Lucky-Spark

LUCKY-SPARK ⟪ LUCKY-SPARK ⟫ is a stager designed for shellcode payloads staged with http/https like sliver or on github raw. It uses modern obfuscation and evaion methods like sliding window just-in-time decryption of the payload and cpu instruction patching. By default it creates an executable...

cve-2019-11707

SpiderMonkey - CVE-2019-11707 Bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820 Screenshots Files exploit.js - Actual exploit, prepended by saelo's util.js & Int64.js. stager.js - Used for creating constants, prepended by saelo's util.js & Int64.js. stager.py - Used to assemble...

WSC2

WSC2 LAST/CURRENT VERSION: 0.1 Author: Arno0x0x - @Arno0x0x WSC2 is a PoC of using the WebSockets and a browser process to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actuel C2 server. The tool is distributed under the terms o...

neurax

A framework that aids in creation of self-spreading software Overview With help of Neurax, Golang binaries can spread on LAN/WAN without using any external servers. Diverse config options and command stagers allow rapid propagation across various wireless environments. Example code package main...

pybeacon

PyBeacon PyBeacon is a collection of scripts for dealing with Cobalt Strike's encrypted traffic. It can encrypt/decrypt beacon metadata, as well as parse symmetric encrypted taskings Scripts included There is a small library which includes encryption/decoding methods, however some example scripts...

Sandman

Sandman Sandman is a backdoor that is meant to work on hardened networks during red team engagements. Sandman works as a stager and leverages NTP a protocol to sync time & date to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many...

CVE-2022-42475

CVE-2022-42475 Background This is the exploit for the blog post here: https://bishopfox.com/blog/exploit-cve-2022-42475 Redacted Version This version of the exploit will not work without you, the hacker, supplying the necessary memory addresses for ROP gadgets, etc. The work to determine these da...

java-stager

java-stager A PoC Java Stager which can download, compile, and execute a Java file in memory. This is for research purposes only, do not use this where you are unauthorised to do so. What is this? This is based on the work of James Williams from his talk "Next Gen AV vs My Shitty Code" available...

java-stager

java-stager 메모리에서 Java 파일을 다운로드, 컴파일 및 실행할 수 있는 PoC Java 스테이저입니다. 이는 연구 목적으로만 사용되며, 권한이 없는 곳에서는 사용하지 마십시오. 이게 뭔가요? 이것은 James Williams의 강연 "Next Gen AV vs My Shitty Code"의 작업을 기반으로 하며, 여기에서 확인할 수 있습니다: https://www.youtube.com/watch?v=247m2dwLlO4&feature=youtu.be 저에게 중요한 강연의 핵심 부분은 다음과 같습니다: 피해자에게...

veneficus

@abraxasnull · [email protected] · abraxaslabs.tech · github.com/abraxas/veneficus Credit: @YoSoth0 Veneficus Mini v3.0 Windows 10/11 x64 임플란트 키트: PowerShell 스테이저 , Rust PE , 그리고 Telegram으로 운영자에게 알림을 보내는 Cloudflare Worker 로 구성된다. 스테이저resources/loader.ps1는 현재 PowerShell 프로세스에서 AMSI를 조용히 비활성화하...

NorthStarC2

NorthStarC2는 침투 테스트 및 레드 팀 목적으로 Engin Demirbilek이 개발한 오픈소스 명령 및 제어 프레임워크입니다. NorthStar C2 프레임워크는 두 개의 애플리케이션으로 구성됩니다: 세션을 관리하기 위한 서버 측 GUI 웹 애플리케이션과 C2 서버와 통신하기 위한 클라이언트 측 스테이저입니다. 빠른 설치 git clone https://github.com/EnginDemirbilek/NorthStarC2.git cd NorthStarC2/ chmod +x install.sh sudo...

NewPowerDNS

NewPowerDNS NewPowerDNS는 @domchell's PowerDNS의 업데이트된 버전입니다. 주요 추가 기능은 DNS A 레코드를 사용한 파일 전송 지원입니다. 아래는 적용된 수정 사항의 전체 목록입니다: DNS A 레코드를 통한 전송 지원 파일 전송 크기를 줄이기 위한 Gzip 압축 모든 유형의 파일 전송 지원 AV/EDR에 의해 차단되는 것을 피하기 위해 쉽게 난독화하거나 줄 단위로 실행할 수 있는 새로운 스테이저 전송된 파일을 출력, 실행 또는 저장하는 옵션 python2에서 python3로 업데이트...

Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...

New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands

Cybersecurity researchers have called attention to a new modular malware called TELEPUZ that's been spreading via websites infected with ClickFix lures since late April 2026. "The malware is full-featured, lightweight, and modular," Elastic Security Labs researcher Cyril François said in a...

Linux dup2 Command Shell, Bind TCP Stager

dup2 socket in s1, then execve. Listen for a connection Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 264 include...

Linux dup2 Command Shell, Bind TCP Stager

dup2 socket in s1, then execve. Listen for a connection Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 256 include...

Linux dup2 Command Shell, Reverse TCP Stager

dup2 socket in s1, then execve. Connect back to the attacker Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 224 include...

Linux dup2 Command Shell, Reverse TCP Stager

dup2 socket in s1, then execve. Connect back to the attacker Module Options...

FTP Fetch, Windows x64 IPv6 Bind TCP Stager

Fetch and execute an x64 payload from an FTP server. Listen for an IPv6 connection Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x64 payload from an FTP server. Spawn a piped command shell Windows x64 staged. Connect back to the attacker Module Options...