| Provider | Folder | ID | User | Host | Domain | OS | Int IP | Ext IP | PID | Process | Last HB | Next Checkin |
|---|
Select a session to interact
| Time | UID | Operator | Command | Output |
|---|---|---|---|---|
| No commands recorded | ||||
| Filename | Type | Size | MD5 | Downloaded | Actions |
|---|---|---|---|---|---|
| No files downloaded for this session | |||||
| Type | Path on Target | Logged |
|---|---|---|
| No artifacts recorded | ||
| Filename | Size | Remote Path | Logged | Status | Actions |
|---|---|---|---|---|---|
| No uploads confirmed for this session | |||||
| Source | Protocol | Host | Domain | Notes | Username | Secret | Type | Actions |
|---|---|---|---|---|---|---|---|---|
| No credentials captured | ||||||||
No active sessions
Donor session credentials will be cloned into the new beacon.
| File | Session ID | Size | Last Modified |
|---|
| Time | ID | Operator | Command | Output preview |
|---|
| Type | Path on Target | Logged | Status |
|---|
| Filename | Size | Remote Path | Logged | Status |
|---|
| Date | Messages |
|---|
/sysinfoFull system enumeration — OS, users, network, processes/statusSession state, sleep interval and channel info/sleep <s>Set check-in interval in seconds (1 – 86400)/jitter <pct>Randomise interval ± pct% (0 – 50)/download <path>Pull file from target — appears in Artifacts tab/upload [dest]Push local file to agent; dest defaults to CWD/timestomp <tgt> <ref>Copy timestamps from ref file onto target file/persist probeProbe all techniques — non-invasive feasibility audit/persist install <id>Install a persistence technique by ID/persist remove <id>Remove a persistence technique by ID/persist status <id>Check current status of a specific technique/persist checkRe-check all installed techniques/creds harvestCollect creds — Firefox, SSH, FileZilla, mRemoteNG, PS history, Git, cloud tokens/creds harvest decryptAlso decrypt Chrome/Edge/DPAPI via CryptUnprotectData (Win)/creds coerceForce local auth to capture NTLMv2 / SSH agent/creds samIn-memory SAM hash extraction (Win, SYSTEM or elevated admin)/creds listen start <proto:port>Start listener — smb:445, http:80 (Basic), http-ntlm:80 (NTLMv2)/creds listen stop [proto:port]Stop all listeners, or a specific one/creds listen dumpDump captured credentials + poisoner stats/bof <file.obj> [args]Execute BOF/COFF object in-memory (Win)/assembly <file.exe> [args]Execute .NET assembly in-memory via CLR (Win)/memexec <file.elf> [args]Execute ELF in-memory via memfd_create (Linux)/jump <mod> <target> [opts]Spawn P2P child via SMB/WMI/SSH/WinRM — builds & deploys agent/generate-listener [tcp|smb] [linux|windows]Build standalone P2P listener beacon (manual deploy via USB/phish)/p2p link tcp <host:port>Connect to a P2P child listening on TCP/p2p link smb <target-ip> [pipe-name]Connect to a P2P child listening on SMB named pipe (port 445, default pipe: stratum)/p2p unlink <guid>Disconnect a linked P2P child/kill-cascadeKill session and all P2P descendants — leaf-first propagation/killWipe agent files on target and terminate process/stopTerminate agent process, leave files on disk/historySwitch to History tab/clearClear Shell output pane/helpOpen this referenceLoading…
IANA timezone for all logs and UI timestamps.
Check for new versions on startup and notify operators.
Loading…