Stratum — Wiki Mockups

Scene 0 — Full UI: session selected · Shell tab · chat open

🔒 https://ops.stratum.local:8443

	Provider	Folder	ID	User	Host	Domain	OS	Int IP	Ext IP	PID	Process	Last HB	Next Checkin
● LIVE	dropbox	ops/DESKTOP-K8PX2	7b3f8a	corp\jdoe	DESKTOP-K8PX2	corp.acme.com	Windows	192.168.14.105	185.23.104.88	6412	powershell.exe	8s	52s
● IDLE	onedrive	ops/ubuntu-srv-03	c92e14	root	ubuntu-srv-03	—	Linux	10.10.5.22	91.47.202.13	2841	bash	4m 22s	—

DESKTOP-K8PX2 alive

ID7b3f8a

Providerdropbox

Heartbeat8s

Sleep60s

Jitter20%

OSWindows 10 Pro

Privscorp\jdoe

Shell

History

Artifacts

Persistence

Credentials

Control

Info

[14:31:04] [admin] PS> whoami

[a7f2d1c9] Output: corp\jdoe

[14:32:18] [admin] C:\Users\jdoe\Documents PS> dir /b Desktop

[b4e3f5a2] Output: budget_q2.xlsx credentials_backup.txt meeting_notes.docx

[14:34:07] [red_team] PS> net user /domain

[c9b2e8f1] * waiting for agent response…

PS>

STRATUM CHAT

A

R

red_team joined

R

red_team 14:30

session 7b3f8a has jdoe — checking Documents

A

admin 14:31

on it, sent whoami + ls

R

red_team 14:33

can you also run net user /domain?

A

admin 14:34

sent, pending response

Scene 1 — Session List · 3 sessions · no selection · alive / idle / dead

🔒 https://ops.stratum.local:8443

	Provider	Folder	ID	User	Host	Domain	OS	Int IP	Ext IP	PID	Process	Last HB	Next Checkin
● LIVE	dropbox	ops/DESKTOP-K8PX2	7b3f8a	corp\jdoe	DESKTOP-K8PX2	corp.acme.com	Windows	192.168.14.105	185.23.104.88	6412	powershell.exe	12s	48s
● IDLE	onedrive	ops/ubuntu-srv-03	c92e14	root	ubuntu-srv-03	—	Linux	10.10.5.22	91.47.202.13	2841	bash	18m	—
■ DEAD	dropbox	ops/WS-FINANCE-01	4a17bc	corp\msmith	WS-FINANCE-01	corp.acme.com	Windows	172.16.8.201	103.14.88.51	—	cmd.exe	2h 14m	—

Scene 2 — Session List · 4 sessions · alive / idle / dead / ■ STOP

🔒 https://ops.stratum.local:8443

	Provider	Folder	ID	User	Host	Domain	OS	Int IP	Ext IP	PID	Process	Last HB	Next Checkin
● LIVE	dropbox	ops/DESKTOP-K8PX2	7b3f8a	corp\jdoe	DESKTOP-K8PX2	corp.acme.com	Windows	192.168.14.105	185.23.104.88	6412	powershell.exe	8s	52s
● IDLE	onedrive	ops/ubuntu-srv-03	c92e14	root	ubuntu-srv-03	—	Linux	10.10.5.22	91.47.202.13	2841	bash	4m 22s	—
■ DEAD	dropbox	ops/WS-FINANCE-01	4a17bc	corp\msmith	WS-FINANCE-01	corp.acme.com	Windows	172.16.8.201	103.14.88.51	—	cmd.exe	2h 14m	—
■ STOP	s3	ops/dc01-corp	f3a901	SYSTEM	DC01-CORP	corp.acme.com	Windows	10.0.0.5	—	1204	pwsh.exe	3m 10s	■ Stopped

Scene 2b — Session List · background wipe in progress · ⟳ WIPING badge

🔒 https://ops.stratum.local:8443

	Provider	Folder	ID	User	Host	Domain	OS	Int IP	Ext IP	PID	Process	Last HB	Next Checkin
● LIVE	dropbox	ops/DESKTOP-K8PX2	7b3f8a	corp\jdoe	DESKTOP-K8PX2	corp.acme.com	Windows	192.168.14.105	185.23.104.88	6412	powershell.exe	8s	52s
● IDLE	onedrive	ops/ubuntu-srv-03	c92e14	root	ubuntu-srv-03	—	Linux	10.10.5.22	91.47.202.13	2841	bash	4m 22s	—
⟳ WIPING	googledrive	ops/WIN-DC01	f3a901	SYSTEM	WIN-DC01	corp.acme.com	Windows	10.0.0.5	—	—	—	2h 14m	cloud cleanup…

Scene 3 — Shell tab · Windows (powershell.exe) · prompt PS>

🔒 https://ops.stratum.local:8443

	ID	User	Host	OS	Process	Last HB
● LIVE	7b3f8a	corp\jdoe	DESKTOP-K8PX2	Windows	powershell.exe	8s

DESKTOP-K8PX2 alive

ID7b3f8a

Providerdropbox

Heartbeat8s

Sleep60s

OSWindows 10 Pro

Shell

History

Artifacts

Persistence

Credentials

Control

Info

[14:31:04][admin]PS>whoami

[d1c8e4a7] Output: corp\jdoe

[14:31:48][admin]PS>Get-Process | Sort CPU -Desc | Select -First 5

[e2f5a9b3] Output: Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName ------- ------ ----- ----- ------ -- -- ----------- 1482 328 856256 902144 142.31 8204 0 MsMpEng 842 92 125440 298560 38.24 1832 0 svchost 521 48 65280 85230 12.16 6412 0 powershell 734 52 74120 156480 4.92 3920 0 explorer

C:\Users\jdoe\DocumentsPS>Get-ChildItem

[f3g6b1c4] Output: Mode LastWriteTime Length Name ---- ------------- ------ ---- d---- 6/21/2026 9:14 AM Work -a--- 6/20/2026 4:32 PM 2864 notes.txt -a--- 6/18/2026 11:02 AM 156240 report_Q2.xlsx

PS>

Scene 4 — Shell tab · Windows (cmd.exe) · prompt cmd>

🔒 https://ops.stratum.local:8443

	ID	User	Host	OS	Process	Last HB
● LIVE	4a17bc	corp\msmith	WS-FINANCE-01	Windows	cmd.exe	5s

WS-FINANCE-01alive

ID4a17bc

Heartbeat5s

OSWindows 11 Pro

Shell

History

Artifacts

Persistence

Credentials

Control

Info

cmd>whoami

[a5c9b2d3] Output: corp\msmith

C:\Users\msmithcmd>dir /b Desktop

[b6d4e1f8] Output: budget_q2.xlsx credentials_backup.txt VPN_config.ovpn

cmd>net user

[c7e5f2a9] Output: User accounts for \\WS-FINANCE-01 Administrator corp\msmith Guest

cmd>

Scene 5 — Shell tab · Linux non-root (bash) · prompt $

🔒 https://ops.stratum.local:8443

	ID	User	Host	OS	Process	Last HB
● IDLE	c92e14	svc_deploy	ubuntu-srv-03	Linux	bash	4m 22s

ubuntu-srv-03idle

IDc92e14

Heartbeat4m 22s

Sleep300s

OSLinux 6.1.0-amd64

Shell

History

Artifacts

Persistence

Credentials

Control

Info

$id

[d4a7b8c1] Output: uid=1002(svc_deploy) gid=1002(svc_deploy) groups=1002(svc_deploy),27(sudo)

/opt/app$ls -la /etc/cron.d/

[e5b8c9d2] Output: total 20 drwxr-xr-x 2 root root 4096 Jun 18 08:12 . drwxr-xr-x 92 root root 4096 Jun 21 14:01 .. -rw-r--r-- 1 root root 201 Jun 19 11:44 sysmon

$

Scene 6 — Shell tab · Linux root (bash) · prompt #

🔒 https://ops.stratum.local:8443

	ID	User	Host	OS	Process	Last HB
● LIVE	d8c042	root	db-prod-01	Linux	bash	3s

db-prod-01alive

IDd8c042

Heartbeat3s

OSLinux 5.15.0-amd64

Shell

History

Artifacts

Persistence

Credentials

Control

Info

#id

[f6c9d3e4] Output: uid=0(root) gid=0(root) groups=0(root)

/root#cat /etc/shadow | head -3

[a7d1e2f5] Output: root:$6$rounds=656000$xyz...:19500:0:99999:7::: daemon:*:19000:0:99999:7::: bin:*:19000:0:99999:7:::

#

Scene 7 — Artifacts tab · on-target files + uploaded files

🔒 https://ops.stratum.local:8443

	ID	User	Host	OS	Process	Last HB
● LIVE	7b3f8a	corp\jdoe	DESKTOP-K8PX2	Windows	powershell.exe	8s

DESKTOP-K8PX2alive

Shell

History

Artifacts

Persistence

Credentials

Control

Info

On-Target Artifacts

Type	Path on Target	Logged	Status
enc_staged_agent	`C:\Users\jdoe\AppData\Local\Temp\.s2w`	Jun 21, 09:12:44	● on target
persist_schtask	`HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SysHealth`	Jun 21, 09:14:02	● on target

Uploaded Files

Filename	Size	Remote Path	Logged	Status	Actions
`mimikatz.exe`	1.2 MB	`C:\Temp\svchost32.exe`	Jun 21, 11:04:18	● on target
`nc.exe`	38 KB	`C:\Temp\nc.exe`	Jun 21, 13:22:51	✕ removed

Scene 8 — History Archives · file list

🔒 https://ops.stratum.local:8443

File	Session ID	Size	Last Modified
dropbox_ops_DESKTOP-K8PX2_7b3f8a.xlsx	7b3f8a	48.2 KB	Jun 21, 14:38	⬇
onedrive_ops_ubuntu-srv-03_c92e14.xlsx	c92e14	12.7 KB	Jun 20, 08:15	⬇
dropbox_ops_WS-FINANCE-01_4a17bc.xlsx	4a17bc	31.4 KB	Jun 19, 22:04	⬇

Scene 9 — History Archives · session detail · Commands tab

🔒 https://ops.stratum.local:8443

Commands

Artifacts

Time	ID	Operator	Command	Output preview
Jun 21, 14:31:04	a1b2c3d4	admin	`whoami`	corp\jdoe
Jun 21, 14:31:48	e5f6a7b8	admin	`Get-Process \| Sort CPU -Desc \| Select -First 5`	Name Id CPU … MsMpEng 8204 142.34 …
Jun 21, 14:33:12	c9d0e1f2	admin	`ls`	Directory: C:\Users\jdoe\Documents …

Scene 10 — Settings · Server modal · timezone selector

🔒 https://ops.stratum.local:8443

Scene 11 — Settings · Display tab · theme selector

🔒 https://ops.stratum.local:8443

Scene 12 — Login page · Local auth (username + password)

Username

operator

Password

••••••••

CONNECT

Stratum C2 v3.0.2

Scene 13 — Login page · OIDC mode (Sign in with provider)

Sign in with OIDC Provider

Stratum C2 v3.0.2

Scene 14 — Deploy Wizard · Step 1: Provider

Deploy Agent ×

1

Provider

2

Credentials

3

Configuration

4

Build

Step 1: Provider

Cloud Provider

      
      Dropbox
      🔑 1 saved

Suggested for personal devices and BYOD environments

      
      OneDrive

Suggested for Microsoft 365 / domain-joined workstations

      
      Google Drive

Suggested for Google Workspace and education networks

      S
      SharePoint

Suggested for corporate environments with SharePoint Online

      
      S3-compatible

Suggested for cloud-hosted targets with outbound AWS access

Scene 15 — Deploy Wizard · Step 2: Credentials (saved profile picker)

Deploy Agent ×

✓

Provider

2

Credentials

3

Configuration

4

Build

Step 2: Credentials

Saved credential profiles

ops-dropbox-2026 🔑 saved

Last used: 2026-06-20 · App key: k8pqr2…

+ New credentials

Enter App key, App secret and authorize via OAuth2

Scene 16 — Deploy Wizard · Step 4: Build output

Deploy Agent ×

✓

Provider

✓

Credentials

✓

Configuration

4

Build

Step 4: Build

✓ Generating RSA-4096 keypair…
✓ Uploading bootstrap key to Dropbox…
✓ Building script agent (bash)…
✓ Building script agent (PowerShell)…
✓ Building native Linux ELF (musl-static)…
✓ Building native Windows EXE (mingw)…
✓ Building shellcode blob (.bin)…
✓ Packaging deployment archive…
✓ Build complete — 7 artifacts

stub.sh14.2 KB

stub.ps118.7 KB

agent.elf1.2 MB

agent.exe892 KB

agent.bin312 KB

agent.dll908 KB

Scene 17 — WebGUI with chat panel open (multi-operator)

STRATUM

2 sessions

2 operators

14:32:07

UTC

A

alice

Session Details

	Provider	Folder	ID	User	Host	Domain	OS	Int IP	Ext IP	PID	Process	Last HB	Next Checkin
● LIVE		ops/DESKTOP-K8PX2	7b3f8a	corp\\jdoe	DESKTOP-K8PX2	corp.acme.com	WIN	192.168.14.105	185.23.104.88	6412	powershell.exe	14s	46s
● LIVE		ops/SRV-PROD-01	a1c2e4	root	SRV-PROD-01	acme.com	LIN	10.0.1.22	185.23.104.88	1337	bash	2m	3m

DESKTOP-K8PX2 LIVE

Providerdropbox

Folderops/DESKTOP-K8PX2

ID7b3f8a

Sleep60s

Jitter20%

Shell

History

Artifacts

Persistence

Credentials

Control

Info

14:28:02alicewhoami
corp\jdoe
PS C:\Users\jdoe>enter command…

Stratum Chat

A

B

bob14:27:51

I have eyes on DESKTOP-K8PX2 — jdoe has local admin

A

alice14:28:05

confirmed — running whoami now

B

bob14:28:18

moving to SRV-PROD-01 next, it's on the same subnet

Message operators…

Scene 18 — Session · Persistence tab · probe results

🔒 https://ops.stratum.local:7443

STRATUM

1 session

1 operator

14:32:07

UTC

A

alice

Session Details

	Provider	Folder	ID	User	Host	Domain	OS	Int IP	Ext IP	PID	Process	Last HB	Next Checkin
● LIVE		ops/DESKTOP-K8PX2	7b3f8a	corp\\jdoe	DESKTOP-K8PX2	corp.acme.com	WIN	192.168.14.105	185.23.104.88	6412	powershell.exe	18s	42s

DESKTOP-K8PX2 LIVE

Providerdropbox

Folderops/DESKTOP-K8PX2

Sleep60s

Jitter20%

Shell

History

Artifacts

Persistence

Credentials

Control

Info

Technique	Priv	Trigger	Stealth	Status
Scheduled Task (logon) schtask-logon	USER	LOGON	★★★	INSTALLED
Registry Run Key (HKCU) registry-run	USER	LOGON	★★★	AVAILABLE
Startup Folder startup-folder	USER	LOGON	★★★	AVAILABLE
Scheduled Task (boot) schtask-boot	ADMIN	BOOT	★★★	UNAVAILABLE
Registry Run Key (HKLM) registry-run-hklm	ADMIN	LOGON	★★★	UNAVAILABLE
WMI Event Subscription wmi-event	ADMIN	BOOT	★★★	UNAVAILABLE
Windows Service service	ADMIN	BOOT	★★★	UNAVAILABLE

Scene 19 — Session · Info tab · full session profile

🔒 https://ops.stratum.local:7443

STRATUM

1 session

1 operator

14:32:07

UTC

A

alice

Session Details

	Provider	Folder	ID	User	Host	Domain	OS	Int IP	Ext IP	PID	Process	Last HB	Next Checkin
● LIVE		ops/DESKTOP-K8PX2	7b3f8a	corp\\jdoe	DESKTOP-K8PX2	corp.acme.com	WIN	192.168.14.105	185.23.104.88	6412	powershell.exe	18s	42s

DESKTOP-K8PX2 LIVE

Providerdropbox

Folderops/DESKTOP-K8PX2

Sleep60s

Jitter20%

Shell

History

Artifacts

Persistence

Credentials

Control

Info

Identity from heartbeat

Session ID

7b3f8a

Status

alive

Hostname

DESKTOP-K8PX2

OS

Windows 10 Pro 22H2 x64

Username

corp\jdoe LOCAL ADMIN

Domain

corp.acme.com

Internal IP

192.168.14.105

External IP

185.23.104.88

Agent from heartbeat

PID

6412

Process

powershell.exe

Last Heartbeat

18s

Sleep / Jitter

60s ± 20%

Dead-Drop Channel from heartbeat

Provider

dropbox

Deploy Mode

stageless-bk

Folder Name

DESKTOP-K8PX2

Folder Path

ops/DESKTOP-K8PX2

Input File

cmd.enc

Output File

out.enc

Heartbeat File

hb.enc

Label

jdoe-workstation

Guardrails baked at deploy time

Kill Date

2026-09-30

Window

08:00 → 18:00

Deployed With

v3.0.2

System Intelligence from /sysinfo

Run /sysinfo in the shell to populate this section.

Scene 20 — Session · Credentials tab · harvested + manual credentials

🔒 https://ops.stratum.local:7443

STRATUM

1 session

1 operator

v3.0.2

14:32:07

UTC

A

alice

Session Details

	Host	User	OS	Last HB
● LIVE	DESKTOP-K8PX2	corp\\jdoe	WIN	18s

DESKTOP-K8PX2 LIVE

Providerdropbox

Folderops/DESKTOP-K8PX2

Sleep60s

Jitter20%

Shell

History

Artifacts

Persistence

Credentials

Control

Info

3 credentials

Source	Protocol	Host	Domain	Notes	Username	Secret	Type
sam	ntlm	192.168.14.10	CORP	DC01 admin	Administrator	aad3b435…31d6cfe0:::	ntlm
listen	http-ntlm	192.168.14.105	CORP	—	jdoe	jdoe::CORP:1122…a8f4	ntlmv2
manual	rdp	10.0.0.5	—	backup acct	svc_backup	••••••••	password

Scene 21 — Session · Control tab · sleep/jitter + actions

🔒 https://ops.stratum.local:7443

STRATUM

1 session

1 operator

v3.0.2

14:32:07

UTC

A

alice

Session Details

	Host	User	OS	Last HB
● LIVE	DESKTOP-K8PX2	corp\\jdoe	WIN	18s

DESKTOP-K8PX2 LIVE

Providerdropbox

Folderops/DESKTOP-K8PX2

Sleep60s

Jitter20%

Shell

History

Artifacts

Persistence

Credentials

Control

Info

Timing

Sleep

s

Jitter

%

Agent Actions

Stop Agent Send EXIT to the agent — it stops executing immediately. No files are removed from the target. The session record remains here.

Remove Session

Performs a full teardown of this session:

Sends KILL to the agent — wipes staged binary, persistence entries and stub from the target
Removes the session from the manager and deletes its profile
Optionally deletes the deployment directory (keys, stage2, artifacts) — operator choice
Optionally deletes the command history log — operator choice

This action is irreversible. The agent cannot be recovered after cleanup.

Scene 22 — P2P Graph View · empty state · no links established

🔒 https://ops.stratum.local:7443

STRATUM

4 sessions

2 operators

v3.0.2

09:15:44

UTC

D

d33p

🔗

No P2P links established

Nodes
Alive
Idle
Dead
Admin
Edges
TCP
SMB
Cloud

Scene 23 — P2P Graph View · active mesh · 5 nodes · mixed transports

🔒 https://ops.stratum.local:7443

STRATUM

5 sessions

2 operators

v3.0.2

10:22:51

UTC

D

d33p

    WS-DEV03

    IP: 192.168.14.33

    User: CORP\mchen

    OS: Windows 11 Pro

    PID: 4820 (svchost.exe)

    Status: alive — 12s ago

    Links: 2 (tcp:4444 in, tcp:8080 out)

    click to select · drag to move

Nodes
Alive
Idle
Dead
Admin
Edges
TCP
SMB
Cloud

Scene 24 — P2P Generate Listener · modal · TCP/SMB transport

Generate P2P Listener ×

Platform

Windows

Linux

Transport

TCP

Raw TCP socket, bind to interface:port

SMB

Named pipe, blends with SMB traffic

Interface

Port

Label (optional)

Scene 25 — Credential Listener · shell output · HTTP-NTLM + dump

🔒 https://ops.stratum.local:7443

STRATUM

3 sessions

1 operator

v3.0.2

D

d33p

	ID	User	Host	OS	Last HB
● LIVE	7b3f8a	corp\jdoe	DESKTOP-K8PX2	WIN	6s

DESKTOP-K8PX2 LIVE

ID7b3f8a

Providerdropbox

Sleep60s

OSWindows 10 Pro

Shell

History

Artifacts

Persistence

Credentials

Control

Info

          [09:15:02]
          [d33p]
          [7b3f8a]
          /creds listen start http-ntlm:80
        
          [7b3f8a] Listener started: HTTP-NTLM on 0.0.0.0:80
        
          [09:42:18]
          [d33p]
          [7b3f8a]
          /creds listen dump
        
          [7b3f8a] Output:

          [HTTP-NTLM:80] 3 credentials (active 27m 16s) — 2 NTLMv2 + 1 Basic

            Total visits: 14 from 5 unique IPs

            Visits per IP:

              10.0.1.50    — 6 visits (NTLMv2 captured ✓)

              10.0.1.105   — 4 visits (NTLMv2 captured ✓)

              10.0.1.22    — 2 visits (Basic captured ✓)

              10.0.1.88    — 1 visit  (no credentials)

              10.0.1.200   — 1 visit  (no credentials)

            [NTLMv2] CORP\jdoe::CORP:1122334455667788:aabbccdd...

            [NTLMv2] CORP\admin::CORP:aabbccddeeff0011:99887766...

            [HTTP-Basic] svc-backup:Winter2025! (from 10.0.1.22)

          NTLMv2 format: hashcat -m 5600

PS>

	Provider	Folder	Host	Domain\User	OS	Int IP	Ext IP	PID	Last HB	Next
● LIVE	dropbox	/ops/red/alpha	DESKTOP-K8PX2	CORP\jdoe	Win 10	192.168.14.105	82.34.17.221	4812	8s	52s
● IDLE	onedrive	/ops/red/bravo	ubuntu-srv-03	root	Linux	10.10.5.22	94.130.55.8	1337	4m 22s	—
✕ DEAD	googledrive	/ops/red/charlie	WIN-DC01	CORP\svc_backup	Win Server	192.168.14.10	82.34.17.221	2048	2h 14m	—