nukeratframework/nukerat

What it is

NukeRat is a post-exploitation framework aimed at red team engagements, particularly against modern, hardened enterprise environments. It bundles a command-and-control server with cross-platform implants (Windows, Linux, and macOS including ARM), a library of more than 550 adapted BOF and .NET utilities, and built-in reporting of executed commands, IOCs, and compromised hosts. It also advertises runtime and static evasion techniques (indirect syscalls, stack spoofing, sleep masking, AMSI/ETW patching, PE customization), multiple injection allocation modes, LOTL integration with 240+ LOLBAS binaries, and optional integration with AI agents such as DeepSeek or local models.

It is intended for authorized offensive security work: penetration testing, adversary simulation, and red teaming. It is not a defensive monitoring tool.

Quick start

The documented path is a Linux setup. Clone the repository and run the installer with root privileges:

git clone https://github.com/nukeratframework/nukerat && cd nukerat && sudo bash install.sh all

Then create an operator key, start the server, and start the client:

./nukerat.py server key add operator
./nukerat.py server start
./nukerat.py client start

The commands should be run from the repository root. The README stops at client startup; implant creation and the remaining workflow are only covered in the fast setup tutorial. Treat that page as the authoritative continuation rather than assuming flags or configuration options.

Operational constraints

• The quick-start instructions assume Linux and use sudo to run the installer, which modifies the host system.
• Implants cover Windows, Linux, and macOS, but the install and control workflow shown is Linux-based; platform-specific agent details are not in the README.
• An operator key must exist before clients can use the server.
• The framework is licensed under GPLv3, with bundled components under their own licenses: SGN under MIT, Nim crypt utilities under MIT (adapted from nimcrypto), and the LOLBAS dataset under GPLv3 (license details).
• Full documentation is hosted externally in several languages, including English and Simplified Chinese.

HotRepo's take

NukeRat first appeared on HotRepo's new-project board for TypeScript on 2026-11-11, gaining 6 stars and 2 forks within an hour-long window starting 2026-11-10 23:15 UTC, reaching about 109 stars and 21 forks. That is a short single snapshot, not enough to describe a trend, and the repository has no recorded rank on the all-language daily board. The feature list is broad for a project this young, and the README distributes a root-run install script without explaining how the installer maps to the checked-in server and implant code; that combination of early-stage activity and host-level installation is what the listing should be read with in mind.