Pupy

Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.^[1]

Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.^[1]

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.^[1]

Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.^[1]

Pupy can communicate over HTTP for C2.^[1]

Pupy can compress data with Zip before sending it over C2.^[1]

Pupy adds itself to the startup folder or adds itself to the Registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.^[1]

Pupy has a module for loading and executing PowerShell scripts.^[1]

Pupy can user PowerView to execute "net user" commands and create local system accounts.^[1]

Pupy can be used to establish persistence using a systemd service.^[1]

Pupy can interact with a victim’s Outlook session and look through folders and emails.^[1]

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.^[1]

Pupy has a module to clear event logs with PowerShell.^[1]

Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.^[1]

Pupy can execute Lazagne as well as Mimikatz using PowerShell.^[1]

Pupy can migrate into another process using reflective DLL injection.^[1]

Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.^[1]

Pupy uses PsExec to execute a payload or commands on a remote host.^[1]

Pupy can use Lazagne for harvesting credentials.^[1]

Pupy can also perform pass-the-ticket.^[1]

Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.^[1]