A no-reboot, in-memory Linux persistence PoC leveraging namespace joining, user-namespace elevation, and self‑deletion.
☆71Aug 6, 2025Updated last year
Alternatives and similar repositories for Linux-persistence
Users that are interested in Linux-persistence are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Sophisticated In-Memory PE loader for Cobalt Strike☆24Jan 24, 2026Updated 9 months ago
- C++ tool and library for converting .bin files to shellcode in multiple output formats.☆34Aug 4, 2026Updated 2 months ago
- A bunch of shenanigans using functions, VEH and more☆38Jun 8, 2025Updated last year
- A cross-platform, collaborative C2 for red-teaming. Agents are cross-compilable (e.g, you can generate Windows DLLs on Linux), cross-comp…☆23Mar 7, 2025Updated last year
- various methods of making API calls☆19Feb 1, 2025Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 4 months ago
- ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code.☆136Apr 13, 2025Updated last year
- Cuban Eight is a red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer. Double-click t…☆30Oct 16, 2026Updated 2 weeks ago
- ☆72Jul 12, 2026Updated 3 months ago
- COM Windows Persistence Technique☆90Apr 27, 2026Updated 6 months ago
- Remote DLL Injection with Timer-based Shellcode Execution☆214Jul 18, 2025Updated last year
- TCP Port Forwarding Utility on C☆42Jun 18, 2026Updated 4 months ago
- Modern PIC implant for Windows (64 & 32 bit)☆103Jul 23, 2025Updated last year
- Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.☆67Updated this week
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Precision call-stack spoofing gadget hunter for x64 DLLs, powered by Iced disassembler☆20Jul 2, 2026Updated 3 months ago
- A lightweight Command and Control (C2) framework built for offensive security research and red teaming (Post Exploitation).☆68Dec 17, 2025Updated 10 months ago
- GhostHound is a BloodHound OpenGraph extension that surfaces Active Directory tombstone reanimation as a first-class attack path, enumera…☆47Aug 9, 2026Updated 2 months ago
- Automatically Download & Compile Useful BOFs for CS☆27Jul 29, 2026Updated 3 months ago
- Repository for various Beacon Object Files (BOFs)☆173Oct 22, 2026Updated last week
- ☆150Nov 6, 2025Updated 11 months ago
- Python based GUI for browsing LDAP☆184Jul 30, 2026Updated 3 months ago
- multi layer encryption for payloads with options of delivery welcome to the Tenebris side☆27May 9, 2026Updated 5 months ago
- A BOF designed to inspect processes memory and addresses☆42Apr 19, 2026Updated 6 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Beacon Object File (BOF) for Windows Session Hijacking via IHxHelpPaneServer COM☆72Dec 25, 2025Updated 10 months ago
- Research notes on Windows Component Object Model (COM) attack surface for offensive security and vulnerability research. Covers COM hijac…☆164Jul 20, 2026Updated 3 months ago
- Pack/Encrypt/Obfuscate ELF + SHELL scripts☆460Apr 11, 2026Updated 6 months ago
- Novel Windows process injection: assembles existing open handles (process & thread), natural RWX regions, and special user APC (NtQueueAp…☆81Feb 17, 2026Updated 8 months ago
- ☆55May 31, 2025Updated last year
- PoC that downloads an executable from a public SSL certificate☆138Jul 27, 2025Updated last year
- Chisel new generation, written in rust. SSH under WSS with some customization.☆138Jan 24, 2026Updated 9 months ago
- Selective In-Memory Syscall Unhooking, a stealthy method to bypass user-mode hooks in ntdll.dll☆46Mar 11, 2026Updated 7 months ago
- Brute Ratel External C2 (Microsoft Teams)☆38Dec 11, 2024Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Reflective PE loader written in Zig. Loads and executes native and .NET PE files directly from memory.☆66Mar 2, 2026Updated 7 months ago
- Using Just In Time (JIT) instruction decryption, this shellcode loader ensures that only the currently executing instruction is visible i…☆69Apr 2, 2025Updated last year
- A tool to convert windows registry export files into windows hive files that can be used to replace NTUSER.MAN☆223Jan 26, 2026Updated 9 months ago
- This is a project aimed to make every other Saas product a C2, confluence is just the beginning.☆21Oct 21, 2026Updated last week
- Lab research on Windows loader internals, PE loading, stack artifacts, and execution tradeoffs.☆246May 4, 2026Updated 5 months ago
- Vulnerable (on purpose) programs to leak NtReadVirtualMemory address for stealthier API resolution (no GetProcAddress, GetModuleHandle or…☆42Dec 22, 2025Updated 10 months ago
- a burp extension for dynamic payload generation to detect injection flaws (RCE, LFI, SQLi), creates access matrix based user sessions to …☆16Apr 25, 2022Updated 4 years ago