DeEpinGh0st/Erebus

Health v2 · maintenance only

Adoption not part of the score

1568 stars · 219 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Erebus is a post-exploitation plugin for Cobalt Strike written in PowerShell and Sleep (Aggressor Script). It bundles information gathering, privilege escalation exploits, credential theft, browser cookie stealing, and various post-exploitation utilities into the Cobalt Strike beacon menu.

Use cases

• enumerate local privilege escalation vulnerabilities on a Windows target
• run Potato-family UAC bypass and elevation exploits from Cobalt Strike
• steal browser cookies from common Chinese and mainstream browsers
• dump Windows credentials with an AV-evading mimikatz variant
• clear RDP login traces on a compromised host
• enable RDP or turn off the firewall on a target machine
• collect system and user information with Seatbelt-style gathering

When to choose

• you run Cobalt Strike 4.x and want an integrated post-exploitation toolkit
• you need quick Windows privilege escalation and credential access during authorized red-team engagements
• you want browser cookie theft and log-clearing utilities accessible from the beacon right-click menu

When to avoid

• you do not use Cobalt Strike as your C2 framework
• you need a maintained tool - the last release was October 2021 and some async features are known to be buggy
• you require support for non-Windows targets, since most modules are Windows-specific

Facets

plugin · maturity maintenance

penetration-testing security developer-tools security penetration-testing windows windows cross-platform cobalt-strike post-exploitation privilege-escalation red-team c2-plugin powershell offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="DeEpinGh0st/Erebus")