Mr-Un1k0d3r/SCShell

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1655 stars · 259 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SCShell is a fileless lateral movement tool that executes commands on remote Windows systems by modifying a service's binary path via ChangeServiceConfigA over DCERPC, without SMB authentication or dropping files. It includes a C utility and a Python implementation supporting pass-the-hash via Impacket.

Use cases

• perform fileless lateral movement on Windows networks
• execute remote commands without creating or registering services
• run payloads over DCERPC instead of SMB
• pass the hash to move laterally with Impacket
• red team remote command execution on Windows hosts

When to choose

• you need stealthy, fileless remote execution on Windows during authorized penetration tests
• you want to avoid SMB authentication and service creation artifacts
• you need pass-the-hash lateral movement support

When to avoid

• you need a defensive or detection tool rather than an offensive one
• you lack authorization to test the target systems
• you need a maintained tool with active development and a license

Facets

cli-tool · maturity maintenance

security penetration-testing security penetration-testing windows windows python cli lateral-movement fileless dcerpc pass-the-hash red-team offensive-security service-abuse

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Mr-Un1k0d3r/SCShell")