#1Tools for maintaining long-term access to compromised systems, even after reboots.
Kitploit recommended
nccgroup/winpayloadsUndetectable Windows Payload Generation
b23r0/heroinnA cross platform C2/post-exploitation framework.
bytecode77/r77-rootkitFileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
nil0x42/phpsploitFull-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
calebstewart/pwncatPost-exploitation platform automating enumeration, privilege escalation, persistence, and C2 operations via reverse/bind shells with cross-platform…
harleyqu1nn/aggressorscriptsCollection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources
4w4k3/beeloggerGenerate Gmail Emailing Keyloggers to Windows.
snaffcon/snafflera tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )
matterpreter/offensivecsharpCollection of Offensive C# Tooling
trustedsec/cs-remote-ops-bofRemote operations commands implemented using Beacon Object Files
lyravoid/folkpatchRoot access to the kernel can be achieved simply by patching the Boot partition for reflashing. This solution is based on a non-parallel extended…
jkornev/hiddenWindows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc
sweetsoftware/aresPython botnet and backdoor
gianlucaborello/libprocesshiderLD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.
reverseclabs/sharpgpoabuseSharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order…
cobbr/sharpsploitSharpSploit is a .NET post-exploitation library written in C#
med0x2e/sigflipSigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.
