Usage

Getting Started

Visit your server at https://<your-ip>:8443
You will likely get flash-banged with the default light-theme.
In the top right, you can toggle to dark mode:

Managing Users

Getting your team onboarded to your C2 server should be the first thing you do, shared passwords are bad!
In the Admin panel, go to “Create New User” tab and submit the form. Set the username, role, and initial password.
From the “Existing Users” tab, we can edit or delete users. Modifying the initial user is forbidden from this panel.
By selecting the “Edit” option for a user, we can modify the password and the role.

Server / API Settings

Currently, the Server and API only support modifying the logging configuration without restarting the container.
From the “Server Settings” or “API Settings” tabs, configure the log level and max log file size:

User Profile

The Profile panel allows users to change their password and API keys.
After a user is created, it is highly recommended for the user to change their password.
API keys are created for authentication for the discord bot.
Enter your password, and the desired max age of the API token:
Direct Message your discord bot with /patron configure <your-api-token>

Redirectors

To install a redirector, create a fresh server. Either install docker first, or use ubuntu 22/24 to use the automatic installer.
It is suggested to have IPv6 configured already. Ensure an IPv6 address appears when running hostname -I
From the Redirector panel in the UI, go to the Create New Redirector tab.
Set the Redirector Name, Description, and Listen Port.
Unless chaining multiple redirectors together, do not use the Forward IP and Forward Port options.
Once you click “Create Redirector”, a download will start for a redirector_install.sh
Save this script locally.
Run this script on the server you created to run the redirector on.
After a few seconds, you should see your redirector online in the “Existing Redirectors’ tab.

Payloads

Once a Redirector is created, it is time to create an agent to call back to this redirector
Click “Create New Payload”
Select the OS for the agent
Select one of the available payload types.
Select one of the online listeners, jitter, and callback frequency
Set payload name, description, and other agent options
Continue to review and create the payload. It can take a couple of minutes for the payload to create.
It is generally suggested to deploy the redirector as a service, but it can be ran via cron, .bashrc, or any other mechanism of starting a process.

Agents

In the home tab, we can now see our agent!
To interact with the agent, click on it.

Agent Page

Filters

To search for agents, use the filters on the right side of the table.
Search by Hostname, IP, or tags.
When filtering by tags, use either
- “Any Tag Match” to OR all selected tags.
- “All Tags Must Match” to AND selected tags.

alt text

Commands

For linux agents, the default shell is bash.
For Windows agents, the default shell is powershell.
The Commands Tab also serves to manage the SOCKS5 proxy module
Switch the command type to Socks
Enter the desired port number, then click “Send” to task the agent to start the proxy module.
Use the proxy via proxychains, or any other tool to use SOCKS5 proxies.
To stop the SOCKS5 proxy, send a Socks command “disable”.

Files

Agents can either send or receive files from the target machine.
To receive a file, set the “Path”, but do not select a file.
Once the agent is done downloading the file, we can download it to our local machine
To upload files, set both the “Path” and upload a file.

Keylogs

The Keylog tab is exactly what it sounds like, keylogs from the target machine.
There is an included timestamp for each keylog, this time the agent submits the keylogs to the teamserver.

Configuration

The configuration tab allows the agent to switch between redirectors, and update the callback frequency. This is useful if you need to interact with an agent and don’t want to wait many minutes for each callback.
Update the desired option, then click “Save”

Notes

The notes tab is a place for the operator to notes on this agent. These notes are per-agent, not per-host.

Tags

The tags tab allows you to put identifiers for your agents.

Files Page

Overview

The Files page is a read only view for all files uploaded to and downloaded from agents.

Filters

Similar to the agents page, filters can be applied to find files from specific agents

Search Page

Overview

The Search page is for searching all OpenSearch data.
This data is sourced from keylogs, and any data sent to agent unix sockets or named pipes.
New OpenSearch data is loaded every 15 seconds.

Search

Similar to the agents and files pages, keylogs can be searched by the agent tags.
However, the tag must exist on the agent at the time the keylog was submitted
Searches cannot start with a *
Lets say there is some keylog, echo "hi keylogger"
- *cho is NOT a valid search query for this.
- ech is NOT a valid search query for this.
- ech* is a valid search query for this.
- echo is a valid search query for this.