RFCpwn : An Enumeration & Exploitation Toolkit Using RFC Calls To SAP

Nimplant is a cross-platform (Linux & Windows) implant written in Nim as a fun project to learn about Nim and see what it can bring to the table for red team tool development. Currently, Nimplant lacks extensive evasive tradecraft; however, overtime Nimplant will become much more sophisticated.


To install Nimplant, you’ll need Mythic installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page.

From the Mythic install root, run the command:

./install_agent_from_github.sh https://github.com/MythicAgents/Nimplant

Once installed, restart Mythic to build a new agent.

Highlighted Agent Features

  • Cross-platform
  • Fully asynchronous
  • Can generate agents compiled from both C and C++ source code

Commands Manual Quick Reference

catcat [file]Retrieve the output of a file.
cdcd [dir]Change working directory.
cpcp [source] [destination]Copy a file from source to destination. Modal popup.
curlcurl [url] [method] [headers] [body]Execute a single web request.
downloaddownload [path]Download a file off the target system.
exitexitExit a callback.
getenvgetenvGet all of the current environment variables.
jobsjobsList all running jobs.
killkill [pid]Attempt to kill the process specified by [pid].
lsls [path] [recurse]List files and folders in [path] with optional param to list recursively. Defaults to current working directory.
mkdirmkdir [dir]Create a directory.
mvmv [source] [destination]Move a file from source to destination. Modal popup.
pspsList process information.
pwdpwdPrint working directory.
rmrm [path]Remove a file specified by [path]
shellshell [command]Run a shell command which will translate to a process being spawned with command line: cmd.exe /r[command]
unsetenvsetenv [envname] [value]Sets an environment variable to your choosing.
sleepsleep [seconds]Set the callback interval of the agent in seconds.
unsetenvunsetenv [envname]Unset an environment variable.
uploaduploadUpload a file to a remote path on the machine. Modal popup.

Supported C2 Profiles

Currently, only one C2 profile is available to use when creating a new Nimplant agent: HTTP.

HTTP Profile

The HTTP profile calls back to the Mythic server over the basic, non-dynamic profile. When selecting options to be stamped into Nimplant at compile time, all options are respected with the exception of those parameters relating to GET requests.