# mdsecactivebreach/SharpShooter

Payload Generation Framework

Repository: https://github.com/mdsecactivebreach/SharpShooter
Canonical: https://ross.abutalabs.com/products/sharpshooter
Language: VBA
License: BSD-3-Clause
License Family: permissive
Last push: 2024-08-21T12:09:54+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3102, "days_push": 742, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1988, forks 368 (observed 2026-08-28T04:06:02.881018+00:00)

## What it is
SharpShooter is a payload creation framework for retrieving and executing arbitrary CSharp source code, generating payloads in formats like HTA, JS, VBS, WSF, VBA, and Excel 4 macros. It supports staged and stageless delivery via web or DNS, RC4 encryption, sandbox detection, AMSI bypass, and HTML smuggling for red team operations.

## Use cases
- generate malicious document payloads for red team engagements
- create HTA, JS, VBS or WSF payloads that execute shellcode
- deliver payloads via web or DNS staging
- bypass AMSI and evade antivirus detection in penetration tests
- embed payloads in HTML files using HTML smuggling
- generate macro-enabled Office documents with embedded shellcode

## When to choose
- you are a red teamer needing script-based payload generation for Windows targets
- you need staged or stageless shellcode execution across multiple scripting formats
- you want sandbox evasion and environment keying built into payloads

## When to avoid
- you need a defensive or detection tool rather than offensive payload generation
- you target non-Windows platforms, since it relies on .NET and Windows scripting hosts
- you want a maintained tool with modern evasion guarantees, as techniques like AMSI bypass may be outdated

## Facets
- artifact type: framework
- maturity: maintenance
- function: penetration-testing, security
- domain: security, penetration-testing
- platform: windows, python, cli
- tags: payload-generation, red-team, offensive-security, shellcode, macro-payloads, amsi-bypass, html-smuggling, dotnettojscript

## Member repositories
- mdsecactivebreach/SharpShooter (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:02.881018+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:02:58.883367+00:00, confidence not recorded.
  - readme: https://github.com/mdsecactivebreach/SharpShooter (fetched 2026-08-28T04:06:02.881018+00:00, sha 02d9a920944e)
- Data as of 2026-08-30T08:39:29.467469+00:00.