BeichenDream/Godzilla
Godzilla
Godzilla is a post-exploitation toolkit and webshell management framework designed for remote administration, credential extraction, and memory shell injection. It provides a centralized platform to deploy, control, and monitor encrypted remote access scripts across multiple server environments.
The project differentiates itself through a memory shell injector that loads binaries and shellcode directly into server memory to avoid disk-based detection. It also employs polyglot payload injection, deploying encrypted scripts across various language environments to maintain persistent connections to target systems.
The toolkit covers a broad range of capabilities, including Windows privilege escalation, stored credential extraction from web browsers and databases, and the bypass of server-side security restrictions. It further includes a virtual terminal for system command execution and a plugin-based extension model for running environment-specific tools.
Features
- Post-Exploitation Tools - Manages compromised servers through encrypted webshells and memory-resident payloads for persistent remote access and control.
- Remote Command Execution - Sends operating-system commands through an injected payload and returns their output to the operator.
- Polyglot Payload Deployments - Deploys encrypted scripts across multiple language environments to maintain persistent remote access.
- Cipher-Based Payload Wrappers - Encodes traffic between operator and injected payloads using AES or XOR ciphers to evade network detection.
- Multi-Environment Payload Generators - Creates dynamic webshell payloads for Java, .NET, PHP, and ASP environments.
- Credential Extraction Utilities - Extracts plaintext passwords, hashes, and tokens from memory of running processes on compromised hosts.
- In-Memory Process Injection - Loads shellcode or Java payloads directly into process memory to execute code without writing files to disk.
- Encrypted Channel Managers - Manages encrypted communication channels using AES and XOR ciphers to evade network detection.
- Post-Exploitation Plugins - Executes modular post-exploitation plugins for credential theft, privilege escalation, and memory injection.
- Post-Exploitation Toolkits - Provides a framework for remote administration, credential extraction, and memory shell injection on compromised servers.
- Webshell Management - Deploys and manages encrypted webshells for persistent remote access on compromised servers.
- Webshell Payload Generators - Generates and deploys dynamic webshell payloads across Java, .NET, PHP, and ASP environments.
- Reflective Memory Loading - Loads shellcode and binaries directly into process memory to avoid disk-based detection.
- Polyglot - Deploys encrypted scripts across Java, .NET, PHP, and ASP environments for persistent remote access.
- Remote - Provides a remote command-line interface for executing system commands through injected payloads.
- Server-Side Restriction Bypasses - Circumvents PHP openbasedir and disablefunctions restrictions to execute arbitrary code.
- PHP Restriction Bypasses - Circumvents PHP openbasedir and disablefunctions restrictions to execute arbitrary code.
- Payload Traffic Encryptions - Encodes client-payload communication using AES or XOR ciphers to evade network detection.
- Persistence and Webshells - Powerful web shell management and exploitation tool.
- Webshell Management - Advanced web management client with encrypted communication.
- Webshell Management Tools - Powerful web shell management tool with advanced evasion features.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
