--- Pivoting and Lateral Movement Handlers --- executeLinkSmb connects to an SMB beacon and re-establishes control

executeLinkTcp connects to a TCP beacon and re-establishes control

--- Payload Operations --- executeListArtifacts lists all server-side artifacts (generated payloads)

executeListJobs lists all active jobs for the specified beacon

============================================================ Server-Level Action Handlers These operations do NOT require a beacon ID and return synch

executeLogonPasswords dumps plaintext credentials and NTLM hashes

executeLs lists directory contents

executeMakeToken creates a token from specified credentials using domain/user/password

executeMakeTokenUpn creates a token from specified credentials using UPN

executeMimikatz executes a mimikatz command

executeMkdir creates a directory

executeMv moves/renames a file

executeNetComputers lists hosts from the Domain Computers and Domain Controllers groups on the specified domain

executeNetDcList lists domain controllers for the specified domain

executeNetDomain gets the current domain

executeNetDomainControllers lists hosts from the Domain Controllers group on the specified domain

executeNetDomainTrusts lists domain trusts for the specified domain

executeNetGroup enumerates groups on a domain controller

executeNetLocalGroup enumerates local groups on a specific system

executeNetLogons lists logged in users on a target

executeNetSessions lists sessions on a target

executeNetShare lists shares on a target

executeNetTime shows time for a target

executeNetUser lists users on a system

executeNetUserDetail gets information about a specific user

executeNetView lists domain hosts

executePortScan runs a portscan against the specified hosts

executePowerPick executes unmanaged PowerShell (spawn)

executePowerShell executes a PowerShell command

--- PowerShell & .NET --- executePowerShellImport imports a PowerShell script

executePrintscreen captures a screenshot using print screen method

--- Process Management Handlers --- executePs lists processes

executePsInject executes unmanaged PowerShell (inject)

executePwd gets current working directory

--- Registry --- executeRegQuery queries a registry key

executeRegQueryValue queries a registry subkey value

executeRemoteExec executes a command on a target via specific remote execution method

executeRev2Self reverts to the original security context

executeRm removes a file or folder

executeRportfwdStart starts reverse port forwarding on the specified bind port

executeRportfwdStop stops reverse port forwarding on the specific bind port

--- Command Execution Variants --- executeRun executes a command without cmd.exe

executeRunAs executes a command as another user

executeRunNoOutput executes a command without blocking or returning output

executeRunUnder executes a command with specified PID as parent

executeScreenshot captures a screenshot

executeScreenwatch starts screenwatch on the beacon (long-running background job)

executeSetDnsMode sets the DNS beacon mode (dns, dns6, or dnsTxt)

executeSetEnv sets an environment variable

executeSetNote assigns a note to the beacon

executeSetPpid sets the parent process ID for the specified beacon

executeSetSleep sets the beacon's sleep time and jitter

executeSetSpawnto sets the spawn-to process for the specified beacon

executeSetSyscallMethod sets the syscall method for the beacon

executeShell executes a shell command

executeSleep pauses execution

--- Tunneling Handlers --- executeSocks4Start starts a SOCKS4a server on the specified port

executeSocks5Start starts a SOCKS5 server on the specified port with optional authentication

executeSocksStop stops the specific SOCKS server on the given port

executeSocksStopAll stops all SOCKS servers and terminates existing connections

--- Beacon/Shellcode Spawn & Inject --- executeSpawnBeacon spawns a beacon process

executeSpawnBeaconAsUser spawns a beacon process as another user

executeSpawnBeaconUnder spawns a beacon with specified PID as parent

--- PostEx DLL --- executeSpawnPostExDll spawns a temporary process and injects postex DLL

--- Pass-the-Hash --- executeSpawnPth spawns a process for pass-the-hash

executeSpawnShellcode spawns a process and injects shellcode

executeSsh spawns a temporary process to run an SSH client with username/password

executeSshKey spawns a temporary process to run an SSH client with SSH key authentication

executeStealToken steals a token from a process

executeTimestomp copies file timestamps from source to destination

executeTokenStoreList lists all tokens in the token store

executeTokenStoreRemove removes a specific token from the token store

executeTokenStoreRemoveAll removes all tokens from the token store

executeTokenStoreSteal steals a token and stores it in the token store

executeTokenStoreStealAndUse steals a token, stores it, and immediately applies it

executeTokenStoreUse uses a token from the token store

executeUnlink disconnects from a named pipe or TCP beacon

executeUnsetPpid unsets the parent process ID for the specified beacon

executeUnsetSpawnto unsets the spawn-to process for the specified beacon

executeUpload uploads a file to the beacon's current working directory

interpolateAction replaces ${action_name} variables with action outputs

interpolateString replaces ${action_name} variables with outputs

packBinaryWithPrefix packs binary data with 4-byte BE length prefix Format: [length:4 BE][data...]

packInt packs a 32-bit integer in BIG-ENDIAN format (no length prefix) Format: [int:4 BE]

packShort packs a 16-bit short in BIG-ENDIAN format (no length prefix) Format: [short:2 BE]

packStringWithPrefix packs an ASCII string with 4-byte BE length prefix and null terminator Format: [length:4 BE][char1:1][char2:1]...[null:1] Note: L

packWideStringWithPrefix packs a UTF-16LE wide string with 4-byte BE length prefix and null terminator Format: [byte_length:4 BE][utf16le_char1:2][utf

storeBeaconMetadata stores beacon metadata in outputs map for condition evaluation

validateAction validates a single action

validateBOFAction validates BOF-specific parameters

validateVariables checks for valid variable names and potential conflicts

writeCSV writes result as CSV

writeJSON writes result as JSON

writeText writes result as human-readable text

ActionIsSynchronous returns true if the action returns a synchronous response (no task ID polling needed). All server-level operations are synchronous

Fatal logs an error message and exits