nccgroup/Winpayloads

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1616 stars · 327 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Winpayloads is a Python 2.7 tool for generating undetectable Windows payloads with extras like UAC bypass, persistence, and PowerShell stagers. It integrates with Metasploit and popular PowerShell post-exploitation scripts and is now primarily distributed via Docker.

Use cases

• generate undetectable windows payloads for penetration testing
• bypass antivirus detection on windows targets
• bypass uac on compromised windows machines
• add persistence to a payload that survives reboot
• invoke powershell payloads in memory with a stager
• spray psexec with stolen hashes across a network
• create custom shellcode payloads for red team engagements

When to choose

• you are doing authorized penetration testing or red teaming against Windows targets
• you need payload generation with AV evasion, UAC bypass, and persistence in one tool
• you work from Kali Linux and already use Metasploit

When to avoid

• you need a maintained tool - it runs on deprecated Python 2.7 and development is stale
• you are not authorized to test the target systems - this is offensive tooling
• you need modern evasion against current EDR/AV, as detection rates have grown

Facets

cli-tool · maturity maintenance

security penetration-testing security penetration-testing windows cli payload-generation antivirus-bypass metasploit powershell uac-bypass persistence red-team linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="nccgroup/Winpayloads")