bats3c/shad0w

Health v2 · maintenance only

Adoption not part of the score

2179 stars · 330 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SHAD0W is a modular post-exploitation C2 (command and control) framework written in Python and C, designed to operate covertly in heavily monitored environments. It evades EDR and AV using syscalls, process injection, and in-memory execution of .NET assemblies via Donut, with encrypted HTTPS beacon communication.

Use cases

• run a covert C2 server for red team operations
• evade EDR and AV during penetration tests
• execute .NET assemblies fully in memory on Windows targets
• bypass userland API hooking with dynamically resolved syscalls
• mirror a legitimate website to disguise C2 traffic
• steal credentials with Mimikatz through a beacon
• disable Sysmon and ETW logging on a compromised host
• exfiltrate files over an encrypted HTTPS channel

When to choose

• you need a free, modular, Docker-based C2 for authorized red team engagements
• you want in-memory execution of offensive tooling to avoid detection
• you need HTTPS-encrypted beacon traffic with proxy awareness
• you want a CLI-driven C2 with extensible Python modules

When to avoid

• you need a commercially supported C2 with enterprise guarantees
• you want a actively maintained tool - the last release was 2021 and the project is beta
• you lack authorization to test systems - this is offensive tooling
• you need non-Windows implant support as beacons primarily target Windows

Facets

framework · maturity maintenance

security cryptography cli developer-tools security penetration-testing windows python c c2 red-team post-exploitation edr-evasion av-bypass penetration-testing beacon process-injection shellcode donut command-line docker linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="bats3c/shad0w")