So let's have a look at how some of these payloads work.
So let's first launch an egress,
payload.
So let's use the sixty four bit HTTP payload.
If I just double click on the executable,
we see that a new beacon appears straight away in the
UI.
And we can right click this to get a little menu,
where are there some,
shortcuts for various functions,
or we can say interact.
We can also
double click
on an entry to open the interaction window.
Now this, you can drag up and down.
And together a list of commands, we can just type
help, and this will show us each,
command and a little short description.
If you want more detailed help on a particular command,
you can say help and then the command name.
So let's say help sleep,
and this will give us, the usage and,
bigger description about what these parameters are.
Now you can see by default,
sleep time for this beacon is one minute,
and the last column here indicates how long ago we last
saw the beacon check-in.
And then, obviously,
up here that we have some of the metadata about the beacon itself.
So it's running on this computer name as this username.
We have the process it's running in and the process ID
and its architecture.
Now every minute, this beacon will check into the team
server, and it will see if it has any jobs pending for it.
If it doesn't, it just goes back to sleep again for a minute.
And if it does, it will download those jobs, executes
them, and and sends the results back.
Now the longer the sleep time is, the more stealthy you are,
wire.
But of course, it also takes forever to do anything.
And in the lab, we don't really want that because, you know, time is money.
So we can change the sleep time.
So let's say sleep
five, and this will instruct the beacon to change its sleep time
from one minute to five seconds.
And we'll see in just a sec.
It has checked in.
So whenever you task a beacon,
you see this little output here where it says that the host has called home,
which really this means the beacon has called home.
So the beacon's checked into us,
and we've sent it some jobs, one or more jobs.
And the size of the data that we sent back was sixteen bytes.
Now some beacon commands like the sleep command,
they don't return any output.
So this is about the only indication you get that the task was sent.
Other than, of course,
the fact that the sleep time has updated.
So we're now at five seconds.
And you can see now that we now check-in every five seconds.
If you wanna go ham, you can change this to sleep zero.
And this changes
this puts the beacon into what this calls interactive mode.
And the beacon is checking in so quickly that everything just
seems to happen instantly.
So it's not really interactive in the true sense.
It's more like a pseudo interactive.
But if we give it some other jobs now,
like print working directory,
getuid,
and ls, you can see that all of the commands come back pretty quickly.
So we're in c payloads.
We are the attacker user,
and this is the listing of the payloads directory.
So let's look at
a peer to peer, beacon next,
because these behave differently.
So let's use the TCP.
Actually, let's use the TCP,
local.
So on this attacking machine, if we do a quick netstat,
and look for the string four four four four,
there is nothing listening on port four four four four.
If I run this beacon payload now,
you'll see that nothing happens,
in the sense that no new beacon appears.
But if we run next that again,
you can see that a process is now listening on four four four
four, on the local host only.
And that is paired,
six seven two four.
And it's just sitting there waiting for a connection.
Control k, by the way, to clear the console.
So to connect to a peer to peer beacon,
we can use the connect command for TCP or the link command for
SMB.
So let's do,
help connect.
And this will take a target,
just by itself.
If you only provide the target and not the port, it will guess
the port based on your listener configuration.
But, of course, if you have multiple TCP,
configurations, it might get
it wrong.
So it's always safer just to be explicit.
So we'll say connect to the local host.
You can use IP addresses or host names.
And the port number, four four four four.
And you see we get this established link to
ChildBeacon, and the TCP payload has, appeared.
You can see that the PID is six seven two four, which matches,
this.
Next step, we'll now show the connection
to port four four four,
from
PID six eight zero four,
which is the PID of the HTTP beacon that you can just see here.
And in this, table view,
you can see that there's a little chain icon here.
And this is to indicate that this beacon,
is a peer to peer beacon.
Now if when you have a bunch of these, it's pretty hard to
know which beacon is linked to which which beacon.
So for that, there's the graph view.
So if we click that, we get the beacons in a different view.
And you can see here that this is the HTTP beacon, and it is
connected to to this beacon here.
Now the direction and color of this
arrow, they actually mean something.
So green is for TCP and yellow is for SMB.
And the direction of the arrow denotes that this beacon
is connecting to this beacon.
You can interact with the beacons here in the same way as the graph view.
So you can right click or double
click.
And you task them in exactly the same
way and there we go
Now in terms of a sleep time,
peer to peer beacons don't really have
a they don't have their own sleep time.
They inherit whatever the,
parent egress beacon is.
So you can see that both of these are interactive at the moment.
If we go to the egress beacon
and we slow the sleep time,
you can see that this also updates the sleep time for the,
child beacon as well.
If you're done with the beacon,
you can get rid of it by go into session and exit in the
first instance, or just type exit here.
And that will instruct the beacon
to,
kill itself, basically.
And then you will see
the little icon changes,
and the graph view will say,
hey this is disconnected
you can then remove them from the view by right clicking
session and remove
and then they will disappear
now if you remove a beacon that is still alive
all that will happen is that on the next check-in it will just appear again.
So you don't have to worry about removing removing them by mistake.