Connection
#| Command | Description |
|---|
connect <url> | Set teamserver URL |
login <username> | Login (prompts for password) |
logout | Logout |
Engagements
#| Command | Description |
|---|
engagements list | List engagements |
engagements use <id> | Switch to engagement |
engagements create <name> | Create new engagement |
Agents
#| Command | Description |
|---|
agents list | List agents |
agents info <id> | Agent detail |
agents use <identifier> | Enter interactive agent shell (accepts hostname, hostname:shortid, or UUID) |
agents group create <name> <ids> | Create named group |
agents group use <name> | Enter interactive group shell |
agents group list | List groups |
agents kill <id> | Kill agent |
agents topology | Show P2P relay topology tree |
agents chain <agent_id> | Show relay chain for an agent |
agents generate <pkg> [opts] | Build an agent binary |
agents builds [info|download] | List/manage existing builds |
Agent Build Flags
#| Flag | Description |
|---|
--listener <name>[:<ip>] | Listener to use for callback |
--kill-date YYYY-MM-DD | Agent kill date |
--kill-days <N> | Kill date N days from now (alternative to --kill-date) |
--name <name> | Agent name |
--interval <seconds> | Beacon interval |
--jitter <percent> | Beacon jitter |
Agent Shell
#Enter with agents use <hostname>. Provides an interactive shell scoped to a single agent.
Remote Commands
#These are sent to the agent and executed on the target:
| Command | Description |
|---|
ls [path] | List directory contents |
cat <path> | Read file contents |
pwd | Print working directory |
cd <path> | Change directory |
whoami | Current user |
env [name] | Environment variables (all, or a specific variable) |
ps | Process list |
netstat | Network connections |
upload <local> <remote> | Upload file to agent |
download <remote_path> | Download file from agent (stored on teamserver; use files fetch to save locally) |
Results are formatted automatically — tables for ls, ps, netstat; colored output for errors.
Module Commands
#| Command | Description |
|---|
load <module_name> <format> [--daemonize] | Load an agent module (format must match agent’s supported formats) |
unload <loaded_module_id> | Unload a managed module by its loaded ID |
loaded | List modules currently loaded in this agent |
modules | Browse agent modules compatible with this agent |
Management Commands
#| Command | Description |
|---|
info | Show agent detail |
capabilities | Show agent capabilities (supported formats, commands, daemonize/relay) |
files | File transfer operations |
tasks | List background tasks |
results [N] | View background task result (by index) |
history [N] | Show command history |
help | Show available commands |
back / exit | Exit agent shell |
!<command> | Execute local shell command |
Background Tasks
#Append & to any command to run it in the background:
1
2
3
| WORKSTATION-01> ps &
[bg:1] Task queued
WORKSTATION-01> results 1
|
Group Shell
#Enter with agents group use <name>. Sends commands to all agents in the group simultaneously.
| Command | Description |
|---|
| (all remote commands) | Same as agent shell — sent to every agent in the group |
info | Show group membership |
tasks | List background tasks |
results [N] | View background task result |
history [N] | Show command history |
help | Show available commands |
back / exit | Exit group shell |
Commands can be separated with ;; for multi-task execution.
Tasks
#| Command | Description |
|---|
task <type> [json_payload] | Task selected agent(s) |
tasks list [agent_id] | List tasks |
tasks result <task_id> | Show task result |
Modules
#| Command | Description |
|---|
modules list | List agent-loadable modules |
modules list --format <fmt> | Filter by module format |
modules info <name> | Module details (metadata, options, platforms) |
modules compatible <agent_id> | List modules compatible with a specific agent |
modules refresh | Refresh agent module registry |
Module loading/unloading is done from within the agent shell via load and unload commands.
Credentials
#| Command | Description |
|---|
creds list | List credentials |
creds add | Add credential (interactive) |
creds export [--format fmt] | Export (json/csv/hashcat) |
creds search [--cred-type X] | Filter credentials |
Tools
#| Command | Description |
|---|
tools list | List remote tool modules |
tools info <name> | Module detail |
tools use <name> | Enter interactive tools shell |
tools refresh | Hot-reload tool modules |
Tools Shell
#Enter with tools use <name>. Provides an interactive session for remote operations (SSH, SMB, etc.) with proxy and credential integration.
| Command | Description |
|---|
set target <host> | Set target host |
set port <N> | Set target port |
set cred <id> | Set credential |
set proxy <id> | Set proxy configuration |
shell | Open interactive session to target |
info | Show module metadata |
operations | List available operations |
tasks | List background tasks |
results [N] | View task result |
history [N] | Show command history |
help | Show available commands |
back / exit | Exit tools shell |
Collection Requests
#| Command | Description |
|---|
requests list [--status pending] | List collection requests |
requests info <id> | Request detail |
requests approve <id> | Approve a pending request (Operator+) |
requests deny <id> [--reason <reason>] | Deny a pending request (Operator+) |
requests count | Show pending request count |
Collectors can request file downloads from agents. Operators approve or deny requests.
Proxies
#| Command | Description |
|---|
proxy list | List proxy configs |
proxy create [opts] | Create proxy config |
proxy info <id> | Proxy detail |
proxy delete <id> | Delete proxy |
File Transfers
#| Command | Description |
|---|
files list [agent_id] | List file transfers |
files info <aid> <tid> | Transfer details |
files fetch <aid> <tid> [path] | Download stored file content |
upload and download commands are available inside the agent shell (agents use <hostname>), not at the top level. Listeners
#| Command | Description |
|---|
listeners list | List listeners |
listeners create <type> [opts] | Create listener |
listeners start <name_or_id> | Start listener |
listeners stop <name_or_id> | Stop listener |
Operators
#| Command | Description |
|---|
operators list | List operators (admin) |
operators info <id> | Operator detail |
operators create <user> [opts] | Create operator (admin) |
operators update <id> [opts] | Update operator (admin) |
operators delete <id> | Delete operator (admin) |
operators grant <op> <eng> | Grant engagement access |
operators revoke <op> <eng> | Revoke engagement access |
Utility
#| Command | Description |
|---|
help | Show help |
clear | Clear screen |
exit / quit | Exit CLI |
local_shell | Open an interactive local shell |
!<command> | Execute local shell command (works in all shells and TUI) |
Flags
#Global Flags
#| Flag | Description |
|---|
--url <url> | Teamserver URL |
--json-mode | JSON output mode |
-c <command> | Execute single command and exit |
Common Command Flags
#| Command | Flag | Description |
|---|
agents generate | --listener <name>[:<ip>] | Listener for callback |
agents generate | --kill-date <date> | Agent kill date |
agents generate | --kill-days <N> | Kill date relative |
agents generate | --interval <seconds> | Beacon interval |
agents generate | --jitter <percent> | Beacon jitter |
agents builds download | --output <path> | Output file path |
creds export | --format <fmt> | Export format (json/csv/hashcat) |
creds search | --cred-type <type> | Filter by credential type |
creds search | --username <name> | Filter by username |
creds search | --domain <domain> | Filter by domain |