Package: kusanagi
Kusanagi - 草薙TL;DR:kusanagiis a major, bind- and reverse shell payload generator.At its core, it is just a collection of Yaml files that define variousshell commands,code snippets,file specificationsandobfuscators. It combines and permutates all of them to generate
payloads according to someone's need.Payloadsare highly searchable and filterable in order
to generate acode-,file-orcommandinjection with correct binaries for the target architecture
and removed bad chars that might get filtered/denied by certain mechanisms which are in between you and the target (e.g.: web application firewall).
Additionaloutput encodingcan be applied on your generated payloads (Seelist of encoders).Disclaimer:It does have acopy-to-clipboardfunction to eliminate heavy mouse gestures.:tada: Installpipinstallkusanagi:exclamation: Requires Python >= 3.6:hourglass: Current statekusanagiis currently at most an alpha version and in a very early state of development.Feel free to use it, but expect drastic changes in ui and available command line arguments.If you want to support this project, drop me all your payloads and obfuscators you know about.:star: FeaturesYou can find current features here:Automated Quote escapingQuote swappingObfuscationPermutationBadchar eliminationOutput encoderCopy to clipboardCommand injectionCode injectionFile injectionPayload: Persistence wrapperPayload: reverse shellPayload: bind shellPayload: port forwardingBYOY: Bring your own yaml - and have custom payloadsUsageGeneralKusanagi is separated into different usage section. To start off, you will have to choose between a shell command for command injection (cmd), a code snippet from a programming language for code injection (code) and a generated file for various exploits injected into it (file).usage:kusa<payload>[options]addr[host]kusa<payload>-hkusa-v,--versionkusa-h,--help

Kusanagiisabindandreverseshellpayloadgeneratorwithobfuscationandbadcharsupport.

positionalarguments:<payload>cmdGenerateacommandtobeexecutedonashell.codeGeneratesourcecode(e.g.:php).fileInjectsourcecodeinafile(e.g.:phpinjpeg).

miscarguments:-v,--versionShowversioninformationandexit-h,--helpShowthishelpmessageandexitInjectable commands (cmd)Options for command injection/execution module.Click here to expand full usageusage:kusacmd[options]addr[port]kusacmd-h,--help

positionalarguments:addrAddresstolistenorconnectto.port(Optional)PorttolistenorconnecttoDefault:4444queryarguments:-eEXE[EXE...],--exeEXE[EXE...]Commandthatwillexecutethepayload(e.g.:perl,python,php,nc,sh,bash,cmd,PowerShell,etc)Default:donotfilterbyunderlyingcommand.-sSHELL[SHELL...],--shellSHELL[SHELL...]Shellonwhichthecommand(specifiedvia-e)willbeexecuted.Somepayloadsusecrazyoutputredirectionsorpipesthatwillonlyworkoncertainunderlyingshells.(e.g.:dash,sh,bash,zsh,cmd,PowerShell)Default:donotfilterbyunderlyingshell.-bBADCHARS,--badcharsBADCHARSExcludeanypayloadsthatcontainthespecifiedbadchars.ThiscomesinhandyifyouencounteraWebApplicationFirewallthatprohibitscertaincharacters.Default:Ignorebadchars-o{bsd,linux,mac,solaris,windows},--os{bsd,linux,mac,solaris,windows}Onlyfetchpayloadswhichworkonaspecificoperatingsystem.Default:fetchforallOS.-mbytes,--maxlenbytesExcludeanypayloadsexceedingthespecifiedmaxlength.


mutatearguments:--obfRunthefun.Thisswitchwillapplyobfuscatortoallpayloadstogetadifferentsetofbadchars.--encname[name...]Encodetheoutputwithoneormoreencoders.Whenencodingmultipletimes,payattentiontotheorderofspecifyingencoders.Notethatanyfiltering(-b,-o,etc)isnotdoneontheencodedpayload.Filteringisdonebefore.Toviewavailableencoders,use--list-encoders.

helperarguments:-q,--quickShowquickpayloadresults(lessdetail).-c[index],--copy[index]Copylastshownpayloadtoclipboardorspecifyindexofpayloadtocopytoclipboard.(indicesareshowninsquarebracketsnexttopayload)miscarguments:-h,--helpShowthishelpmessageandexitExamples# List reverse shells connecting to 10.0.0.1 (port 4444 by default)kusacmd10.0.0.1# List reverse shells connecting to 10.0.0.1:1337kusacmd10.0.0.11337# Copy last reverse shell payload to clipboardkusacmd10.0.0.1-c# Copy reverse shell with index 2 to clipboardkusacmd10.0.0.1-c2# URL encode reverse shellkusacmd10.0.0.1--encurl# Base64 encode and then url encode reverse shellkusacmd10.0.0.1--encbase64url# Obfuscate payloadskusacmd10.0.0.1--obf# Obfuscated and filter away '/' and '$' characters in payloadkusacmd10.0.0.1--obf-b'/$'Injectable code (code)Options for code injection/execution module.Click here to expand full usageusage:kusacode[options]addr[port]kusacode-h,--help

positionalarguments:addrAddresstolistenorconnectto.port(Optional)PorttolistenorconnecttoDefault:4444queryarguments:-lLANG[LANG...],--langLANG[LANG...]Thepayloadlanguagetoquery.(e.g.:perl,python,php,etc)Default:donotfilterlanguage.-sSHELL[SHELL...],--shellSHELL[SHELL...]Shellonwhichthecommand(specifiedvia-e)willbeexecuted.Somepayloadsusecrazyoutputredirectionsorpipesthatwillonlyworkoncertainunderlyingshells.(e.g.:dash,sh,bash,zsh,cmd,PowerShell)Default:donotfilterbyunderlyingshell.-bBADCHARS,--badcharsBADCHARSExcludeanypayloadsthatcontainthespecifiedbadchars.ThiscomesinhandyifyouencounteraWebApplicationFirewallthatprohibitscertaincharacters.Default:Ignorebadchars-o{bsd,linux,mac,solaris,windows},--os{bsd,linux,mac,solaris,windows}Onlyfetchpayloadswhichworkonaspecificoperatingsystem.Default:fetchforallOS.-mbytes,--maxlenbytesExcludeanypayloadsexceedingthespecifiedmaxlength.


mutatearguments:--obfRunthefun.Thisswitchwillapplyobfuscatortoallpayloadstogetadifferentsetofbadchars.--encname[name...]Encodetheoutputwithoneormoreencoders.Whenencodingmultipletimes,payattentiontotheorderofspecifyingencoders.Notethatanyfiltering(-b,-o,etc)isnotdoneontheencodedpayload.Filteringisdonebefore.Toviewavailableencoders,use--list-encoders.

helperarguments:-q,--quickShowquickpayloadresults(lessdetail).-c[index],--copy[index]Copylastshownpayloadtoclipboardorspecifyindexofpayloadtocopytoclipboard.(indicesareshowninsquarebracketsnexttopayload)miscarguments:-h,--helpShowthishelpmessageandexitExamples# List reverse shells connecting to 10.0.0.1 (port 4444 by default)kusacode10.0.0.1# List reverse shells connecting to 10.0.0.1:1337kusacode10.0.0.11337# Copy last reverse shell payload to clipboardkusacode10.0.0.1-c# Copy reverse shell with index 2 to clipboardkusacode10.0.0.1-c2# Select only PHP code (-l/--language)kusacode10.0.0.1-lphp# URL encode reverse shellkusacode10.0.0.1--encurl# Base64 encode and then url encode reverse shellkusacode10.0.0.1--encbase64url# Obfuscate payloadskusacode10.0.0.1--obf# Obfuscated and filter away '/' and '$' characters in payloadkusacode10.0.0.1--obf-b'/$':lock:cytopiasec toolsBelow is a list of sec tools and docs I am maintaining.NameCategoryLanguageDescriptionoffsecDocumentationMarkdownOffsec checklist, tools and examplesheader-fuzzEnumerationBashFuzz HTTP headerssmtp-user-enumEnumerationPython 2+3SMTP users enumeratorurlbusterEnumerationPython 2+3Mutable web directory fuzzerpwncatPivotingPython 2+3Cross-platform netcat on steroidskusanagiPayload GeneratorPython 3Bind- and Reverse shell payload generatorbadcharsReverse EngineeringPython 2+3Badchar generatorfuzzaReverse EngineeringPython 2+3TCP fuzzing tooldocker-dvwaPlaygroundPHPDVWA with local priv esc challenges:octocat: ContributingSeeContributing guidelinesto help to improve this project.:exclamation: DisclaimerThis tool may be used for legal purposes only. Users take full responsibility for any actions performed using this tool. The author accepts no liability for damage caused by this tool. If these terms are not acceptable to you, then do not use this tool.:page_facing_up: LicenseMIT LicenseCopyright (c) 2021cytopia