Alternatives and similar repositories for XenoRAT

Users that are interested in XenoRAT are comparing it to the libraries listed below

• HulkOperator / AuthStager
  ☆57Updated 10 months ago
• Mazzy-Stars / lain_c2
  command control framework
  ☆22Updated 2 months ago
• fin3ss3g0d / NativeThreadpool
  Work, timer, and wait callback example using solely Native Windows APIs.
  ☆89Updated last year
• SecTheBit / ZoomBotC2
  ☆43Updated 2 months ago
• Faran-17 / EarlyBird-APC-Injection
  Demonstration of Early Bird APC Injection - MITRE ID T1055.004
  ☆33Updated last year
• almounah / GoDroplets
  Go Shellcode Loader to be Integrated in Exploration C2
  ☆27Updated 7 months ago
• offalltn / gitC2
  POC of GITHUB simple C2 in rust
  ☆52Updated last month
• syncwithali / HavocExploit
  A remote unauthenticated DOS POC exploit that targets the authentication implementation of Havoc.
  ☆38Updated last year
• horizon3ai / CVE-2024-9465
  Proof of Concept Exploit for CVE-2024-9465
  ☆29Updated 10 months ago
• 0xJs / EnumEDRs
  Enumerate active EDR's on the system
  ☆103Updated 2 weeks ago
• Leo4j / PPLKiller
  Tool to bypass LSA Protection (aka Protected Process Light)
  ☆56Updated 8 months ago
• kleiton0x00 / RtlHijack
  Alternative Read and Write primitives using Rtl* functions the unintended way.
  ☆65Updated last week
• NUL0x4C / HookingLsassForCredentials
  Attempting to Hook LSASS APIs to Retrieve Plaintext Credentials
  ☆56Updated 3 months ago
• tehstoni / tryharder
  C++ Staged Shellcode Loader with Evasion capabilities.
  ☆96Updated 11 months ago
• Whitecat18 / earlycascade-injection
  Early cascade injection PoC based on Outflanks blog post written in Rust
  ☆54Updated 7 months ago
• Offensive-Panda / .NET_PROFILER_DLL_LOADING
  .NET profiler DLL loading can be abused to make a legit .NET application load a malicious DLL using environment variables. This exploit i…
  ☆44Updated last year
• EQSTLab / CVE-2024-46538
  PfSense Stored XSS lead to Arbitrary Code Execution exploit
  ☆47Updated 7 months ago
• decoder-it / DFSCoerce-exe-2
  DFSCoerce exe revisited version with custom authentication
  ☆41Updated last year
• EvilBytecode / Ebyte-AMSI-ProxyInjector
  A lightweight tool that injects a custom assembly proxy into a target process to silently bypass AMSI scanning by redirecting AmsiScanBuf…
  ☆57Updated 3 months ago
• T1erno / bin2shellcode
  C++ tool and library for converting .bin files to shellcode in multiple output formats.
  ☆33Updated 2 weeks ago
• nbaertsch / AutoAppDomainHijack
  Automated .NET AppDomain hijack payload generation
  ☆127Updated 7 months ago
• zarkones / BloodfangC2
  Modern PIC implant for Windows (64 & 32 bit)
  ☆103Updated last month
• absholi7ly / CVE-2025-0282-Ivanti-exploit
  CVE-2025-0282 is a critical vulnerability found in Ivanti Connect Secure, allowing Remote Command Execution (RCE) through a buffer overfl…
  ☆48Updated 7 months ago
• 0xTriboulet / rssh-rs
  ☆53Updated 3 months ago
• wolfcod / lsassdump
  lsassdump via RtlCreateProcessReflection and NanoDump
  ☆83Updated 10 months ago
• Offensive-Panda / D3MPSEC
  "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…
  ☆26Updated 11 months ago
• Maldev-Academy / Alphabetfuscation
  Convert your shellcode into an ASCII string
  ☆114Updated 2 months ago
• jsecu / ModTask
  ☆53Updated 8 months ago
• kn0x0x / CVE-2025-32756-POC
  Proof of Concept for CVE-2025-32756 - A critical stack-based buffer overflow vulnerability affecting multiple Fortinet products.
  ☆84Updated 2 months ago
• rasta-mouse / SpawnWith
  ☆110Updated 6 months ago