkit designed for malware development and penetration testing using the Rust programming language. It includes a variety of tools and scripts that facilitate tasks such as enumeration, exploitation, and post-exploitation, each thoroughly documented to aid both personal use and community contributions. Notable features include advanced techniques for process injection, persistence mechanisms, and a structured catalog of utilities tailored for security assessment challenges.

Searchbins is an offline command-line tool designed to search for GTFOBins binaries that allow users to bypass local security restrictions in misconfigured systems. Its notable features include the ability to enumerate specific binary functions, display commands to exploit those functions, maintain an up-to-date GTFOBins database, and allow for file-based binary searches. This tool serves as a valuable resource for security professionals to identify and utilize potential vulnerabilities in binary applications.

The SeaShell Framework is a post-exploitation tool designed for iOS and macOS that facilitates remote access to devices, allowing for control and extraction of sensitive data. Its notable features include a powerful payload named Pwny which supports custom post-exploitation modules, encrypted communication via TLS 1.3, and a basic set of modules for exfiltrating user data such as SMS, voicemail, and browsing history. Actively updated, it supports a wide array of iOS versions susceptible to specific vulnerabilities, enhancing its utility in security assessments and penetration testing.

Sh3ller is a lightweight command-and-control (C2) framework designed for managing incoming reverse shells via PowerShell. Its primary use case is to maintain persistent access to compromised systems, allowing users to manage multiple shell sessions simultaneously with minimal dependencies. Notable features include an always-on listening mode, support for various reverse shell payloads, and intuitive session management commands.

Silkwire is a gRPC-based Command and Control (C2) framework designed for authorized penetration testing and red team operations. It supports multiple platforms (Windows, Linux, macOS) and offers advanced features including dynamic implant generation, post-exploitation modules, keylogging, and enhanced evasion techniques against detection mechanisms. The tool emphasizes encryption for communications and session management, making it a robust option for security professionals in performing comprehensive security assessments.

SoundShell is a Command-and-Control (C2) tool developed in Go that utilizes the Spotify Web API to execute encoded commands and generate corresponding playlists. Its primary use case is to dynamically create playlists based on user-inputted commands, with notable features including custom command execution, command encoding for playlist generation, and random track selection from a predefined song pool.

Sshimpanzee is a tool for creating a static reverse SSH server that initiates connections from the victim machine to an attacker's IP, bypassing the need for incoming connection requests. It provides all standard SSH functionalities, including port forwarding and dynamic SOCKS proxies, while also offering advanced tunneling methods like DNS Tunneling, ICMP Tunneling, and HTTP encapsulation to facilitate communication in restrictive network environments. Notable features include customizable build configurations, support for multiple tunneling mechanisms, and the ability to generate new SSH keys upon build.

The FreeZeroDays/TTPs repository serves as a curated collection of offensive security notes, focusing on Tactics, Techniques, and Procedures (TTPs). It provides a repository of validated commands and resources targeted towards researchers and practitioners in offensive security. Notably, the documentation emphasizes accuracy and reliability, and it draws inspiration from other established collections in the field.

Unicorn is a Command and Control (C2) framework designed for post-exploitation and remote control operations. Built using Python and Flask, it features a client-server architecture that supports multiple listeners, dynamic command execution, and client chat synchronization, while still being in development with planned enhancements such as a proxy server and GUI integration. This tool is aimed at cybersecurity professionals for managing agents and executing commands in compromised environments.

Venus is a VS Code extension designed to serve as an agent for the Mythic C2 framework, enabling operators to create and deliver payloads to target systems. This tool automates the packaging of VS Code extensions and supports various commands for interacting with the system environment, although it currently lacks support for encrypted payloads. Notably, Venus is cross-platform compatible and requires manual installation on target machines after preparation.

WebcamBOF is a Beacon Object File (BOF) for Cobalt Strike that enables webcam capture functionality. Its primary use case is to facilitate remote image acquisition by allowing users to save webcam images either to disk or download them directly over the Cobalt Strike beacon. Notable features include multiple save methods, including capturing images as screenshots, and the ability to enumerate connected webcam devices.

WindowSpy is a Cobalt Strike Beacon Object File designed for targeted user surveillance, facilitating stealthy detection of significant user activities such as entering credentials or accessing confidential documents. It operates by comparing active window titles against a customizable list to trigger specific actions, like screenshots, only when relevant activities are detected, thus minimizing unnecessary data collection. Key features include easy integration with Cobalt Strike, a configurable keyword list for triggering surveillance, and the ability to customize the actions performed upon detection.

XENA is a cross-platform cybersecurity automation framework designed for adversary simulations and red team operations, featuring a built-in post-exploitation agent and a command-and-control (C2) server. Notable features include an elegant dark-themed user interface that supports desktop, web, and mobile formats, along with high-level automation capabilities for orchestrating C2 clusters. This community edition serves as an integrated tool for penetration testing, facilitating a comprehensive approach to security assessment.

ZeroPulse is a modern Command & Control (C2) platform designed for secure remote management and monitoring of systems, utilizing Cloudflare Tunnel technology for encrypted connections. Key features include built-in authentication, support for WinRM and SSH interactions, a responsive React interface with real-time terminal integration, and comprehensive DNS management. The tool is currently in active development and is intended primarily for testing and evaluation purposes.

BYOB is an open-source post-exploitation framework designed for educational purposes that facilitates command and control operations following a system compromise. It features a comprehensive web GUI for managing post-exploitation tasks, customizable payload generation for multiple platforms, and the ability to dynamically load third-party packages without leaving traces on the disk. The framework is optimized for ease of use, allowing students, researchers, and developers to extend its capabilities with minimal effort.

linux-priv-esc-audit is a Linux system auditing script designed to identify privilege escalation vulnerabilities and enhance security. It offers dual-mode operation for both root and low-privilege users, generates comprehensive audit reports with vulnerability insights, and provides user-friendly guidance throughout the audit process. Regular updates ensure the tool remains effective against new security threats and techniques.

ShellCode Elevator is a sophisticated tool for bypassing User Account Control (UAC) and injecting shellcode into processes on x64 systems while maintaining stealth and undetectability. Its primary features include fully undetectable operation, privilege escalation, memory-only execution, and anti-debugging mechanisms to prevent detection by security tools. This makes it a potent option for executing malicious payloads without alerts on target systems.

ShellOrd is a cross-platform Command & Control (C2) framework designed for authorized penetration testing and educational purposes, implemented in Rust and Java. It supports Windows, MacOS, and Linux, and features a modular architecture with extensions, secure memory handling, and encrypted data transmission over TCP or UDP. The framework enables users to build and automate workflows, serving as an alternative to Trickest, while emphasizing speed and security.

Cannon is a post-exploitation framework developed in Python, designed primarily for Unix-based systems to facilitate post-access tasks on compromised machines. Its functionalities include uploading and downloading files, executing pre-defined modules, and harvesting reverse shells, making it a powerful tool for security professionals and penetration testers. The framework also offers some compatibility with Windows systems, expanding its utility across different platforms.

Gecko is a web backdoor tool designed to facilitate exploitation and control of compromised systems, primarily targeting web applications. It features functionality for bypassing various HTTP error responses, auto-rooting capabilities, and the ability to manage backdoors, admin accounts, and file handling operations. Notably, it includes a Backdoor Destroyer and supports both Linux Exploit Suggester functionality and user account modifications, making it a versatile tool for penetration testing and system administration.

The Windows Post-Exploitation repository provides a comprehensive resource for post-exploitation techniques specifically tailored for Windows systems. It includes an extensive catalog of commands, tools, and guides for executing post-exploitation tasks, especially in scenarios where traditional frameworks like Meterpreter are unavailable. Notable features include curated lists of PowerShell scripts, privilege escalation tools, and various post-exploitation techniques, making it an invaluable tool for penetration testers and security professionals.

AndroidHack_BackDoor is a Python and shell script designed to facilitate the integration of a backdoor into Android APK files while leveraging the Android Debug Bridge (ADB) for remote device access. It is primarily intended for educational use and requires a solid understanding of various technical tools such as Metasploit, Apktool, and the Android SDK. Notable features include a simplified process for backdoor insertion and remote accessibility of Android devices.

Exploit is an offensive hacking tool designed to assist cybersecurity professionals and ethical hackers in executing exploits and conducting penetration testing. Its primary use case is to facilitate hacking activities, enabling users to automate various exploitation tasks. Notable features include ease of installation on any Linux distribution and comprehensive support for dependency management through a requirements file.

reveng_rtkit is a Linux Loadable Kernel Module (LKM) rootkit specifically designed for the 5.11.0-49-generic Linux kernel, primarily used for post-exploitation stealth techniques. Its key features include syscall table address retrieval, function hooking, and the capability to hide itself and other processes from system monitoring tools, making it difficult to detect. Additionally, it implements an IOCTL for interactive control and can bypass known rootkit detection tools like rkhunter.

emp3r0r is an advanced, zero-trust post-exploitation framework and command & control (C2) system designed for secure operations on both Linux and Windows environments. Its notable features include autonomous gossip mesh networking, fileless memory execution of Starlark-scripted agents, and robust cryptographic identity pinning, ensuring high levels of stealth, operational control, and security against impersonation attacks. The framework facilitates seamless integration and execution without relying on host-based interpreters, making it highly suitable for high-security scenarios.

ARTC2 is an advanced execution framework designed to help security teams efficiently execute attack scenarios across multiple breach points, primarily focusing on Windows OS environments. Its notable features include rapid deployment, modern command and control capabilities utilizing encrypted communications, and dynamic attack formations that enable execution without recompilation. The tool supports extensive logging for evidence collection and analysis, facilitating rapid evaluation of endpoint detection and response (EDR) solutions against MITRE ATT&CK frameworks.

CS-EDR-Enumeration is a Cobalt Strike Aggressor Script designed to enumerate antivirus (AV), endpoint protection platform (EPP), endpoint detection and response (EDR), and telemetry/SIEM products on Windows hosts post-compromise. It features six commands with varying noise levels to suit different operational risk tolerances, and includes a comprehensive signature database for major security vendors, enabling silent enumeration techniques that minimize detection. Notable capabilities include kernel driver enumeration, automatic threat level assessment, and color-coded output for quick identification of security products.

HTTPWorker is a Flask-based command and control (C2) framework designed for security competitions, utilizing custom Windows implants written in C++. Its primary use case involves coordinating and managing remote Windows clients with capabilities such as command execution, file management, system information retrieval, and user interface access through an authentication-protected web app. Notable features include Docker support for deployment, integration with Pwnboard for beacon tracking, and customizable implant configurations to evade detection.

The Periodic Table of Offensive Security serves as a visual reference for 118 essential tools, frameworks, and standards utilized in offensive security and red teaming. Its primary use case includes aiding penetration testing, red team training, and providing a comprehensive overview of tools for OSINT, exploitation, and post-exploitation phases. Notable features include downloadable print-friendly PDFs and an interactive clickable version that links directly to resources for each tool represented.

Proxy_Bypass is a post-exploitation tool designed to identify user agents capable of circumventing proxy restrictions. It offers batch processing, the ability to test various user agents against specific domains, and includes a predefined library of user agents for immediate use. Notable features include verbose output, support for custom user agents, and future enhancements such as multi-threading and additional language support.

TibaneC2 is a modular Command & Control (C2) framework designed for offensive security research and red teaming, featuring a C/C++ core server, a PHP-based web panel, and a CLI console. Its notable characteristics include cross-platform implants, multi-language stagers, and scripting tools for enhanced automation and emulation, facilitating extensive customization without altering core functionality. The framework is intended strictly for educational and authorized testing purposes.

EVA is an AI-driven penetration testing tool designed to aid users throughout the pentesting lifecycle with intelligent analysis, automated enumeration, and real-time vulnerability assessment. It features support for multiple AI backends, session management for persistent interactions, and an interactive interface for executing commands and analyzing results, thereby enhancing the efficiency of penetration testing efforts. This tool aims to assist, rather than replace, cybersecurity professionals by providing strategic guidance and quicker outcomes during engagements.

Ligolo-MP is a sophisticated pentesting tool that facilitates collaborative pivoting through a client-server architecture, allowing multiple concurrent tunnels with automated TUN management. Its notable features include SOCKS and HTTP proxy support, cross-platform compatibility, and dynamic mTLS-enabled agent generation, all while providing a user-friendly terminal-based GUI for efficient monitoring and management.

LogHound is a post-exploitation tool designed for analyzing Windows Security Event Logs (.evtx) to facilitate BloodHound mapping, aiding Red Teams in tracking lateral movement targets and deciphering active user sessions. Notable features include a chunk-based streaming parser that minimizes memory usage, support for Pass-The-Hash and Kerberos authentication methods, and the ability to generate detailed reports in various formats, ensuring effective operational security during network penetration testing.

KHAØS C2 is a sophisticated post-exploitation command and control framework designed for stealth and evasion against endpoint detection systems. It features five covert communication channels, including Microsoft Teams and GitHub Gist, ensuring that the traffic blends with normal operations. The framework includes extensive post-exploitation capabilities, such as token theft, process injection, and lateral movement, along with a user-friendly React-based UI for real-time monitoring and payload management.

WafRift is a programmable WAF-evasion engine designed to test and bypass web application firewalls by generating and exploiting payload mutations through various encoding and grammar strategies. Its primary use case is for security researchers and penetration testers seeking to identify WAF vulnerabilities, featuring automated scanning, detailed response classification, and an integrated discovery tool for API endpoints. Notable features include customizable evasion strategies, session management, multi-signal response analysis, and comprehensive WAF fingerprinting capabilities.

ForceAdmin is a malicious tool designed to create an infinite loop of User Account Control (UAC) prompts, compelling users to grant administrative privileges by overwhelming them with requests. It provides various script templates in formats such as batch, PowerShell, AutoHotkey, AutoIt, HTA, and VBScript, facilitating execution via PowerShell and bypassing antivirus protections. Notable features include no dependencies, dual architecture support for x86 and x64 systems, and a fileless execution method.

HatSploit is a modular penetration testing framework designed for writing, testing, and executing exploit code. Its primary use case is to facilitate security assessments and vulnerability exploitation in a structured manner. Notable features include its extensibility through modules and a user-friendly interface for deploying exploits.

OnlyShell is a Go-based reverse shell handler designed for penetration testers and security researchers, enabling the management of multiple reverse shell connections concurrently. Key features include automatic shell type detection, background shell management, command broadcasting across active shells, and the option for encrypted communications with TLS support. The tool offers an intuitive command-line interface and allows for real-time interaction and status monitoring of all connected sessions.

The postexploitation-toolbox-android is a specialized toolkit for executing post-exploitation techniques on Android devices, particularly designed for Android 14 on the Samsung S21 Ultra. It leverages CVE-2024-34740 to allow code injection into system processes, enabling features such as temporary app debuggability, system-wide permission bypassing, and dynamic resource editing, while providing a user-friendly interface for manipulating system service internals through Java reflection.

IrisC2 is a command and control (C2) framework designed for authorized security testing, red team exercises, and internal research. It features a modular architecture comprising a Client for user interaction, a Server for managing communication and tasks, Beacons for executing commands within target environments, and a Stager for handling staged payloads. Notable capabilities include multi-platform support, advanced task scheduling, plugin integration for extended actions, and comprehensive event synchronization.

KittySploit is a modular offensive security framework and C2 platform designed for penetration testers, researchers, and red teams. It consolidates security workflows into a single console, featuring capabilities for target scanning, engagement organization, module execution, and AI-assisted testing plan generation, alongside built-in command and control functionalities. Notable features include an extensible architecture, automation readiness, and an array of integrated tools for reconnaissance, exploitation, and traffic analysis.

The EternalHush Framework is an advanced command and control (C&C) platform designed specifically for Windows systems, enabling users to extend its functionality through a Python API for plugin development. Notable features include an intuitive GUI, integration capabilities for external modules, and a variety of built-in implant functionalities such as TCP/HTTP(S) connections and reflective DLL loading, all aimed at facilitating data collection and interaction with infected systems. This open-source project is currently in early development and seeks community collaboration for enhancements.

The "exploits" repository serves as a comprehensive security research and exploit development toolkit, focusing on browser vulnerabilities, post-exploitation techniques, and cloud identity attacks. It features organized content around CVE reproductions, offensive tooling with detection guidance, and written assessment deliverables, all designed for educational use and authorized security testing. Notably, it includes a contained Docker lab environment for safe execution and testing of exploit scenarios without internet access, ensuring a secure and isolated workspace for enterprise assessments.

RedTeam-Agent is an AI-powered autonomous framework designed for red team security assessments, enabling automated execution of commands across multiple tools through a skill-first terminal workflow. Its notable features include support for over 15 integrated security tools, advanced output filtering, and comprehensive Active Directory attack coverage, allowing users to streamline the red teaming process without manual tool management. The framework facilitates multi-client operations and includes functionalities for reconnaissance, data collection, analysis, and lateral movement.

Maldev is a comprehensive Go library designed for malware engineering, providing tools for syscall manipulation, evasion techniques, code injection, credential harvesting, and persistence mechanisms. Its capabilities include a variety of syscall calling methods, extensive evasion techniques against detection mechanisms, and robust injection methods, all integrated through a unified syscall caller for enhanced stealth and flexibility. The library is aimed at authorized security research, red teaming, and penetration testing, ensuring a modular approach to malware development with an emphasis on cross-compilation without CGO dependencies.

PrecompiledBinaries is a curated repository of precompiled binaries designed for use in authorized security testing, including penetration testing, red teaming, and exploit validation. It facilitates rapid access to essential tools across various scenarios such as privilege escalation, Active Directory assessments, and tunneling, eliminating the need for time-consuming compilation from source. Notable features include an organized layout of binaries by tool and platform, covering a wide range of use cases in security assessments.

Shells-X is a modular web shell framework designed for authorized penetration testing and security research, allowing users to deploy a single-file shell that incorporates various tools for executing commands, interacting with databases, and scanning ports. Its notable features include customizable builds with unique SHA256 fingerprints, an interactive environment for PHP and SQL commands, robust system diagnostics, and encrypted traffic handling. The framework also supports automatic detection of CMS/frameworks and provides a one-click export option for recon data to Faraday.

WinPrivEsc is a Windows enumeration and privilege escalation discovery toolkit designed for authorized testing. It offers two script variants—one using cmd for stealth on monitored hosts and another using PowerShell for more comprehensive analysis, allowing users to assess escalation vectors while maintaining a read-only operation. Notable features include customizable noise levels for the script output and extensive reporting on system configurations, user accounts, and permissions, ensuring flexibility and adaptability to various security environments.

The bof-launcher is a versatile programming library designed for in-memory management and execution of Beacon Object Files (BOFs) across multiple platforms, including Windows and Linux. It supports various architectures and integrates seamlessly with languages such as C, Zig, and Rust, offering features like asynchronous execution, cross-platform compatibility, and advanced memory masking techniques. Additionally, the library facilitates the development of BOFs using Zig, leveraging a rich standard library for enhanced functionality during red team engagements.

AutoRedTeam-Orchestrator is a local-first, MCP-native automation platform designed for authorized testing and AI/MCP attack surface auditing. It features a modular security capability set accessible via an MCP Server, Python SDK, and Typer CLI, enabling static code audits, reconnaissance, and vulnerability detection primarily for research and training purposes. Notable capabilities include AI-assisted audits, configurable scanning profiles, and different export formats for audit reports, each tailored for secure and compliant usage scenarios.

ENDGAME is a command and control framework designed for authorized red team operations and penetration testing, enabling users to simulate adversarial techniques and assess their network's detection capabilities. Its standout feature is the integrated AI Console, which interprets user objectives in natural language and suggests executable commands based on real-time contextual data, enhancing efficiency in red team workflows. Additionally, the framework supports automated analysis of command outputs to inform follow-up actions, ensuring a streamlined operational process.

Enumdb is a brute force and post-exploitation tool designed for MySQL and MSSQL databases, enabling users to test credentials and search for sensitive data fields within database tables. Its notable features include automated credential discovery, multi-threaded enumeration for efficiency, the ability to execute SQL queries and spawn a simulated shell, as well as options for reporting extracted information in .csv or .xlsx formats.

Amnesiac is a post-exploitation framework developed in PowerShell that facilitates lateral movement within Active Directory environments without the need for installation, as it operates entirely in memory. It features command execution over Named Pipes for discreet operations, a user-friendly interface, and a variety of integrated modules for tasks such as keylogging and Kerberos ticket dumping. The tool is designed for research and authorized testing, emphasizing user responsibility in compliance with legal regulations.

The Largo-m/security-tools-hacking is a modular Windows penetration testing framework designed for security professionals, facilitating various stages of red team operations such as reconnaissance, exploitation, and post-exploitation. Key features include system information collection, geolocation lookup, browser history extraction, and optional key logging, all presented in a user-friendly manner that allows for easy integration and extension of custom modules.

COM-Hunter is a COM hijacking persistence tool designed for both educational purposes and red teaming applications, offering functionality in .NET and as a Cobalt Strike compatible BOF variant. Its notable features include multiple modes for establishing or removing COM hijacking persistence mechanisms, such as searching for CLSIDs, executing classic persistence, and utilizing Task Scheduler. This versatile tool assists security professionals in simulating advanced persistence techniques within Windows environments.

GTFONow is a Python-based tool designed for automatic privilege escalation on Unix systems by exploiting misconfigured setuid/setgid binaries, capabilities, and sudo permissions. With a focus on usability for both CTF challenges and real-world pentesting scenarios, it offers various automated exploitation techniques, including file read/write primitives and SSH key theft. The tool is lightweight, compatible with multiple Unix variants, and requires no third-party dependencies, making it easy to deploy via a single script.

The HTB / THM / OSCP Master Penetration Testing Checklist is a comprehensive, modular framework designed to guide penetration testers through the phases of engaging with Hack The Box, TryHackMe, and OSCP-level machines. Key features include structured sections from setup and reconnaissance through exploitation and post-exploitation activities, as well as a quick reference for tools, commands, and troubleshooting. This checklist serves as a valuable resource for both beginners and intermediate practitioners in the penetration testing field.

Alien is a modular webshell client designed for cybersecurity research and education, providing a flexible post-exploitation framework that integrates with various web technologies through reusable modules. Key features include arbitrary code execution, a file manager, database interaction, SOCKS5 proxying, HTTP traffic obfuscation, and the ability to pivot through webshells for enhanced communication security. The architecture enables advanced capabilities while keeping the core webshell lightweight, making it suitable for authorized penetration testing scenarios.

MSSQLand is a C# post-exploitation tool designed for red team operations targeting Microsoft SQL Server (MSSQL) environments. It facilitates linked server traversal, cascading impersonation of logins, and various discovery actions to gather impactful information with minimal operational security footprint. Notable features include automatic execution of linked queries across deep server chains, support for multiple authentication methods, and customizable output formats, enhancing both usability and data presentation in penetration testing scenarios.

Toboggan is a post-exploitation tool that facilitates a semi-interactive shell on both Linux and Windows targets via Remote Code Execution (RCE) methods. It operates by allowing users to define custom command execution logic through a simple Python interface, enabling interaction with command outputs even in restrictive network environments. Key features include support for Python-based execution modules, an interactive shell with command history, and the ability to establish communications using named pipes when reverse shells are not feasible.

LinEnum-ng is a targeted, stable enumeration script designed for Linux privilege escalation, particularly suited for OSCP examinations. Its notable features include kernel CVE detection for various exploits, comprehensive checks for SUID and sudo vulnerabilities with GTFOBins integration, as well as support for container escape assessments in Docker and Kubernetes environments. The output is structured and color-coded for efficient triaging, minimizing information overload.

MovementHound is a PowerShell tool designed for active enumeration of lateral movement capabilities in Windows environments, focusing on the effective rights a principal possesses rather than simple group memberships. This approach allows users to identify potential access paths that may be overlooked by traditional enumeration methods, making it particularly effective in environments with modified DACLs and security descriptors. Notable features include integration with BloodHound Legacy for detailed access mapping and a comprehensive output that aids in identifying persistent footholds during security assessments.

ADB WebKit is a browser-based tool designed for managing Android devices via ADB (Android Debug Bridge) with an intuitive user interface. Its primary use case includes functionalities like application management (installing, uninstalling, granting permissions), shell access, screen capture, and device control commands, making it a comprehensive solution for developers and testers. Notable features include support for live application management, real-time screen interactions, and various device control options, all accessible through a USB connection or IP address.

Bashark 2.0 is a post-exploitation toolkit designed for penetration testers and security researchers to facilitate operations during the post-exploitation phase of security audits. It offers a simple command-line interface, where users can source the bashark.sh script to access various functions and commands, streamlining the process of managing compromised hosts. Key features include ease of use through a help menu and support for Bash scripting, making it a practical tool for enhancing post-exploitation activities.

DllShimmer is a tool designed to facilitate DLL hijacking by allowing users to backdoor any function in a DLL without disrupting the normal operation of the host program. It generates proxy DLLs through a boilerplate C++ file and a corresponding .def file, ensuring that all exported functions maintain their original names and ordinal numbers, thus avoiding detection. Key features include support for both dynamic and static linking, the option to prevent multiple executions of the backdoor, and comprehensive debug logging capabilities.

Heroinn is a cross-platform command-and-control (C2) and post-exploitation framework developed in Rust, designed primarily for research and educational purposes. Notable features include a graphical user interface (GUI), an interactive PTY shell, system information collection, file management with support for large files and resuming broken transfers, and compatibility with multiple operating systems including Windows, Linux, BSD, and macOS, leveraging various communication protocols such as TCP, HTTP, and reliable UDP.

Vegile is a post-exploitation tool designed for maintaining stealthy backdoor/rootkit access on Linux systems. Its primary use case involves establishing persistent access to compromised hosts while enabling features such as process hiding and session unlimited capabilities in Metasploit. Notable functionalities include the ability to automatically restart hidden processes, ensuring persistent access even after termination, and support for various backdoor implementations, including those created with msfvenom.

VMkatz is a cybersecurity tool designed to extract Windows credentials and secrets directly from virtual machine memory snapshots and disk images without the need for full exfiltration. It supports various input formats, including VMware snapshots and VirtualBox saved states, allowing efficient retrieval of sensitive data such as NTLM hashes, DPAPI master keys, and Kerberos tickets directly from the hypervisor or NAS. Notably, VMkatz operates as a single static binary, requiring minimal setup and enabling rapid credential access in red team engagements.

RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.

一个攻防知识库。A knowledge base for red teaming and offensive security.

DeimosC2 is a Golang command and control framework for post-exploitation.

An evil RAT (Remote Administration Tool) for macOS / OS X.

Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase.

fsociety Hacking Tools Pack – A Penetration Testing Framework

Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device.

Load shellcode into a new process

GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

A tool to dump the login password from the current linux user

mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor

A post exploitation tool based on a web application, focusing on bypassing endpoint protection and application whitelisting

Dominate Active Directory with PowerShell.

An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with zero human intervention.

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

venom - C2 shellcode generator/compiler/handler

Adversary simulation and Red teaming platform with AI

WADComs is an interactive cheat sheet, containing a curated list of offensive security tools and their respective commands, to be used against Windows/AD environments.