lem0nSec/ShellGhost

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1200 stars · 140 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ShellGhost is a proof-of-concept memory-based evasion technique written in C that keeps shellcode invisible in memory from process start to end. It uses Vectored Exception Handling and software breakpoints to decrypt and execute shellcode instructions one at a time, defeating memory scanners like PE-Sieve and Moneta.

Use cases

• evade EDR memory scanners during red team operations
• execute shellcode without exposing it in memory
• demonstrate AV/EDR evasion concepts
• hide payload from PE-Sieve and Moneta scans
• implement breakpoint-based shellcode mapping
• run reverse shells undetected in memory

When to choose

• you need a red team POC for in-memory shellcode evasion
• you want to study Vectored Exception Handling-based evasion techniques
• you need shellcode that never appears fully decrypted in memory

When to avoid

• you need production-ready, supported tooling
• your use case is defensive security rather than offensive testing
• you target non-Windows platforms

Facets

library · maturity experimental

security cryptography security penetration-testing developer-tools windows cpp shellcode edr-evasion red-team vectored-exception-handling memory-evasion offensive-security

Member repositories

For agents

markdown · JSON · MCP: product_card(name="lem0nSec/ShellGhost")