#1Tools for maintaining long-term access to compromised systems, even after reboots.
Kitploit recommended
psmths/reaveWIP Post-exploitation framework tailored for hypervisors.
stillbigjosh/adaptix-serverless-c2Serverless C2 transport plugin for AdaptixC2 v1.2 using AWS Lambda + DynamoDB as the relay infrastructure.
yschgroup/skyratSkyRAT - Powershell Remote Administration Tool
snothin/ghostlock-s26GhostLock (CVE-2026-43499) for the Galaxy S26
mustafadalga/wildloggerThis is a keylogger that collects all the data and e-mail it in a set time with system information which includes device S/N and hardware specs,…
rootup/git-fsmonitorThis is a proof-of-work for abusing "fsmonitor" against IDE.
karmanya03/overthroneAll-Rust Active Directory exploitation framework: LDAP/SMB/Kerberos enumeration, attack-graph pathfinding, Kerberoasting, NTLM relay, ticket forging,…
gsoffmarket/malvinciThis simple but powerful script will introduce a new type of malware that will turn off the firewall, start an HTTP server, forward its port through…
al1ex/monitorA old way to Persistence
aldisakti2/cve-2025-8088-builder-winrar-toolCVE-2025-8088-BUILDER
mwsrc/schwarze-sonne-ratSS-RAT (Schwarze-Sonne-Remote-Access-Trojan)
knight0x07/poc-malware-ttpsPoC-Malware-TTPs
hackerhouse-opensource/nofaxgivenCode Execution & Persistence in NETWORK SERVICE FAX Service
carsonchan12345/cve-2024-37726-msi-center-local-privilege-escalationProof-of-concept for CVE-2024-37726: local privilege escalation in MSI Center via arbitrary file overwrite using symlink/junction attacks and OpLock…
knight0x07/winrar-cve-2025-8088-poc-rarWinRAR 0day CVE-2025-8088 PoC RAR Archive
tomiwa-ot/telegram-c2Control a system remotely via telegram
jgoyd/glass-cage-ios18-cve-2025-24085-cve-2025-24201Glass Cage is a zero-click PNG-based RCE chain in iOS 18.2.1, bypassing LockDown mode protection by exploiting ImageIO (CVE-2025-43300), then…
sbousseaden/edrunchokerEDRUnChoker - fileless WMI defense that removes EDRChoker QoS throttling policies
