Cn33liz/p0wnedShell

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1550 stars · 335 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

p0wnedShell is a C# offensive PowerShell host application that runs PowerShell commands and modules within a runspace environment without relying on powershell.exe. It bundles many post-exploitation tools for attacking Active Directory environments and demonstrating attack techniques to blue teams.

Use cases

• run post-exploitation PowerShell tools without powershell.exe
• bypass application whitelisting like AppLocker
• masquerade the shell process as a legitimate binary like notepad.exe
• spawn a shell with system privileges using a custom parent process ID
• perform modern Active Directory attacks for red team exercises
• build blue team awareness of offensive PowerShell techniques

When to choose

• you need an all-in-one post-exploitation toolkit for Windows and Active Directory environments
• powershell.exe is blocked and you need a runspace-based PowerShell host
• you want to demonstrate offensive techniques to train defensive teams

When to avoid

• you need a maintained tool with recent updates and active support
• your target is not Windows or you cannot compile/run .NET binaries
• you require stealth against modern EDR solutions beyond what this 2019-era tool provides

Facets

application · maturity maintenance

security penetration-testing cli security penetration-testing windows windows dotnet post-exploitation powershell-runspace red-team offensive-security applocker-bypass process-masquerading active-directory

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Cn33liz/p0wnedShell")