lintstar/LSTAR

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1266 stars · 167 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

LSTAR is a comprehensive Cobalt Strike post-exploitation Aggressor plugin written in PowerShell and CNA. It consolidates host information gathering, intranet pivoting, privilege escalation, persistence, and credential capture into a single right-click menu.

Use cases

• run post-exploitation commands from a Cobalt Strike beacon menu
• pivot through non-internet-facing hosts via TCP, SMB, and proxy tunnels
• escalate privileges with potato-style exploits to SYSTEM
• maintain access with hidden scheduled tasks and shadow users
• capture credentials with AV-evading Mimikatz and lsass dumps
• collect host info and detect installed antivirus software
• scan intranet for live hosts across SMB, WMI, SNMP, HTTP, DNS protocols
• retrieve Sunflower remote-desktop credentials

When to choose

• you operate Cobalt Strike during authorized red-team engagements or security research
• you want one plugin covering the path from initial beacon to domain controller
• you need multiple AV-bypass execution options for common post-exploitation actions

When to avoid

• you use a C2 framework other than Cobalt Strike
• you need a maintained tool - the last release was January 2022 and there is no license
• your use is not authorized security testing - this is offensive tooling

Facets

plugin · maturity maintenance

security penetration-testing developer-tools security penetration-testing windows windows cli cobaltstrike aggressor-script post-exploitation red-team privilege-escalation lateral-movement mimikatz cna

Member repositories

For agents

markdown · JSON · MCP: product_card(name="lintstar/LSTAR")