Pupy – Cross-Platform (Windows, Linux, OSX, Android) Remote Administration & Post-Exploitation Tool

Pupy - Cross-Platform (Windows, Linux, OSX, Android) Remote Administration and Post-Exploitation Tool

What is Puppy?

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android), multi function RAT (Remote Administration Tool) and post-exploitation tool mainly written in python. It features an all-in-memory execution guideline and leaves very low footprint. Pupy can communicate using various transports, migrate into processes (reflective injection), load remote python code, python packages and python C-extensions from memory.

Pupy modules can transparently access remote python objects using rpyc to perform various interactive tasks. Pupy can generate payloads in multiple formats like PE executables, reflective DLLs, pure python files, powershell, apk, … When you package a payload, you can choose a launcher (connect, bind, …), a transport (ssl, http, rsa, obfs3, scramblesuit, …) and a number of “scriptlets”. Scriptlets are python scripts meant to be embedded to perform various tasks offline (without requiring a session), like starting a background script, adding persistence, starting a keylogger, detecting a sandbox, etc.


Installation instructions are on the wiki, in addition to all other documentation. For maximum compatibility, it is recommended to use Docker Compose.

Refer to the wiki


  • Windows payload can load the entire Python interpreter from memory using a reflective DLL.
    • Pupy does not touch the disk.
  • Can be packed into a single .py file and run without any dependencies other than the python standard library on all OSes.
    • PyCrypto gets replaced by pure Python AES & RSA implementations when unavailable.
  • Reflectively migrate into other processes.
  • Remotely import pure python packages (.py, .pyc) and compiled python C extensions (.pyd, .so) from memory.
    • Imported python modules do not touch the disk.
  • Easily extensible, modules are simple to write and are sorted by os and category.
  • Modules can directly access python objects on the remote client using rpyc.
  • Access remote objects interactively from the pupy shell and get auto-completion of remote attributes.
  • Communication transports are modular and stackable. Exfiltrate data using HTTP over HTTP over AES over XOR, or any combination of the available transports.
  • Communicate using obfsproxy pluggable transports.
  • Execute noninteractive commands on multiple hosts at once.
  • Commands and scripts running on remote hosts are interruptible.
  • Auto-completion for commands and arguments.
  • Custom config can be defined: command aliases, modules. automatically run at connection, etc.
  • Open interactive python shells with auto-completion on the all-in-memory remote python interpreter.
  • Interactive shells (cmd.exe, /bin/bash, etc) can be opened remotely.
    • Remote shells on Unix & Windows clients have a real tty with all keyboard signals working just like an SSH shell.
  • Execute PE executable remotely and from memory.
  • Generate payloads in various formats:
FormatArchitectureShort Name
Android Packagex86 & ARMv7apk
Linux Binaryx86lin_x86
Linux Binaryx64lin_x64
Linux Shared Objectx86so_x86
Linux Shared Objectx64so_x64
Windows PE Executablex86exe_x86
Windows PE Executablex64exe_x64
Windows DLLx86dll_x86
Windows DLLx64dll_x64
Python Scriptx86 & x64py
PyInstallerx86 & x64pyinst
Python Onelinerx86 & x64py_oneliner
Powershellx86 & x64ps1
Powershell Onelinerx86 & x64ps1_oneliner
Ducky ScriptN/Arubber_ducky
  • Deploy in memory from a single command line using python or powershell one-liners.
  • Embed “scriptlets” in generated payloads to perform some tasks “offline” without needing network connectivity (ex: start keylogger, add persistence, execute custom python script, check_vm, etc.)
  • Multiple Target Platforms:
PlatformSupport Status
Windows XPSupported
Windows 7Supported
Windows 8Supported
Windows 10Supported
Mac OSXLimited Support
AndroidLimited Support

You May Also Like

Leave a Reply

Your email address will not be published. Required fields are marked *

5 × one =