pybeacon

PyBeacon PyBeacon is a collection of scripts for dealing with Cobalt Strike's encrypted traffic. It can encrypt/decrypt beacon metadata, as well as parse symmetric encrypted taskings Scripts included There is a small library which includes encryption/decoding methods, however some example scripts...

Lucky-Spark

LUCKY-SPARK ⟪ LUCKY-SPARK ⟫ is a stager designed for shellcode payloads staged with http/https like sliver or on github raw. It uses modern obfuscation and evaion methods like sliding window just-in-time decryption of the payload and cpu instruction patching. By default it creates an executable...

CVE-2022-42475

CVE-2022-42475 Background This is the exploit for the blog post here: https://bishopfox.com/blog/exploit-cve-2022-42475 Redacted Version This version of the exploit will not work without you, the hacker, supplying the necessary memory addresses for ROP gadgets, etc. The work to determine these da...

java-stager

java-stager A PoC Java Stager which can download, compile, and execute a Java file in memory. This is for research purposes only, do not use this where you are unauthorised to do so. What is this? This is based on the work of James Williams from his talk "Next Gen AV vs My Shitty Code" available...

cve-2019-11707

SpiderMonkey - CVE-2019-11707 Bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820 Screenshots Files exploit.js - Actual exploit, prepended by saelo's util.js & Int64.js. stager.js - Used for creating constants, prepended by saelo's util.js & Int64.js...

Sandman

Sandman Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many...

neurax

A framework that aids in creation of self-spreading software Overview With help of Neurax, Golang binaries can spread on LAN/WAN without using any external servers. Diverse config options and command stagers allow rapid propagation across various wireless environments. Example code root@kitploit:...

WSC2

WSC2 LAST/CURRENT VERSION: 0.1 Author: Arno0x0x - @Arno0x0x WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. The tool is distributed under the terms o...

NorthStarC2

NorthStarC2 is an open-source command and control framework developed for penetration testing and red teaming purposes by Engin Demirbilek. NorthStar C2 Framework consists of two applications, a server-side GUI web application for managing sessions and a client-side stager to communicate with C2...

java-stager

java-stager メモリ内でJavaファイルをダウンロード、コンパイル、実行できるPoC Java Stagerです。 これは研究目的のみであり、許可されていない場所では使用しないでください。 これは何ですか？ これはJames Williams氏のトーク「Next Gen AV vs My Shitty Code」の成果に基づいています。動画はこちら： https://www.youtube.com/watch?v=247m2dwLlO4&feature=youtu.be 私にとってトークの重要な部分は以下の通りです：...

NewPowerDNS

NewPowerDNS NewPowerDNS is an updated version of @domchell's PowerDNS. The main feature added is support for transferring files using DNS A records. See below for a complete list of the modifications made: Support for transfer over DNS A records Gzip compression to reduce file transfer size Suppo...

Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...

New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured, lightweight, and modular," Elastic Security Labs researcher Cyril François said in a...

Linux dup2 Command Shell, Bind TCP Stager

dup2 socket in s1, then execve. Listen for a connection Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 256 include...

Linux dup2 Command Shell, Bind TCP Stager

dup2 socket in s1, then execve. Listen for a connection Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 264 include...

Linux dup2 Command Shell, Reverse TCP Stager

dup2 socket in s1, then execve. Connect back to the attacker Module Options...

Linux dup2 Command Shell, Reverse TCP Stager

dup2 socket in s1, then execve. Connect back to the attacker Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 224 include...

FTP Fetch, Bind IPv6 TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Listen for an IPv6 connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows x86 Bind Named Pipe Stager

Fetch and execute an x86 payload from an FTP server. Listen for a pipe connection Windows x86 Module Options...

FTP Fetch, Windows Upload/Execute, Bind TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Listen for a connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...