Update: This project has now become a sub-project of Alien for demonstrating my ideas and experimental purposes.

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX), originally developed as part of the Alien project.

Unlike traditional webshell demonstrations that focus solely on command execution, NebulaPulsar explores how an in-memory implant can establish an encrypted communication channel, dynamically load payloads, and execute them entirely in memory.

The project is intended for security research, malware analysis, and defensive education. It is not designed to be an operational offensive framework.

Technical details:

If you find this project helpful or informative, I would truly appreciate a ⭐ on the repository. Your support would be a great motivation for me to continue improving this tool.

Disclaimer

"If you shame attack research, you misjudge its contribution. Offense and defense aren't peers. Defense is offense's child." — John Lambert

This project was created solely for educational, research, and defensive cybersecurity purposes.

Its purpose is to study the implementation of modern in-memory implants, encrypted communication, and dynamic payload execution across Java and .NET platforms.

The project is not intended for unauthorized access, persistence, or malicious deployment. Any use against systems without explicit authorization is strictly discouraged.

The author assumes no responsibility for any misuse or damage resulting from this project.

Motivation

While developing Alien, I wanted to better understand how modern memory-resident webshells and implants are designed internally.

Many publicly available webshells focus on functionality but rarely explain why they are implemented that way. Features such as encrypted communication, in-memory payload execution, dynamic class loading, and session-based implants are often treated as black boxes.

NebulaPulsar was created to bridge that gap.

Rather than cloning an existing implementation, this project explores the underlying concepts behind modern memory implants and demonstrates how those ideas can be implemented on both the Java and .NET platforms.

Throughout the development process, I studied topics including:

  • Java ClassLoader internals
  • .NET Assembly.Load() and reflection
  • In-memory payload execution
  • Encrypted communication channels
  • Session-based memory implants
  • Dynamic payload loading
  • Basic anti-forensics techniques

The goal is to understand how these techniques work, not to encourage their misuse.

Architecture

This framework is divided into two layers:

NebulaPulsar

NebulaPulsar is the resident in-memory implant. It is responsible for:

  • Establishing an encrypted communication channel (AES)
  • Managing HTTP sessions
  • Decrypting incoming payloads
  • Dynamically loading classes/assemblies into memory
  • Managing the payload lifecycle (Persistent / Volatile)

DarkMatter

DarkMatter is the payload executed by NebulaPulsar.

It implements the actual post-exploitation logic while remaining independent from the transport layer, making it easy to extend with additional modules and capabilities.

Operating Principle

NebulaPulsar is first injected into the target webshell and remains resident in memory.

Once initialized, it establishes an encrypted communication channel and waits for incoming payloads.

Subsequent payloads, such as DarkMatter, are then delivered through this channel. NebulaPulsar decrypts the payload, loads it directly into memory, and transfers execution to it.

DarkMatter is responsible for implementing more advanced functionality, while NebulaPulsar remains lightweight and focuses on payload management and communication.

Demonstration (Screenshot)

JSP

ASPX

ASMX

ASHX

Wireshark

Usage

Download:

wget https://github.com/iss4cf0ng/NebulaPulsar/releases/latest/download/NebulaPulsar.tar.gz
tar -xzf NebulaPulsar.tar.gz
cd ./NebulaPulsar

Run with Python:

python3 main.py --url http://localhost/nebulapulsar.jsp --script java --encoding='utf-8'

Future Plans

  • Add more functionalities for DarkMatter (payload)

Thanks

Thanks for checking out this project. Feedback and suggestions are welcome.