PoshC2
defcon27_csharp_workshop
| PoshC2 | defcon27_csharp_workshop | |
|---|---|---|
| 1 | 1 | |
| 1,692 | 952 | |
| 0.4% | - | |
| 0.0 | 10.0 | |
| 17 days ago | about 2 years ago | |
| PowerShell | C# | |
| BSD 3-clause "New" or "Revised" License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
PoshC2
-
Sketchy stuff lately?
PowerShell has never been used for nefarious purposes. ;-)
defcon27_csharp_workshop
What are some alternatives?
Empire - Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
PipeViewer - A tool that shows detailed information about named pipes in Windows
Empire - Empire is a PowerShell and Python post-exploitation agent.
frostbyte - FrostByte is a POC project that combines different defense evasion techniques to build better redteam payloads
Invoke-MetasploitPayload - Powershell script to download and kick off Metasploit payloads. Relies on the exploit/multi/scripts/web_delivery metasploit module.
LocalAdminSharp - .NET executable to use when dealing with privilege escalation on Windows to gain local administrator access
empire - A PaaS built on top of Amazon EC2 Container Service (ECS)
Sandman - Sandman is a NTP based backdoor for red team engagements in hardened networks.
ConPtyShell - ConPtyShell - Fully Interactive Reverse Shell for Windows
CIMplant - C# port of WMImplant which uses either CIM or WMI to query remote systems
PowerShell-Botnet - A POC powershell botnet
nishang - Nishang - Offensive PowerShell for red team, penetration testing and offensive security.