// the find
byt3bl33d3r/SILENTTRINITY
An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
SILENTTRINITY is a red team C2 framework that uses the Boo language (a Python-like .NET language) to compile and execute post-exploitation modules dynamically on the implant side, avoiding the need to ship precompiled binaries. The BYOI (Bring Your Own Interpreter) concept is genuinely clever: you get PowerShell-level flexibility without touching PowerShell. It's aimed at pentesters running structured red team ops who want collaborative multi-operator support.
The core BYOI architecture is the real idea here — embedding the Boo compiler in the implant means modules are just text sent over the wire and compiled in-memory, which sidesteps a lot of static detection. The multi-operator teamserver model (WebSockets, real-time sync, multiple connected clients) is properly designed rather than bolted on. ECDHE-encrypted C2 traffic with ephemeral keys is the right call, not just TLS with a static cert. The module library is extensive — kerberoasting, AMSI patches, credential dumping, UAC bypasses, process injection — covering most of the standard engagement playbook.
Last meaningful commit was late 2023 and the repo feels abandoned; EDR/AV detections have moved fast since then and the AMSI patches in particular are almost certainly flagged by now. Boo is a dead language — the compiler DLLs are shipped as blobs in the repo, and if you hit a bug or need to extend the language runtime, you're on your own. The Python 3.7-era asyncio code has dependency rot: Quart and Hypercorn have both had breaking API changes, and you'll spend real time just getting it to run before doing any actual testing. The pre-compiled binaries checked into `data/` (mimikatz PE loader, naga.exe) are signature-dead on arrival against anything modern.