Awesome GitHub RepositoriesShellcode Generators

Pwntools is a Python-based framework designed for rapid prototyping and automation in binary exploitation, reverse engineering, and security research. It serves as a comprehensive toolkit for interacting with local and remote processes, providing the primitives necessary to manage complex exploit workflows and streamline security analysis tasks. The framework distinguishes itself through its specialized capabilities for binary manipulation and automated exploit construction. It includes dedicated utilities for parsing executable file formats, assembling and disassembling machine code, and gen

Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

CppGuide is a curated collection of educational resources and practical guides focused on C++ server development, Linux kernel internals, concurrent programming, network protocols, and security exploitation. It provides structured learning paths for backend developers, covering everything from interview preparation to building high-performance network servers and understanding operating system fundamentals. The guide distinguishes itself by offering in-depth, hands-on tutorials that walk through real-world implementations, including building a Redis-like server from scratch, designing custom

Merlin 是一个跨平台的命令与控制框架及远程访问工具。它提供了一个用于渗透后协调的服务器和代理系统，利用 HTTP/2 框架进行安全通信，并在多个操作系统上执行命令。 该项目具有内存代码执行引擎，可在进程内直接运行程序集和 shellcode，从而避免将文件写入磁盘。它通过点对点网络实现了去中心化的通信架构，允许代理通过直接绑定或反向连接交换数据。 为了规避检测，该框架包含流量混淆工具，可修改 TLS 指纹并添加可配置的数据包填充以掩盖通信模式。安全性通过加密的代理通信、对称流量加密以及用于身份验证的非对称加密握手来管理。 该系统支持通过命令行界面进行多用户访问协调，从而实现红队基础设施内分布式代理的管理。

Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red

这是一个进攻性安全工具包和开发框架，用于创建内存安全恶意软件、网络扫描器和有效载荷生成器。它提供了一种开发漏洞利用、Shellcode 和远程访问工具的结构化方法。 该框架通过使用无标准库环境来生成最小化的独立机器码和 Shellcode 而脱颖而出。它还支持将高性能逻辑编译为 WebAssembly，以创建用于社会工程学的欺骗性 Web 界面。 功能领域涵盖通过模糊测试（fuzzing）进行的自动化漏洞发现、多线程和异步网络表面映射，以及自传播蠕虫的开发。该工具包还包括用于保护远程植入物与命令服务器之间流量的端到端加密通信通道实现，以及针对多种操作系统的跨平台二进制编译。

EQGRP 是一个远程访问木马框架和后渗透工具包。它提供了一个集中式命令与控制基础设施，用于部署持久化植入物并管理跨不同操作系统的远程智能体。 该项目包括用于数字取证规避的工具，例如修改系统日志和文件系统时间戳以删除执行痕迹。它具有一个网络拦截系统，用于通过挂钩系统根目录来捕获和重构数据流，以及专为内核权限提升而设计的漏洞利用，以将进程权限提升为管理根权限。 该工具包涵盖了广泛的功能，包括远程代码执行、用于签名规避的 Shellcode 打包，以及移动设备日志和电信记录的渗出与解析。它还提供用于绑定网络端口和浏览解密归档的工具。

Veil is a payload generation framework and a suite of tools designed to automate the creation of obfuscated binaries and encoded shellcode. It functions as an anti-virus evasion tool that transforms binary code to bypass security scanners and endpoint detection software. The framework utilizes multi-language payload generation, employing various programming language compilers to create executables that evade signature-based detection. It includes an evasive shellcode encoder to remove forbidden characters and apply obfuscation techniques to hide payload logic. The project covers the generati

Unicorn 是一个用于生成恶意 HTA 文件、VBA 宏、编码 PowerShell 命令和内存驻留 shellcode 注入框架的工具集合。它提供工具来创建旨在通过绕过安全控制来实现远程代码执行的有效载荷。 该项目专注于通过 VBA 宏和公式武器化 Office 文档、生成 HTA 攻击向量以及创建编码的 PowerShell 有效载荷。它包括一个 shellcode 注入框架，用于包装外部 shellcode 以在系统内存中直接执行。 该工具包涵盖了用于基于证书的文件传输的二进制转 Base64 转换，以及避免基于磁盘检测的方法。它还包括用于 PowerShell 脚本编码和版本降级攻击的功能，以绕过执行策略和安全限制。

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

Phantom-Evasion is a security research framework designed for generating obfuscated payloads and automating post-exploitation tasks during authorized security assessments. It provides a suite of utilities for creating custom executables and libraries intended to test the effectiveness of antivirus and endpoint security detection systems. The framework distinguishes itself through a focus on memory-resident operations, allowing for the execution of encrypted binaries and shellcode directly within system memory. By utilizing techniques such as junk code injection, payload encryption, and remote