khaos-c2
28zaaky/khaos-c2KHAOS is a modern C2 framework that routes agent traffic through cloud services already trusted by enterprise networks.
command-and-controllateral-movementpayload-development+5
28zaaky/khaos-c2KHAOS is a modern C2 framework that routes agent traffic through cloud services already trusted by enterprise networks.
s3n4t0r-0x0/bear-c2The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a…
ly1g3/proofpoint-cve-2023-0089Proofpoint Email Gateway: Low level authenticated user to admin RCE
error-inside/cve-2026-10520Root-Level RCE via OS Command Injection in Ivanti Sentry
abc1230940/soc336-windows-ole-zero-click-rce-exploitation-detected-cve-2025-21298SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough
ttpreport/ligolo-mpMultiplayer pivoting solution
tdragon6/supershellSupershell C2 远控平台，基于反向SSH隧道获取完全交互式Shell
ineesdv/tangledOpen-source offensive security platform for conducting phishing campaigns that weaponizes iCalendar automatic event processing.
p3nt4/invoke-socksproxySocks proxy, and reverse socks server using powershell.
yeeb1/socktailLightweight Go binary that joins a device to a Tailscale network and exposes a local SOCKS5 proxy for ephemeral red team access. Supports…
leo4j/amnesiacPowerShell-based post-exploitation framework for lateral movement in Active Directory environments. Executes in-memory with named-pipe command…
nettitude/poshc2A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.
u53rw4r3/remotekeystrokesA script to automate keystrokes through a graphical desktop program.
0nyx-my7h/cve-2025-43920PoC and technical write-up for CVE-2025-43920, a remote command injection in GNU Mailman 2.1.39's external archiver allowing unauthenticated code…
skelsec/evilrdpRDP client with extended control for automated mouse, keyboard, and clipboard manipulation, file transfer, SOCKS proxy, and remote command execution…
rasta-mouse/spawnwithCobalt Strike BOF that spawns a process using another user's token and injects Beacon shellcode, enabling post-exploitation and lateral movement via…
h3x0v3rl0rd/xll_windows_reverse_shellxll windows reverse shell
jump-wang-111/amzwordAn automated attack chain based on CVE-2022-30190, 163 email backdoor, and image steganography.