#1Tools for maintaining long-term access to compromised systems, even after reboots.
Kitploit recommended
ne0nd0g/merlinMerlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
bmax121/apatchThe patching of Android kernel and Android system
tc4dy/cve-2026-6875-poc-exploitCVE-2026-6875 ServiceNow Pre-Auth RCE Framework 🔥 JS Injection → Sandbox Escape → RCE → Root. Features: --detect, --exec, reverse/interactive shell,…
b23r0/heroinnA cross platform C2/post-exploitation framework.
lyravoid/folkpatchRoot access to the kernel can be achieved simply by patching the Boot partition for reflashing. This solution is based on a non-parallel extended…
nikopmpm/fsociety-cve-2024-0670-checkmk-lpe🔍 Exploit CVE-2024-0670 in CheckMK agents for local privilege escalation using a robust C++ tool designed for security professionals.
its-a-feature/mythicA collaborative, multi-platform, red teaming framework
tc4dy/cve-2026-64638-poc-exploit🛡️ CVE-2026-64638 - WordPress Security Assessment Suite (CVSS 8.9) | WordPress 4.7.0-7.0.2 pentest toolkit. Includes vulnerability assessment &…
tc4dy/cve-2026-65643-poc-toolkitRed/Blue team toolkit for CVE-2026-65643, a cPanel domain parking RCE. Includes exploit with reverse shell, webshell, persistence, and mass scanning,…
idov31/silversealLinux post-exploitation framework with a UEFI bootkit that persistently and stealthily loads a Rust-based kernel module rootkit on modern Linux…
kamalx06/tornadorevc2Modular post-exploitation framework managing reverse-shell sessions over TCP/TLS/mTLS with plugins for enumeration, in-memory execution, SOCKS5…
snothin/ghostlock-s26GhostLock (CVE-2026-43499) for the Galaxy S26
kaandemir993/python-shellcode-anydesk-apc-injection-remote-ip-address-analysisReverse engineering write-up of Python shellcode that APC-injects into AnyDesk, exfiltrates to a C2 over HTTPS with AES/RSA, and persists via…
kyle41111/ai-fileA listener profile for the Mythic C2 framework that utilizes AI vendors file API's
shadowforge-cyber/cve-2026-104286-pocUnauthenticated path traversal exploit for CVE-2026-104286 in FortiMail, writing arbitrary files via crafted HTTP/HTTPS requests for red team…
wonjj6768/lenovo-tb365fc-ghostlock-cve-2026-43499GhostLock (CVE-2026-43499) root + KernelSU LKM for the Lenovo TB365FC (ZUXOS / Android 16, kernel 5.15.170)
kaill-jlq/mmskillriskBenchmark and evaluation harness testing whether LLM agents resist malicious instructions hidden in multimodal skill images, with 108 cases across…
g13net/lockjawModular Windows C2 framework with a Rust teamserver, Zig implant, indirect syscalls, AMSI bypass, reflective/PoolParty injection, in-memory BOF…
