Persistence Mechanisms

1ndevelopment/ghostlock-s26

GhostLock (CVE-2026-43499) app for the Galaxy S26 series

bishopfox/sliver

Adversary Emulation Framework

s3n4t0r-0x0/bear-c2

The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a…

peass-ng/peass-ng

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

hfiref0x/kdu

Windows kernel driver utility that abuses vulnerable signed drivers (BYOVD) to bypass DSE, load unsigned drivers, hijack protected processes, and…

capture0x/adstrike

AI-powered modular Active Directory red-team framework for authorized penetration testing, AD enumeration, attack-path analysis, Kerberos/ADCS…

bc-security/empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.

lyravoid/folkpatch

Root access to the kernel can be achieved simply by patching the Boot partition for reflashing. This solution is based on a non-parallel extended…

bmax121/apatch

The patching of Android kernel and Android system

rapid7/metasploit-payloads

Unified repository for different Metasploit Framework payloads

deadexpl0it/cve-2026-78006-poc

POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

rapid7/metasploit-framework

Open-source exploitation framework with modular payload, encoder, and auxiliary system for penetration testing, vulnerability validation, and…

mythicagents/xenon

A Mythic agent for Windows written in C

nil0x42/phpsploit

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor

dagowda/notrdp

Havoc C2 plugin that creates a hidden Windows desktop, streams it to a browser viewer, and injects mouse/keyboard input for covert remote control.

a2333c/dfroot

Android root tool for Samsung Galaxy S25 Ultra (SM-S938B) that chains DirtyFrag CVE-2026-43284 and CVE-2026-43499 to gain root automatically at boot…