Native Commands

Built-in commands that ship with every agent. These are simple, direct tools for common tasks with no external plugin dependencies.

Commercial additions

The commercial payload adds native commands for privilege management (privilege-enable, privilege-disable, privilege-list), a runtime DLL override system (override-*), and shell access (sh on Linux, BSD, and macOS; chmod on Linux and BSD). See commercial native commands →

Quick Reference

Command	OS	Summary
`bof`	Windows	Execute a Beacon Object File
`cd`	Win / Linux / BSD / macOS	Change working directory
`cmd`	Windows	Execute a command via `cmd.exe`
`die`	Win / Linux / BSD / macOS	Stop the agent
`jobs`	Win / Linux / BSD / macOS	List running background tasks
`ls`	Win / Linux / BSD / macOS	List directory contents
`powershell`	Windows	Execute via PowerShell
`ps`	Win / Linux / BSD / macOS	List running processes
`run`	Win / Linux / BSD / macOS	Execute a program
`run-as`	Windows	Execute as a different user
`shutdown`	Win / Linux / BSD / macOS	Shutdown or reboot the target machine
`sleep`	Win / Linux / BSD / macOS	Adjust beacon sleep interval
`sleep-until`	Win / Linux / BSD / macOS	Pause callbacks until a specific time
`token-del`	Windows	Delete a stored token
`token-del-all`	Windows	Delete all stored tokens
`token-from-handle`	Windows	Import a token from an existing handle
`token-list`	Windows	List all stored tokens
`token-make`	Windows	Create a token from credentials
`token-steal`	Windows	Steal a token from a running process
`token-use`	Windows	Apply a stored token

bof

Purpose: Executes a Beacon Object File (BOF) in the agent process and returns its output.

OS Support: Windows

Parameter	Type	Required	Default	Description
`@files.bofFile`	file	Yes	-	The BOF `.o` file to execute.
`method`	string	No	`go`	Entry-point method name.
`inputArgs`	string[]	No	-	List of simple string arguments passed to the BOF.
`inputArgsEncoding`	string	No	`UTF8`	Encoding for `inputArgs`. Options: `UTF8`, `UTF16LE`.
`inputAsBytes`	bytes	No	-	Binary input - overrides `inputArgs` when provided.
`pack_format`	string	No	-	Format string for packing structured arguments. Supported format characters are `i`, `s`, `b`, `z`, and `Z` (e.g. `bsZi`).
`pack_args`	string[]	No	-	Argument values matching each character in `pack_format`.
`designated_thread`	bool	No	`false`	Run on a shared persistent BOF thread instead of spawning a new one per execution.
`keep_in_memory`	bool	No	`false`	Keep the BOF loaded after execution so it is reused on subsequent calls without re-uploading.

Example:

1	`bof --@files.bofFile whoami.o --method go`

Additional notes for designated_thread and keep_in_memory: * Why designated_thread exists: It’s meant for cases where a BOF needs to be re-run on the same OS thread because certain OS features are thread-bound. A common example is Win32 window/message handling, where doing follow-up work on a different thread can break things.
What happens if two BOFs both use designated_thread = true at the same time: They won’t actually run concurrently. One BOF runs first, and the other starts only after the first one finishes and returns a result. The execution order is usually based on command ID (lower ID first), but it’s not strictly guaranteed.
What keep_in_memory = true changes: When a BOF is kept in memory and then re-run, its read/write data sections are not reset to their initial state. In other words, it retains state between runs. Whether a BOF is considered “the same one” for reuse is determined by its hash.

cd

Purpose: Changes the agent's current working directory.

OS Support: Windows, Linux, BSD, macOS

Parameter	Type	Required	Default	Description
`dir`	string	Yes	-	Target directory. Supports absolute and relative paths.

Example:

1	`cd --dir C:\Users\Administrator\Documents`

cmd

Purpose: Executes a command string using cmd.exe.

OS Support: Windows

Parameter	Type	Required	Default	Description
`command`	string	No	-	The command to execute. May be omitted when supplying input through `stdin`.
`stdin`	string[]	No	-	Lines sent to stdin, simulating Enter presses between each.
`outputEncoding`	string	No	`Windows-1252`	Encoding used to decode the output.
`outputUnicode`	bool	No	`true`	Start `cmd.exe` with Unicode output enabled (`/u`), producing UTF-16LE output where supported.

Example:

1	`cmd --command "whoami /all"`

Tip

Prefer run over cmd for programs that do not require a shell interpreter - it avoids spawning an extra cmd.exe process.

die

Purpose: Terminates the agent process immediately.

OS Support: Windows, Linux, BSD, macOS

Parameter	Type	Required	Default	Description
`erase`	bool	No	`false`	When `true`, the agent attempts to delete itself from the filesystem before exiting (if there is a file to delete).

Example:

1	`die --erase true`

Warning

This command stops the agent immediately with no confirmation prompt. The connection will drop as soon as the command is received and the agent will not reconnect.

jobs

Purpose: Lists all currently running background tasks (commands executing asynchronously).

OS Support: Windows, Linux, BSD, macOS

Parameters: None

Example:

jobs

ls

Purpose: Lists the contents of a directory, optionally recursing into subdirectories.

OS Support: Windows, Linux, BSD, macOS

Parameter	Type	Required	Default	Description
`dir`	string	Yes	Named example: `.`	Directory to list. Direct JSON configurations must provide this field; the named `default` example uses the current directory (`.`).
`depth`	int	No	`1`	Number of subdirectory levels to recurse into.

Example:

1	`ls --dir C:\Users --depth 2`

powershell

Purpose: Executes a command or script block using PowerShell.

OS Support: Windows

Parameter	Type	Required	Default	Description
`command`	string	No	-	PowerShell command or script block to execute. May be omitted when supplying input through `stdin`.
`stdin`	string[]	No	-	Lines sent to stdin, simulating Enter presses between each.
`outputEncoding`	string	No	`Windows-1252`	Encoding used to decode the output.

Example:

1	`powershell --command "Get-LocalUser \| Select Name, Enabled"`

OPSEC

PowerShell execution is highly visible to EDR solutions and Windows event logging (Event ID 4103/4104). For more evasive execution, consider using run with a compiled binary, bof for inline execution, or the commercial load-pe command.

ps

Purpose: Returns a snapshot of all running processes on the target machine.

OS Support: Windows, Linux, BSD, macOS

Parameters: None

Example:

ps

Tip

Run ps before token-steal or inject to identify target process IDs and the user context they run under.

run

Purpose: Executes a program directly (without a shell) and optionally returns its output.

OS Support: Windows, Linux, BSD, macOS

Parameter	Type	Required	Default	Description
`cmdline`	string	Yes	-	Full command line including the program path and arguments.
`output`	bool	No	`true`	Whether to capture and return stdout and stderr.
`stdin`	string[]	No	-	Lines sent to stdin, simulating Enter presses between each.
`unicode`	bool	No	`false`	Treat stdin as UTF-16LE. Windows only.
`outputEncoding`	string	No	`Windows-1252`	Encoding used to decode the output. Windows only.

Example:

1	`run --cmdline "net user /domain"`

run-as

Purpose: Executes a program as a different user, supplying credentials directly.

OS Support: Windows

Parameter	Type	Required	Default	Description
`cmdline`	string	Yes	-	Full command line to execute.
`username`	string	Yes	-	Username to impersonate (e.g. `CORP\svc_backup`).
`password`	string	Yes	-	Password for the specified user.
`output`	bool	No	`true`	Whether to capture and return output.
`stdin`	string[]	No	-	Lines sent to stdin.
`unicode`	bool	No	`false`	Treat stdin as UTF-16LE.
`outputEncoding`	string	No	`Windows-1252`	Encoding used to decode the output.

Example:

1	`run-as --cmdline "cmd /c whoami" --username "CORP\svc_backup" --password "P@ssword1"`

Credentials in command history

Credentials passed via run-as appear in the command history. For a credential-free approach, use token-steal to capture an existing process token or token-make to create one - then apply it with token-use before running commands.

shutdown

Purpose: Shuts down or reboots the target machine.

OS Support: Windows, Linux, BSD, macOS

Parameter	Type	Required	Default	Description
`reboot`	bool	No	`false`	When `false`, the machine shuts down. When `true`, the machine reboots instead.

Example:

1	`shutdown --reboot true`

Warning

This command will immediately shut down or reboot the target machine, which will terminate the agent along with all other running processes. The agent will only reconnect after reboot if persistence has been set up.

sleep

Purpose: Adjusts the agent's callback interval for reverse HTTP(S) or reverse DNS communication.

OS Support: Windows, Linux, BSD, macOS

Listener requirement: The agent must have an active reverse HTTP(S) or reverse DNS listener.

Parameter	Type	Required	Default	Description
`sleep`	int	Yes	-	Base sleep duration in seconds.
`sleepRandom`	int	No	`0`	Random jitter added to the base sleep (seconds). Actual interval = `sleep` ± `sleepRandom`.

Example:

1	`sleep --sleep 60 --sleepRandom 15`

Tip

Adding jitter with sleepRandom makes beacon intervals less regular and harder to fingerprint via network-based anomaly detection.

sleep-until

Purpose: Suspends agent callbacks until a specific date and time.

OS Support: Windows, Linux, BSD, macOS

Listener requirement: The agent must have an active reverse HTTP(S) or reverse DNS listener.

Parameter	Type	Required	Default	Description
`sleepEnds`	string	Yes	-	ISO 8601 UTC timestamp (e.g. `2099-12-31T23:59:59Z`) or a Unix timestamp in seconds. Choose an appropriate future time for the operation.

Example:

1	`sleep-until --sleepEnds 2099-12-31T23:59:59Z`

Tip

Use sleep-until to park an agent silently overnight or across a weekend without generating any callback traffic during off-hours.

token-del

Purpose: Removes a specific token from the agent's token store by its number.

OS Support: Windows

Parameter	Type	Required	Default	Description
`nr`	int	Yes	-	Token number to delete, as shown by `token-list`.

Example:

1	`token-del --nr 2`

token-del-all

Purpose: Clears all tokens from the agent's token store.

OS Support: Windows

Parameters: None

Example:

1	`token-del-all`

token-from-handle

Purpose: Imports a token into the store from an existing Windows token handle, obtained externally (e.g. from a BOF).

OS Support: Windows

Parameter	Type	Required	Default	Description
`handle`	int	Yes	-	Numeric handle value of the token to import. Accepts decimal or hex (e.g. `0x1A4`).

Example:

1	`token-from-handle --handle 0x1A4`

Info

Handles are typically obtained from custom BOFs or external tooling that opens a token handle and returns its value. Use token-list after import to confirm the token was captured.

token-list

Purpose: Lists all tokens currently held in the agent's token store, showing their number, user, and type.

OS Support: Windows

Parameters: None

Example:

1	`token-list`

token-make

Purpose: Creates a new Windows token using a username and password and stores it for later use.

OS Support: Windows

Parameter	Type	Required	Default	Description
`username`	string	Yes	-	Username for the new token (e.g. `CORP\jsmith`).
`password`	string	Yes	-	Password for the user.
`netonly`	bool	No	`false`	Create a network-only token - credentials are used for network auth only; local identity remains unchanged. Equivalent to `runas /netonly`.

Example:

1	`token-make --username "CORP\jsmith" --password "Winter2025!" --netonly true`

Tip

Use netonly: true when you only need the token for network access (SMB, LDAP, WMI) while keeping the current local process identity intact.

token-steal

Purpose: Duplicates a token from an existing process and stores it in the token store.

OS Support: Windows

Parameter	Type	Required	Default	Description
`pid`	int	Yes	-	Process ID to steal the token from.

Example:

1	`token-steal --pid 4832`

Privileges required

Stealing tokens from processes owned by other users typically requires SeDebugPrivilege or an equivalent high-integrity context. Run ps first to identify a process running under the target identity.

Tip

Full impersonation workflow: ps → token-steal → token-list → token-use → run commands → token-use --nr 0 to revert.

token-use

Purpose: Applies a stored token to all subsequent commands, or resets to the agent's default token.

OS Support: Windows

Parameter	Type	Required	Default	Description
`nr`	int	Yes	-	Token number to apply. Pass `0` to reset to the agent's original token.

Example:

1	`token-use --nr 5`