erl_mouse

erlmouse version 1.1 Alright, I've improved several things to increase chances of finding a vulnerable device or network. Most are not public facing, have been patched, or are so oscure that it can be difficult to find a target. Nevertheless, we persist. You can now scan every IP address in china...

pwnlift

pwnlift Named in homage to pwndrop, pwnlift is a simple dotnet server application for uploading files from a desktop without the use of a C2. Useful if you have a console access to a machine and need to take files offline for analysis such as Code Integrity Policy files. Building Build the projec...

GeckoDroid

GeckoDroid Mobile client for Adaptix C2 Framework. Full operator access from your Android device. What it does GeckoDroid gives you control over your Adaptix C2 server from anywhere. Instead of sitting at your desktop client, you can manage operations on the go. Agents - See all connected agents...

CrystalSliver

crystal-kit-sliver Crystal Palace evasion kit ported to Sliver C2. This is the first public port of rasta-mouse's Crystal-Kit Cobalt Strike to Sliver. It follows the same cross-C2 pattern proven by Crystal-Kit-Xenon Mythic. License: MIT — Copyright c 2026 Simone Licitra Target: Windows x64 only...

Powershell-C2

Powershell-C2 This attack stems off of my Powershell Payload Excel Delivery, but it uses a really cool method for Command and Control/persistence on the box. A walk-through can be found here: http://enigma0x3.wordpress.com/2014/01/17/command-and-control-using-powershell-and-your-favorite-website/...

apfell

Apfell Apfell is a JavaScript for Automation JXA payload for macOS. This version currently supports Mythic 2.3.+ and will update as necessary. It will not work with Mythic 2.2 and lower. How to install an agent in this format within Mythic When it's time for you to test out your install or for...

jarm

JARM Por favor, lee la publicación inicial del blog sobre JARM para más información. JARM es una herramienta activa de huellas digitales de servidores de seguridad de la capa de transporte TLS. Las huellas digitales de JARM se pueden usar para: Verificar rápidamente que todos los servidores de un...

APTs-Adversary-Simulation

Simulación de APTs Adversarios Una colección completa de ataques simulados de Amenazas Persistentes Avanzadas APT basados en tácticas, técnicas y procedimientos TTPs del mundo real utilizados por grupos APT patrocinados por estados de Rusia, China, Irán y Corea del Norte !CAUTION Aviso Importante...

c2-printf

C2-PRINTF is a small utility that lets you do printf-style debugging over a C2 debugger connection, for use with the Silicon Labs EFM8 and C8051F microcontrollers. Full write up available on my blog: https://jaycarlson.net/2017/07/16/printf-style-trace-messages-using-c2/ If you build the WPF...

C2-Hunter

C2-Hunter C2-Hunter es un programa diseñado para analistas de malware para extraer tráfico de Comando y Control C2 de malwares en tiempo real. El programa utiliza un enfoque único al engancharse en las API de conexiones win32. Con C2-Hunter, los analistas de malware ahora pueden interceptar y...

ramnit_traffic_parser

ramnittrafficparser If you have traffic data between Ramnit and C2, you can dump the configs & modules Require PHP 7 tshark Usage $ php main.php pcap/URL Example $ php main.php "https://content.any.run/tasks/b1cf6c3e-f079-49b4-9798-44a7c511d194/download/pcap" + REGISTERBOT0xe2 : output/00e2.bin +...

Phoenix-Framework

Phoenix-Framework Phoenix es un framework de post-explotación basado en async que abusa de sitios confiables para C2. Plataformas compatibles Phoenix actualmente soporta las siguientes plataformas a través de sus APIs de Bot: Discord Telegram Reddit Próximamente Phoenix ofrece las siguientes...

FudgeC2

FudgeC2 FudgeC2 es una plataforma C2 en Powershell diseñada para facilitar la colaboración en equipo y la línea de tiempo de campañas, presentada en BlackHat Arsenal USA 2019. Su objetivo es ayudar a los clientes a comprender mejor las actividades del equipo rojo, brindándoles un detalle más...

bat

Behavioral Adversary Tracer BAT BAT is a realistic, evolving adversary threat model for Linux and Windows. It is not a C2 framework and it is not a rootkit. It is a complete threat simulation platform that integrates C2 communication, kernel-level stealth rootkit modules, userspace evasion,...

inject-assembly

inject-assembly - Execute .NET in an Existing Process This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies will continue to run and send output back to the Beacon,...

apfell-chrome-extension-c2server

apfell-chrome-extension-c2server Apfell C2 Server for the Google Chrome Extension Payload Find the latest version of the chrome extension C2 server in the Apfell framework here: https://github.com/its-a-feature/Apfell...

ICMP-Ghost-A-Fileless-x64-Assembly-C2-Agent

|\ |\ |\ |\ |\ |\ \ |\ |\ \ \ \ | \ \ \\ \ \ |\ \ \ || \ | \ \ |||\ \ \ \ \ \ \ \ \ \\ \ \ \ \ \ \ \ \ \ \ \ \ \ |\ \ \ \ \ \ \ \\ ||\ \ \ \ \ \ \ |\ \ \ \ \ \ \ \\ \ \ \ \ \\ ||||||||\ || ||| || Fileless, pure x64 Assembly C2 implant utilizing a Dual-Channel...

MalleableC2Profiles

MalleableC2Profiles Malleable C2 profiles for Cobalt Strike version 3.6+ bingsearchgetonly.profile - Bing web search profile, uses GET requests only cnnvideogetonly.profile - MSNBC live video straming profile, uses GET requests only googledrivegetonly.profile - Google Drive document viewer...

C2-Pwn

C2-Pwn Uses Shodan API to pull down C2 servers to run known exploits on them. Requires shodan account for API. https://www.shodan.io/ Rat Exploit Support Dark Comet Remote File Download https://www.rapid7.com/db/modules/auxiliary/gather/darkcometfiledownloader Gh0st Rat buffer Overflow...

Kitsune

Kitsune Kitsune es un Comando y Control polimórfico. Esta herramienta te permite obtener una versión gráfica de tus herramientas de hacking favoritas, como NetExec, Villain o Evil-WinRM entre otras. Además, trae muchas mejoras como reconexión automática, informes, historial y algunas funciones...