bats3c/shad0w

SHAD0W is a modular post-exploitation C2 framework designed for covert operations on heavily monitored environments. It leverages Python 3.8 and C, with Donut for payload generation, enabling in-memory execution of .NET assemblies, DLLs, EXEs, JS, VBS, or XSLs. The framework heavily uses dynamically resolved syscalls to bypass userland API hooking, anti-DLL injection to prevent EDR code injection, and Microsoft mitigation methods to protect spawned processes. The C2 server runs inside Docker for cross-platform usage, communicates over HTTPS with a JSON-based protocol, and features a live proxy/mirror that mimics a real website to disguise traffic. Beacons support multiple formats (EXE, PowerShell, shellcode), process injection, and proxy-aware callbacks. Included modules range from privilege escalation (Elevate), ETW/Sysmon disabling (Ghost in the Logs), credential theft (Mimikatz), to reverse SOCKS proxy (SharpSocks) and file management (StdAPI).