mdsecactivebreach/CACTUSTORCH

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1017 stars · 220 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

CACTUSTORCH is a payload generation tool that produces JavaScript, VBScript, and VBA shellcode launchers for adversary simulations. It spawns a 32-bit host binary (e.g. rundll32.exe) and injects raw shellcode into it, with Cobalt Strike integration via an aggressor script.

Use cases

• generate vbscript shellcode launcher for red team engagement
• inject shellcode into rundll32 for adversary simulation
• create word macro payload that runs shellcode
• host cactustorch payload from cobalt strike
• emulate attacker payload delivery in penetration test

When to choose

• you need script-based (js/vbs/vba) shellcode execution on Windows for authorized red team exercises
• you use Cobalt Strike or Metasploit and want a quick payload hosting workflow

When to avoid

• you need a maintained tool with active development or a license
• your target environment blocks script execution or you need modern evasion techniques

Facets

cli-tool · maturity maintenance

security penetration-testing security penetration-testing windows shellcode payload-generation adversary-simulation red-team vbscript javascript dotnettojscript cobalt-strike

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mdsecactivebreach/CACTUSTORCH")