explaingit

n1nj4sec/pupy

8,975PythonAudience · ops devopsComplexity · 5/5Setup · hard

TLDR

An open-source remote administration and post-exploitation framework for authorized penetration testing that runs entirely in memory across Windows, Linux, macOS, and Android.

Mindmap

mindmap
  root((Pupy))
    What it does
      Remote administration
      Post-exploitation
      In-memory execution
    Platforms
      Windows Linux macOS
      Android APK
      Python and C core
    Transports
      SSL and HTTP
      obfs3 obfuscation
      Layered stacking
    Modules
      Credential gathering
      Keylogging
      Port forwarding
      Process migration
Click or tap to explore — scroll the page freely

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Things people build with this

USE CASE 1

Test whether a target system can detect in-memory payloads during an authorized penetration test without writing files to disk.

USE CASE 2

Simulate post-exploitation scenarios including credential gathering, keylogging, and port forwarding in a controlled engagement.

USE CASE 3

Research traffic concealment by layering SSL and obfs3 transports to see how malicious traffic might be disguised.

USE CASE 4

Generate Android APK payloads for authorized mobile security assessments.

Tech stack

PythonCPowerShell

Getting it running

Difficulty · hard Time to first run · 1day+

Server must run on Linux, payload compilation requires a C toolchain and platform-specific build environments, intended for authorized security testing only.

In plain English

Pupy is an open-source remote administration and post-exploitation framework used in authorized security testing, penetration testing, and security research. It runs on Windows, Linux, macOS, and Android, and is written primarily in Python with some C components. The central idea is that Pupy can run entirely in memory without writing files to disk on the target system. A payload can be compiled as an executable, a DLL, a Python file, a PowerShell script, or an Android APK. Once a connection is established back to the attacker's server, the framework gives the operator an interactive shell with access to a wide range of modules. Communication between the server and a connected target is handled through a layered transport system. Transports like SSL, HTTP, and obfs3 can be stacked on top of each other to make the traffic look like something ordinary or to conceal what protocol is being used. This is particularly relevant for research into how malicious traffic might be disguised. The module library covers common post-exploitation tasks: running commands, transferring files, taking screenshots, recording keystrokes, opening an interactive shell, forwarding ports, running a SOCKS proxy, and gathering credentials. On Windows there are additional capabilities including process migration, in-memory execution of other programs, webcam snapshots, and microphone recording. On Android, GPS tracking and webcam access are included. Pupy uses a library called rpyc that allows the operator to interact with Python objects on the remote system directly from the server shell, including tab completion for remote attributes. Payloads can include embedded scripts called scriptlets that run offline, before a network session is established. These can set up persistence, start a keylogger, or check whether the environment is a sandbox. The server is designed to run on Linux. The project is open source and documented through a wiki on GitHub.

Copy-paste prompts

Prompt 1
How do I set up the Pupy server on Linux and generate a Windows executable payload for an authorized penetration test?
Prompt 2
How do I configure Pupy to stack HTTP and obfs3 transports so the traffic blends in with normal web requests?
Prompt 3
Show me how to use Pupy's rpyc shell to interact with Python objects on a connected Windows target during an authorized engagement.
Prompt 4
How do I write a Pupy scriptlet that sets up persistence on a Windows target before the network session is established?
Prompt 5
How do I compile a Pupy payload as an Android APK for use in an authorized mobile security test?
Open on GitHub → Explain another repo

← n1nj4sec on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.