security enabled verified high v1.0.0

pupy

Cross-platform remote administration and post-exploitation framework written in Python, supporting in-memory execution, multiple transports, and extensible modules.

📋 Live Preview 
pupysh {flags}
📎 flags 
pupysh {flags}

Sandbox: execFile · Timeout: 3600s

Capabilities

agent.communication
command.control.c2
post.exploitation
remote.administration
inmemory.execution

Parameters

Name Type Required Default Description Aliases
flag-l string No - Listener bind address -l, --listen
flag-p integer No - Listener port -p, --port
flag-t string No - Transport type (ssl, http, https, dns, rsa) -t, --transport
flag-s string No - Script or module to execute -s, --script

Contract

Inputs

network.target.ip

Pupy server bind address

network.port.number

Listener port

payload.type

Payload type (Windows/Linux/Android)

Outputs

agent.session

Pupy agent session

credential.data

Extracted credentials

Side effects: network_trafficprocess_spawnfilesystem_write

Workflow Edges

Produces

agent.sessioncredential.data

Consumes

network.target.ipnetwork.port.numberpayload.type

Resource Profile

ResourceValue
CPUmedium
Memory128 MB
Networkhigh
Disk I/Olow

Examples

Start Pupy server

pupysh

Generate Windows payload with SSL transport

pupy --transport ssl -l 0.0.0.0 -p 8443

Generate Android payload

pupy --transport ssl -l 0.0.0.0 -p 8443 --platform android

Documentation

Pupy — Remote Administration C2 Framework

Pupy is a cross-platform remote administration and post-exploitation framework written entirely in Python. It supports in-memory execution, multiple transport protocols (SSL, HTTP, HTTPS, DNS, RSA), and runs on Windows, Linux, macOS, and Android.

Key Features

  • In-memory payload execution
  • Multi-transport support (SSL, HTTP, HTTPS, DNS, RSA)
  • Reflective DLL injection on Windows
  • Linux payload support
  • Android agent support
  • Extensible module system

Common Commands

# Start the Pupy shell interface
pupysh

# Generate a staged payload
pupy --transport ssl -l 0.0.0.0 -p 8443

# Interactive shell access
# Once the agent checks in, list sessions with 'sessions'
# Interact with 'sessions -i <id>'

Dependencies

python3

Related Tools

sliverempiremerlinmetasploit

References