AHXR/ghost

Health v2 · maintenance only

Adoption not part of the score

1058 stars · 226 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Ghost is a lightweight Remote Access Trojan (RAT) written in C++ that gives an attacker silent remote command-line access to Windows machines, along with hidden download-and-execute capabilities for spreading malware. It is explicitly framed as an educational project demonstrating botnet and backdoor techniques.

Use cases

• study how remote access trojans and botnets work
• set up a command-and-control server in a malware analysis lab
• demonstrate silent remote command execution on Windows VMs
• learn C++ socket programming and Windows persistence techniques
• test antivirus and endpoint detection against a known RAT
• teach cybersecurity students about backdoor behavior

When to choose

• you need a simple, readable C++ codebase for malware education or red-team training
• you want a minimal C2/zombie example to analyze in a sandboxed lab
• you are researching Windows startup persistence and stealth techniques

When to avoid

• you need a legitimate remote administration tool for managing real machines - use SSH, RMM, or PowerShell remoting instead
• you want a modern, maintained framework - the last release was 2021 and it uses weak substitution-cipher encryption
• you intend to deploy it against systems you do not own - that is illegal
• you need cross-platform support - it targets Windows only

Facets

application · maturity maintenance

security penetration-testing networking cli security penetration-testing windows windows cpp cli rat remote-access-trojan botnet backdoor malware-research c2-server educational

Member repositories

For agents

markdown · JSON · MCP: product_card(name="AHXR/ghost")