Skip to Main Content


UNICORN is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory.


Based on Matthew Graeber’s PowerShell attacks and the PowerShell bypass technique presented by our own David Kennedy and Josh Kelly at Defcon 18.

Usage is simple. Ensure Metasploit is installed and in the right path. Run Magic Unicorn.

This will generate a PowerShell command. Simply paste this to a command line window or through a payload delivery system.

How to Get UNICORN

Option 1

To download UNICORN, type the following command in Linux:

git clone /unicorn

Option 2

View on Git.

How to Get Help with UNICORN

For bug reports or enhancements, please open an issue on this projects GitHub page.