poshc2
v9.0 open-sourceThe section your link pointed to isn't on poshc2's page any more, so we've brought you to the top.
PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access..
# In poshC2_config.json or environment: # "stage_retry_count": 5 stopsocks
Summary
poshc2 is an open-source command-and-control framework, free to use, built to help penetration testers with red teaming, post-exploitation and lateral movement. It runs as a client/server setup, deployed via Docker, with a server component that multiple team members can connect to and implants (PowerShell, C#, Python) deployed against Windows, *nix and OSX targets. It is aimed at red teamers and penetration testers who need to run their own C2 infrastructure rather than rely on a hosted platform, and its documentation describes it as a proxy-aware framework generating auto-configured Apache rewrite rules to protect that infrastructure. It sits in the same space as other post-exploitation C2 frameworks used in offensive engagements. Development has slowed markedly: first committed in 2018 with 42 contributors over its life, the project has seen only one commit in the past year and its last release was over two years ago.
PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.
How poshc2 helps
Which of my compromised hosts are still checking in, and how do I reach one to run commands?
lists active implants across every operating system reporting to the server, and drops into a handler session for any one of them to issue commands and see the response
How do I move from one foothold to other machines on the network without redeploying my infrastructure?
reuses the same encrypted channel and beacon configuration for new implants dropped on additional hosts, so lateral movement runs through the same tracked session model as the original foothold
Can several of us work the same engagement without stepping on each other?
runs as a single server that multiple operators connect to at once, with every action and response timestamped and attributed to the user and host that issued it
Will my payloads get flagged before they even beacon out?
ships shellcode with built-in AMSI bypass and ETW patching baked into the generated executables, DLLs and scripts, aimed at getting past common antivirus products
How exposed is my C2 infrastructure to being fingerprinted or torn down?
auto-generates Apache rewrite rules that front the server as a reverse proxy, and encrypts all beacon traffic end-to-end so contents stay opaque even sent over plain HTTP
Can I reconstruct exactly what happened on this engagement afterward?
keeps every task, response, user and implant number in a database plus a separate server output log, so the sequence of an operation can be pulled back out after the fact
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for poshc2, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail poshc2 puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
6 entries
No entries match these filters.
- June 20241
- August 20221
- March 20221
- December 20201
- October 20201
- August 20201
Project health
Issue, contributor and maintainer activity in nettitude/PoshC2, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 0 −1 vs prior 12 months
- Maintainers 0 +0 joined · −1 left, last 12 months
- Bus factor 0 committers behind half the commits
- Community-filed not measured of issues opened, last 12 months
- Median time to close not measured issues closed, last 12 months
- Open backlog 23 of 126 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 23
- Contributors / month 0
- Commits / month 0
- Stars 2,135
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Articles
3 articles · updated Nov 4, 2026Where poshc2 turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.
-
Command & Control: PoshC2
PoshC2 is an open-source remote administration and post-exploitation framework that is publicly available on GitHub.
2 more quotes
Although PoshC2 primarily focuses on Windows implantation, it does contain a basic Python dropper for Linux/macOS.
Support for Docker, allowing reliable and cross-platform execution Installation of PoshC2 We can install PoshC2 automatically for Python3 using the curl command.
-
Cybercriminals Abuse Open-Source Tools To Target Africa’s Financial Sector
These tools include: PoshC2: An open-source attack framework Chisel: An open-source tunneling utility Classroom Spy: A remote administration tool The threat actor copies signatures from legitimate applications to forge…
2 more quotes
This playbook appears to consist of a combination of open-source and freely available tools such as PoshC2, Chisel and Classroom Spy, which are advertised as penetration testing and remote administration tools.
How the threat actor used PsExec, Chisel, PoshC2 and Classroom Spy as part of their attack playbook.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →