Awesome GitHub RepositoriesRemote Command Execution Tools

The framework is a comprehensive penetration testing platform designed for the development, testing, and execution of security exploits. It serves as a research toolkit and automated assessment environment, enabling security professionals to identify and validate vulnerabilities within networked systems and infrastructure through repeatable, standardized procedures. The platform distinguishes itself through a modular architecture that supports reflective payload injection, allowing for the execution of code directly in memory without writing to disk. It utilizes an asynchronous event loop to

Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

ysoserial is a security research tool and payload generator designed to identify and exploit insecure Java deserialization. It functions as a framework for creating malicious serialized objects that can trigger remote code execution on Java virtual machines. The project provides a library of known gadget chains, which are sequences of vulnerable class calls that achieve arbitrary command execution during the deserialization process. It automates the generation of these payloads by leveraging common third-party libraries. The tool covers capabilities for security penetration testing, Java app

LOLBAS is a curated database and knowledge base of signed Windows binaries that can be misused to bypass security restrictions and execute unauthorized code. It serves as a technical registry that maps trusted system files to their functional capabilities and the offensive tactics they enable. The project distinguishes itself by providing a capability-driven indexing system and a tactics registry that relates legitimate binary functionality to known security evasion techniques. It includes an association layer that links specific system binaries to attack patterns and tactical objectives, pro

Havoc is a post-exploitation framework used for red team operations. It provides a centralized command and control system for managing remote agents through persistent network connections and customizable communication profiles. The framework focuses on security evasion and stealth, utilizing indirect syscall execution, return address spoofing, and hardware-breakpoint patching to bypass endpoint detection and response tools. It includes a payload generation workflow to create executable shellcode or DLLs for initial remote access. The system covers a broad range of operational capabilities,

Empire is a command and control framework and post-exploitation toolkit used for network penetration testing. It serves as a centralized platform for coordinating remote agent communication and automating the delivery of security testing payloads to target systems. The project provides a suite of modules for host reconnaissance, lateral movement, and credential harvesting across corporate environments. It functions as a remote administration tool to maintain persistence and execute commands on compromised hosts. The framework incorporates capabilities for agent orchestration and the executio

HackTools is a browser extension pentesting toolkit designed for offensive security professionals. It serves as a centralized collection of tools for generating payloads, managing penetration testing workflows, and accessing security reference materials within a web-based interface. The project provides specialized utilities for generating attack strings for XSS, SQL injection, and reverse shells to identify and exploit web vulnerabilities. It includes a data encoding and hashing utility to convert information between various formats for the purpose of bypassing security filters or verifying

K8tools is a multi-stage attack framework that combines memory-only payload execution, credential testing, port forwarding, privilege escalation, and physical USB-based keystroke injection for comprehensive system compromise. At its core, the Ladon PowerShell module loads a multi-function scanner directly into memory, enabling command execution without writing files to disk, while supporting memory-only payload delivery that downloads and runs obfuscated shellcode or PowerShell commands to evade antivirus detection. The framework distinguishes itself through its breadth of integrated capabili

该项目是 AWS Lambda 的性能优化器和资源基准测试工具。它通过测试各种内存配置来分析执行速度与成本之间的权衡，以确定最具成本效益的设置并最小化运营支出。 该工具利用 AWS Step Functions 编排器来自动化执行和收集跨不同功率级别的多个函数测试运行的数据。它通过注入自定义静态或远程数据并使用加权有效负载分布来模拟生产工作负载，以模仿真实世界的流量模式。 该套件涵盖了几个功能领域，包括迭代内存采样和基于指标的成本建模，以可视化性能权衡。它为临时函数版本和别名提供自动化资源清理、为受限内部资源提供私有网络配置，以及提供远程有效负载加载以绕过标准调用大小限制。 部署通过基础设施即代码（IaC）结构进行处理，以确保环境设置的一致性和可重复性。

PhoneSploit-Pro 是一个 Android 漏洞利用和远程管理工具包。它提供了一个系统，用于通过 Android Debug Bridge 协议远程控制 Android 设备并提取数据。 该项目与 Metasploit 集成，以自动化创建和安装有效载荷，建立持久的命令与控制会话。它还包括一个网络设备扫描器，通过探测 TCP 端口来识别本地网络上的活跃 Android 主机。 该工具包涵盖了广泛的管理和取证功能，包括远程 Shell 执行、应用程序管理和硬件状态控制。它能够提取消息和联系人等用户数据，并通过屏幕镜像以及来自设备摄像头的实时音视频流进行实时监控。 该软件包含自动化实用程序，用于检测主机操作系统并安装所需的二进制依赖项。

This project is a collection of malware analysis reports and decompiled code focused on a backdoor embedded within an Android application. It serves as a study of Android APK malware, documenting the specific code patterns used for unauthorized data access and system security bypasses. The research focuses on dynamic bytecode loading and the execution of remote files to implement persistence. It specifically analyzes mechanisms for downloading and running remote Dalvik Executable files to change application behavior without updating the installed package. The analysis covers several security

Ladon 是一款内网渗透扫描器和漏洞评估工具，旨在识别跨网段的高风险安全漏洞和资产。它作为一款无文件安全扫描器，直接在内存中执行引擎和模块，从而避免在目标系统上留下磁盘痕迹。 该项目的特色在于作为 Cobalt Strike 框架中命令信标（Beacon）的插件集成。这实现了内存驻留的网络发现和漏洞检测。它还通过载荷和脚本混淆，以及绕过终端检测与响应（EDR）系统的技术，支持隐蔽操作。 该工具提供了一套全面的后渗透功能，包括凭据审计、提取，以及用于域渗透的 Kerberos 攻击执行。它通过多协议扫描和服务指纹识别来处理资产发现，以识别操作系统和 Web 技术。此外，它还支持横向移动自动化、权限提升以及远程代码执行载荷的部署。 该框架通过插件架构实现扩展，允许动态加载外部程序集或脚本，以添加自定义扫描模块和概念验证（PoC）。

AndroRAT 是一款针对 Android 设备的远程管理工具和监控框架。它由一个基于 Python 的命令服务器和一个基于 Java 的客户端代理组成，它们建立持久的套接字连接以实现远程控制和数据提取。 该项目包括一个有效载荷生成器，用于创建配置有特定网络地址和端口的签名安装包以进行部署。一旦激活，该框架提供了一个中央界面来管理多个连接的设备，通过在设备启动时重启的后台服务来维持访问。 该系统通过交互式 Shell 执行和系统数据传输涵盖远程管理。它还提供用于检索通信日志、提取设备信息和位置数据以及远程捕获音频、视频和照片的监控功能。

Covenant 是一个基于 .NET 的命令与控制（C2）框架，专为红队行动和对抗模拟而设计。它作为一个协作平台，用于协调安全评估、管理远程植入物，并通过中央服务器在受损系统上执行任务。 该项目的特色在于其动态载荷生成器，可即时编译和混淆可执行二进制文件及脚本以绕过检测。它通过一个协作环境进一步脱颖而出，该环境允许多个经过身份验证的操作员共享同步状态、跟踪操作指标，并在单个界面内管理联合行动。 该框架提供了广泛的流量混淆功能，包括使用自定义网络配置文件、数据转换流水线以及基于网桥的协议转换来掩盖通信。它还涵盖了后渗透需求，如远程文件检索、集中式凭据收集，以及使用插件扩展模型开发自定义远程任务模块。 该系统使用 SSL 证书固定和加密密钥交换来保护服务器与代理之间的通信，以确保前向安全性。

本项目是一个内部网络渗透测试的技术指南和参考资料。它作为在安全评估期间利用和漫游企业私有网络的程序集合。 该仓库提供专注于 Active Directory 攻击、横向移动和权限提升的专业手册和速查表。它包括用于维持系统持久性和清除取证痕迹的后渗透行动手册。 该文档涵盖了广泛的安全功能，包括初始访问、网络枢轴（Pivoting）和隧道技术，以及内部侦察。它还详细介绍了规避安全检测和破坏目录服务以提取域哈希的方法。

Mythic 是一个红队框架和命令与控制服务器，专为管理渗透后活动而设计。它提供了一个集中式系统，用于向部署在不同目标平台和操作系统上的代理下达任务并接收遥测数据。 该平台具有协作式操作员界面，允许多个安全研究人员在共享环境中协调操作并跟踪目标活动。它支持通过多平台载荷管理器部署和更新不同的代理载荷。 该框架利用基于插件的架构来扩展功能，允许集成来自远程仓库的自定义命令配置文件和载荷定义。其操作结构采用基于容器的服务隔离和消息桥接，以在解耦组件之间同步数据和任务。

Apfell 是一个红队框架和命令与控制服务器，专为协作式对抗模拟而设计。它提供了一个集中式基础设施来管理远程代理，并使用消息代理在多个操作系统之间分发任务以实现实时同步。 该系统作为一个分布式代理编排器，允许团队协调复杂的攻击链并同步容器数据。它具有多平台载荷管理器，支持从远程仓库下载和集成自定义代理及命令配置文件。 该平台涵盖对抗模拟管理、分布式命令控制以及使用模块化命令配置来在不同目标环境中保持一致的执行行为。

Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red

Godzilla is a post-exploitation toolkit and webshell management framework designed for remote administration, credential extraction, and memory shell injection. It provides a centralized platform to deploy, control, and monitor encrypted remote access scripts across multiple server environments. The project differentiates itself through a memory shell injector that loads binaries and shellcode directly into server memory to avoid disk-based detection. It also employs polyglot payload injection, deploying encrypted scripts across various language environments to maintain persistent connections