A cross-platform, collaborative C2 for red-teaming. Agents are cross-compilable (e.g, you can generate Windows DLLs on Linux), cross-compatible, and built with evasion, anti-analysis and stability in mind. All capabilities are natively implemented from scratch.
☆23Mar 7, 2025Updated last year
Alternatives and similar repositories for Hydrangea-C2-Payloads
Users that are interested in Hydrangea-C2-Payloads are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Brute Ratel External C2 (Microsoft Teams)☆38Dec 11, 2024Updated last year
- Evasive loader for .NET Framework assemblies☆82May 12, 2026Updated 2 months ago
- ACE Analyzer for identifying ESC1-8 vulnerabilities (Written by AI)☆42Jul 4, 2026Updated 2 weeks ago
- Phantom Keylogger is an advanced, stealth-enabled keystroke and visual intelligence gathering system.☆77Dec 10, 2025Updated 7 months ago
- C++ tool and library for converting .bin files to shellcode in multiple output formats.☆33Aug 18, 2025Updated 11 months ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- PowerShell toolkit for AMSI/Defender detection-boundary analysis — maps byte offsets to detection triggers in scripts and binaries. Compa…☆36Updated this week
- rust clr heap encryption (https://github.com/lap1nou/CLR_Heap_encryption), but no heap encryption.☆17Jan 6, 2024Updated 2 years ago
- Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques☆130Dec 28, 2025Updated 6 months ago
- Power Automate C2 (PAC2) : Stealth living-off-the-cloud C2 framework.☆39Apr 16, 2024Updated 2 years ago
- Scripts to interact with Microsoft Graph APIs☆46Nov 7, 2024Updated last year
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆80Dec 23, 2023Updated 2 years ago
- Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advance…☆113Jun 30, 2026Updated 3 weeks ago
- ☆52Jul 12, 2026Updated last week
- Slides and resources from MCTTP 2025 Talk☆70Oct 26, 2025Updated 8 months ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- rShellZ s a linux reverse-shell & exploitation assistance framework. With lots of payload and post exploitation modules.☆13Dec 13, 2023Updated 2 years ago
- A curated collection of Living off the Land (LotL) attack demonstrations where trusted binaries go rogue, because if it didn’t launch cal…☆37Jan 7, 2026Updated 6 months ago
- Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.☆85Jun 15, 2026Updated last month
- A shellcode loader generator with support for multiple injection techniques, built for red team engagements.☆98Jul 1, 2026Updated 3 weeks ago
- Surgical UNWIND_INFO preservation for sleep masking without call stack spoofing.☆56Mar 30, 2026Updated 3 months ago
- Async BOF to capture KeePass master passwords by detecting and keylogging locked database windows.☆49Updated this week
- Agent for AdaptixC2 with focus in evasion, capability and malleable.☆224Apr 26, 2026Updated 2 months ago
- Beacon Object File (BOF) for Windows Session Hijacking via IHxHelpPaneServer COM☆71Dec 25, 2025Updated 6 months ago
- Memory API proxy via signed mozglue.dll☆40Jun 25, 2026Updated 3 weeks ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Exploit for ToolShell☆15Nov 20, 2025Updated 8 months ago
- Encode shellcode as XML-looking data. Single-header C library with a two-stage PIC loader example.☆15Feb 11, 2026Updated 5 months ago
- Another new coercion primitive with LPE - machine-account NTLM coercion from a non-admin user via Windows Store InstallService plugin res…☆87Jun 20, 2026Updated last month
- Advanced OPSEC fork of Donut. Features a Custom in-memory CLR Host, Tail-Jump ETW bypasses, and zero-patch AMSI evasion for stealthy shel…☆71Jun 24, 2026Updated last month
- Monarch - The Adversary Emulation Toolkit☆64Jan 7, 2025Updated last year
- Boilerplate to develop raw and truly Position Independent Code (PIC).☆118Jan 20, 2025Updated last year
- DynLoader A modular Windows loader focused on EDR evasion Built with indirect syscall (Tartarus Gate / Hell’s Gate), Manual PE parsing …☆77Jul 10, 2026Updated 2 weeks ago
- Detect Remote Local Credentials Dumping using a Shadow Snapshot☆32Jan 27, 2025Updated last year
- An aggressor script that tracks operational changes made during a red team engagement. Gives you a full audit trail of what was changed a…☆27May 21, 2026Updated 2 months ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Sleep Obfuscation☆45Oct 13, 2022Updated 3 years ago
- poc for cve-2025-53772☆46Dec 10, 2025Updated 7 months ago
- ☆159Jun 20, 2026Updated last month
- A portable C# utility for enumerating local and remote windows sessions☆57Jan 1, 2026Updated 6 months ago
- Templates for developing your own listeners and agents for AdaptixC2.☆56Feb 28, 2026Updated 4 months ago
- A PoC Cobalt Strike UDRL written in Rust☆32Jun 20, 2026Updated last month
- WinMan - An Offline WIN/NT API Documentation☆29Jul 8, 2026Updated 2 weeks ago