Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
RedPeanut is a small RAT developed in .Net Core 2 and its agent in .Net 3.5 / 4.0.
| Date | Stars |
|---|---|
| 2026-07-31 | 330 |
| 2026-08-19 | 330 |
| 2026-09-06 | 331 |
| 2026-09-17 | 330 |
| 2026-09-20 | 330 |
Today
— stars today
This week
-1 stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# RedPeanut ``` __________________________________________________________________________ ooooooo________________oo_ooooooo___________________________________oo____ oo____oo___ooooo___oooooo_oo____oo__ooooo___ooooo__oo_ooo__oo____o__oo____ oo____oo__oo____o_oo___oo_oo____oo_oo____o_oo___oo_ooo___o_oo____o_oooo___ ooooooo___ooooooo_oo___oo_oooooo___ooooooo_oo___oo_oo____o_oo____o__oo____ oo____oo__oo______oo___oo_oo_______oo______oo___oo_oo____o_ooo___o__oo__o_ oo_____oo__ooooo___oooooo_oo________ooooo___oooo_o_oo____o_oo_ooo____ooo__ __________________________________________________________________________ ________________________________________________RedPeanut_v0.3.0___@b4rtik __________________________________________________________________________ ``` - - - - Currently being tested. Known modules Issues: process -> spawnasagent process -> spawnasshellcode - - - - RedPeanut is a small RAT developed in .Net Core 2 and its agent in .Net 3.5 / 4.0. RedPeanut code execution is based on shellcode generated with [DonutCS](https://github.com/n1xbyte/donutCS). It is therefore a hybrid, although developed in .Net it does not rely solely on the Assembly.Load. This increases the detection surface, but allows us to practice and experiment with various evasion techniques related to the dotnet environment, process management and injection. This behavior can be changed at rutime with the "managed" and "unmanaged" commands. If you are interested in a .Net C2 Framework that is consistent and can be used in an enagement, I suggest [Covenant](https://github.com/cobbr/Covenant). RedPeanut is weaponized with: * GhostPack * SharpGPOAbuse * SharpCOM * EvilClippy * DotNetToJS * SharpWeb * Modified version of PsExec * SharpSploit * TikiTorch ## RedPeanut Agent The RedPeanut agent can be compiled in .Net 3.5 and 4.0 and has pivoting capabilities via NamedPipe. The agent, when executed in an unmanaged mode, performs its own critical tasks in a separate process to prevent the AV response to detection or error during execution make you lose the whole agent. The execution flow is as follow: 1. Process creation 2. Inject static shellcode generated with DonutCS 4. The loader loads and executes the stager or module The agent currently only supports https channel. ## C2 Channel The agent checkin protocol is very simple: 1. The stager requires an agent id, the message is encrypted with RC4 with the shared serverkey 2. The server decrypt the message, compile and sends the agent, generate and send KEY and IV for future communications AES encryption, the message is encrypted RC4 3. The stager decrypt the message and load the agent via Assembly.Load 4. The agent sends a checkin message to the server, the message is encrypted with AES Alternatively, the covered channel feature can be activated(at the moment it is just a PoC). The idea is to imitate the web traffic carried out by a real user. Usually a web page is composed of the html page and all the objects necessary for its display as css, images, etc. At the request of a new task the answer from the server will not be directly the encrypted task but an html page from which to extract the link to the image that will have embedded the encrypted task. The http request for the image will contain the Referer header. ## Content delivery Content delivery is organized in 4 channels: 1. C2 Channe customizable via profile 2. Dynamic content generated/managed by RedPeanut customizable via profile 3. Static content mapped to /file/ 3. Covered channel for the recovery of the image containing the payload mapped to /images/ ## Profiles RedPeanut capability of customization of network footprint both server side and client side. The properties that can be set are: * _General_ * Delay (between requests) * ContentUri (url of dynamic content eg. dll hta etc.) * UserAgent * Spawn (the process to create to perform critical tasks) * HtmlCovered (Enable covered channel) * TargetClas
Excerpt of 12,187 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
Not classified yet. Classification runs as part of npm run ingest.