LazyOwn Command Reference

Searches for packages on Launchpad based on the provided search term and extracts codenames from the results. The distribution is extracted from the search term.

`metabigor`

Phase: recon | Source: cli/commands/recon_migrated.py

Executes Metabigor commands for OSINT and scanning tasks with guided input or predefined arguments.

`openssl_sclient`

Phase: recon | Source: cli/commands/recon.py

Uses openssl s_client to connect to a specified host and port, allowing for testing and debugging of SSL/TLS connections.

`ping`

Phase: recon | Source: cli/commands/recon_migrated.py

Perform a ping to check host availability and infer the operating system based on TTL values.

`ports`

Phase: recon | Source: cli/commands/recon_migrated.py

Lists all open TCP and UDP ports on the local system.

`proxy`

Phase: recon | Source: cli/commands/recon_migrated.py

Runs a small proxy server to modify HTTP requests on the fly.

`recon`

Phase: recon | Source: cli/commands/recon_migrated.py

Performs reconnaissance on a specified self.params['domain'] using crt.sh (the target must be visible on internet), pup, httprobe, and EyeWitness.

`serveralive2`

Phase: recon | Source: cli/commands/recon_migrated.py

Command serveralive2: Uses Impacket to connect to a remote MSRPC interface and retrieves the server bindings.

`sherlock`

Phase: recon | Source: cli/commands/recon_migrated.py

Executes the Sherlock tool to find usernames across social networks.

`sslscan`

Phase: recon | Source: cli/commands/recon_migrated.py

Run an SSL scan on the specified remote host.

`surface`

Phase: recon | Source: cli/commands/recon_migrated.py

Render the network surface graph in the terminal.

`tcpdump_capture`

Phase: recon | Source: cli/commands/recon_migrated.py

Starts packet capture using tcpdump on the specified interface.

`tcpdump_icmp`

Phase: recon | Source: cli/commands/recon_migrated.py

Starts tcpdump to capture ICMP traffic on the specified interface.

`trace`

Phase: recon | Source: cli/commands/recon_migrated.py

Traces the DNS information for a given self.params['domain'] using the FreeDNS service. (using freedns IP Not your IP)

`trufflehog`

Phase: recon | Source: cli/commands/recon_migrated.py

Executes trufflehog to search for secrets in a given Git repository URL.

`tshark_analyze`

Phase: recon | Source: cli/commands/recon_migrated.py

Analyzes a packet capture file using tshark based on the provided remote host IP.

`waybackmachine`

Phase: recon | Source: cli/commands/recon_migrated.py

Fetch URLs from the Wayback Machine for a given website.

`whatweb`

Phase: recon | Source: cli/commands/recon.py

Performs a web technology fingerprinting scan using whatweb.

`windapsearchscrapeusers`

Phase: recon | Source: cli/commands/recon_migrated.py

Extracts usernames from a JSON output generated by go-windapsearch and appends them

02. Scanning & Enumeration

`ad_ldap_enum`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes ad-ldap-enum to enumerate Active Directory objects (users, groups, computers)

`allin`

Phase: enum | Source: cli/commands/scan_migrated.py

Execute the AlliN.py tool with various scan modes and parameters.

`amass`

Phase: enum | Source: cli/commands/scan.py

Executes Amass to perform a passive enumeration on a given domain.

`arjun`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes an Arjun scan on the specified URL for parameter discovery.

`arpscan`

Phase: enum | Source: cli/commands/scan.py

Executes an ARP scan using arp-scan.

`batchnmap`

Phase: enum | Source: cli/commands/recon.py

Runs the internal module modules/lazynmap.sh for multiple Nmap scans.

`bbot`

Phase: enum | Source: cli/commands/scan.py

Executes a BBOT scan to perform various reconnaissance tasks.

`blazy`

Phase: enum | Source: cli/commands/scan_migrated.py

Command blazy: Installs and runs blazy for multi-vulnerability web application scanning.

`bloodhound`

Phase: enum | Source: cli/commands/scan_migrated.py

Perform LDAP enumeration using bloodhound-python with credentials from a file.

`breacher`

Phase: enum | Source: cli/commands/scan_migrated.py

Command breacher: Installs and runs Breacher for finding admin login pages and EAR vulnerabilities.

`certipy`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Certipy tool to interact with Active Directory Certificate Services.

`certipy_ad`

Phase: enum | Source: cli/commands/scan_migrated.py

Run certipy-ad against Active Directory Certificate Services.

`changeme`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes a changeme scan on a specified target URL or host.

`cme`

Phase: enum | Source: cli/commands/scan_migrated.py

Execute CrackMapExec (CME) for SMB enumeration and authentication attempts against a target.

`davtest`

Phase: enum | Source: cli/commands/scan_migrated.py

Tests WebDAV server configurations using davtest.

`dirsearch`

Phase: enum | Source: cli/commands/scan.py

Runs the dirsearch tool to perform directory and file enumeration on a specified URL.

`dmitry`

Phase: enum | Source: cli/commands/scan.py

This function constructs and executes a command for the 'dmitry' tool.

`enum4linux`

Phase: enum | Source: cli/commands/enum.py

Performs enumeration of information from a target Linux/Unix system using enum4linux.

`enum4linux_ng`

Phase: enum | Source: cli/commands/scan_migrated.py

Performs enumeration of information from a target system using enum4linux-ng.

`evil_ssdp`

Phase: enum | Source: cli/commands/scan_migrated.py

Runs evil-ssdp with various options and user-selected templates.

`feroxbuster`

Phase: enum | Source: cli/commands/scan.py

Command feroxbuster: Installs and runs Feroxbuster for performing forced browsing and directory brute-forcing.

`finger_user_enum`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the finger-user-enum tool for enumerating users on the target host.

`fuzz`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes a web server fuzzing script with user-provided parameters.

`getnpusers`

Phase: enum | Source: cli/commands/enum.py

sudo impacket-GetNPUsers mist.htb/ -no-pass -usersfile sessions/users.txt

`gobuster`

Phase: enum | Source: cli/commands/scan.py

Uses gobuster for directory and virtual host fuzzing based on provided parameters. Supports directory enumeration and virtual host discovery.

`hostdiscover`

Phase: enum | Source: cli/commands/scan.py

Discover active hosts in a subnet by performing a ping sweep.

`hound`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the hound tool for Hound is a simple and light tool for information gathering and capture exact GPS coordinates

`kerbrute`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Kerbrute tool to enumerate user accounts against a specified target self.params['domain'] controller.

`lazynmap`

Phase: enum | Source: cli/commands/recon.py

Runs the internal module modules/lazynmap.sh with target mode.

`ldapdomaindump`

Phase: enum | Source: cli/commands/scan_migrated.py

Dumps LDAP information using ldapdomaindump with credentials from a file.

`ldapsearch`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes an LDAP search against a target remote host (self.params['rhost']) and saves the results.

`lookupsid`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Impacket lookupsid tool to enumerate SIDs on a target system.

`lookupsid_py`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the LookupSID tool to perform SID enumeration on a target system.

`loxs`

Phase: enum | Source: cli/commands/scan_migrated.py

Command loxs: Installs and runs Loxs for multi-vulnerability web application scanning.

`lynis`

Phase: enum | Source: cli/commands/scan_migrated.py

Performs a Lynis audit on the specified remote system.

`magicrecon`

Phase: enum | Source: cli/commands/scan.py

Command magicrecon: Automates the setup and usage of MagicRecon to perform various types of reconnaissance and vulnerability scanning on specified targets.

`mqtt_check_py`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the MQTT check tool to verify credentials on a target system with optional SSL.

`nbtscan`

Phase: enum | Source: cli/commands/recon.py

Performs network scanning using nbtscan to discover NetBIOS names and addresses in a specified range.

`net_rpc_addmem`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the net rpc group addmem command to add a user to a specified group in Active Directory.

`netexec`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes netexec with various options for network protocol operations.

`netview`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Impacket netview tool to list network shares on a specified target.

`nikto`

Phase: enum | Source: cli/commands/recon.py

Runs the nikto tool to perform a web server vulnerability scan against the specified target host.

`nmapscript`

Phase: enum | Source: cli/commands/scan.py

Perform an Nmap scan using a specified script and port.

`nuclei`

Phase: enum | Source: cli/commands/scan.py

Executes a Nuclei scan on a specified target URL or host.

`odat`

Phase: enum | Source: cli/commands/scan_migrated.py

Command odat: Runs the ODAT sidguesser module to guess Oracle SIDs on a target Oracle database.

`openredirex`

Phase: enum | Source: cli/commands/scan_migrated.py

Command openredirex: Clones, installs, and runs OpenRedirex for testing open redirection vulnerabilities.

`osmedeus`

Phase: enum | Source: cli/commands/scan.py

Executes Osmedeus scans with guided input for various scanning scenarios.

`parsero`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes a parsero scan on a specified target URL or host.

`parth`

Phase: enum | Source: cli/commands/scan_migrated.py

Command parth: Installs and runs Parth for discovering vulnerable URLs and parameters.

`portdiscover`

Phase: enum | Source: cli/commands/scan.py

Scan all ports on a specified host to identify open ports.

`portservicediscover`

Phase: enum | Source: cli/commands/scan.py

Scan all ports on a specified host to identify open ports and associated services.

`pre2k`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the pre2k tool to query the self.params['domain'] for pre-Windows 2000 machine accounts or to pass a list of hostnames to test authentication.

`pykerbrute`

Phase: enum | Source: cli/commands/scan_migrated.py

Command pykerbrute: Automates the installation and execution of PyKerbrute for bruteforcing Active Directory accounts using Kerberos pre-authentication.

`rdp_check_py`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the RDP check tool to verify credentials or hash-based authentication on a target system.

`rpcclient`

Phase: enum | Source: cli/commands/enum.py

Executes the rpcclient command to interact with a remote Windows system over RPC (Remote Procedure Call) using anonymous credentials.

`rpcdump`

Phase: enum | Source: cli/commands/enum.py

Executes the rpcdump.py script to dump RPC services from a target host.

`rpcmap_py`

Phase: enum | Source: cli/commands/scan_migrated.py

Command rpcmap_py: Executes rpcmap.py commands to enumerate MSRPC interfaces.

`samrdump`

Phase: enum | Source: cli/commands/scan_migrated.py

Run impacket-samrdump to dump SAM data from specified ports.

`sawks`

Phase: enum | Source: cli/commands/scan_migrated.py

Executes the Swaks (Swiss Army Knife for SMTP) tool to send test emails for phishing simulations.

`sessionssh`

Phase: enum | Source: cli/commands/scan_migrated.py

Execute a command to list active SSH connections.

`skipfish`

Phase: enum | Source: cli/commands/scan.py

This function executes the web security scanning tool Skipfish

`smbattack`

Phase: enum | Source: cli/commands/scan_migrated.py

Scans for hosts with SMB service open on port 445 in the specified target network.

`smbclient`

Phase: enum | Source: cli/commands/enum.py

Interacts with SMB shares using the smbclient command to perform the following operations:

`smbclient_impacket`

Phase: enum | Source: cli/commands/enum.py

Interacts with SMB shares using the smbclient command to perform the following operations:

`smbclient_py`

Phase: enum | Source: cli/commands/enum.py

Interacts with SMB shares using the smbclient.py command to perform the following operations:

`smbmap`

Phase: enum | Source: cli/commands/enum.py

smbmap -H 10.10.10.3 [OPTIONS]

`smtpuserenum`

Phase: enum | Source: cli/commands/scan_migrated.py

Enumerates SMTP users using the smtp-user-enum tool with the VRFY method.

`snmpcheck`

Phase: enum | Source: cli/commands/scan_migrated.py

Performs an SNMP check on the specified target host.

`snmpwalk`

Phase: enum | Source: cli/commands/scan_migrated.py

Performs an SNMP check on the specified target host.

`swaks`

Phase: enum | Source: cli/commands/scan_migrated.py

Sends an email using swaks (Swiss Army Knife for SMTP).

`vscan`

Phase: enum | Source: cli/commands/scan.py

Perform port scanning using vscan with the provided parameters.

`wfuzz`

Phase: enum | Source: cli/commands/recon.py

Uses wfuzz to perform fuzzing based on provided parameters. This function supports various options for directory and file fuzzing.

`windapsearch`

Phase: enum | Source: cli/commands/scan_migrated.py

Execute the windapsearch tool to perform Active Directory Domain enumeration through LDAP queries.

`wpscan`

Phase: enum | Source: cli/commands/scan_migrated.py

Command wpscan: Installs and runs WPScan to perform WordPress vulnerability scanning.

03. Exploitation

`aclpwn_py`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the aclpwn.py tool to find and exploit ACL paths for privilege escalation in an Active Directory environment.

`adcs_check`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Check Active Directory Certificate Services for ESC1-ESC8 vulnerabilities.

`addspn_py`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the addspn.py tool to manage Service Principal Names (SPNs) on Active Directory accounts via LDAP.

`auto_pwn`

Phase: exploit | Source: cli/commands/pwn.py

Run the full autonomous exploitation chain against the target.

`autoblody`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the autobloody tool for automating Active Directory privilege escalation paths.

`cacti_exploit`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Automates the exploitation of the Cacti version 1.2.26 vulnerability

`chain`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Run autonomous exploitation chain: recon -> vuln -> exploit -> post-exploit.

`commix`

Phase: exploit | Source: cli/commands/exploit.py

Runs commix for command injection testing.

`cp`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Copies a file from the ExploitDB directory to the sessions directory.

`createcookie`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Creates a cookie.txt file in the sessions directory with the specified cookie value.

`createdll`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Create a Windows DLL file using MinGW-w64 or a Blazor DLL for Linux.

`digdug`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes Dig Dug to inflate the size of an executable file, leveraging pre-configured settings

`download_exploit`

Phase: exploit | Source: cli/commands/exploit.py

Downloads and sets up an exploit, optionally serving via HTTP.

`downloader`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Generate a downloader command for files in the sessions directory.

`eternal`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Automates the EternalBlue (MS17-010) exploitation process using Metasploit.

`excelntdonut`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Generates an Excel 4.0 (XLM) macro from a provided C# source file using EXCELntDonut.

`exploit_chain`

Phase: exploit | Source: cli/commands/pwn.py

AI-driven multi-step exploit chaining with fallback strategies.

`exploit_recommend`

Phase: exploit | Source: cli/commands/exploit_migrated.py

AI-powered exploit recommendation — matches discovered services to CVEs.

`filtering`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Applies various filtering techniques to the given command line by modifying each character or word appropriately.

`gets4uticket_py`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the gets4uticket.py tool from PKINITtools to request an S4U2Self service ticket using Kerberos.

`gettgtpkinit_py`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the gettgtpkinit.py tool from PKINITtools to request a TGT using Kerberos PKINIT with a PFX or PEM certificate.

`greatSCT`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the GreatSCT tool for generating payloads that bypass antivirus and application whitelisting solutions.

`img2cookie`

Phase: exploit | Source: cli/commands/exploit.py

Generates an XSS payload that steals cookies via an image tag.

`jwt_tool`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Uses the jwt_tool to analyze, tamper, or exploit JSON Web Tokens (JWTs).

`krbrelayx_py`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the krbrelayx.py tool for Kerberos relaying or unconstrained delegation abuse.

`kusa`

Phase: exploit | Source: cli/commands/exploit.py

Runs the Kusanagi payload generator.

`lazypwn`

Phase: exploit | Source: cli/commands/exploit.py

Executes the LazyPwn automated exploitation script.

`lfi`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Exploits a potential Local File Inclusion (LFI) vulnerability by crafting

`lol`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Exploits a target by injecting a malicious payload and collecting admin information.

`lolbas_use`

Phase: exploit | Source: cli/commands/pwn.py

Execute a specific LOLBAS technique.

`ms08_067_netapi`

Phase: exploit | Source: cli/commands/exploit_migrated.py

SMB CVE-2008-4250. Vulnerable using the module ms08_067_netapi of metasploit

`ntpdate`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Synchronizes the system clock with a specified NTP server.

`owneredit`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the Impacket owneredit tool for manipulating ownership of Active Directory objects.

`padbuster`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Execute the PadBuster command for padding oracle attacks.

`powerserver`

Phase: exploit | Source: cli/commands/exploit_migrated.py

This function generates a PowerShell script that retrieves reverse shell over http on a Windows system.

`printerbug_py`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the printerbug.py tool to trigger the SpoolService bug via RPC backconnect.

`psexec`

Phase: exploit | Source: cli/commands/enum.py

Executes the Impacket PSExec tool to attempt remote execution on the specified target.

`psexec_py`

Phase: exploit | Source: cli/commands/enum.py

Executes the Impacket PSExec tool to attempt remote execution on the specified target.

`py3ttyup`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Copies a Python reverse shell command to the clipboard.

`pyautomate`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Automates the execution of pwntomate tools on XML configuration files.

`pyoracle2`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the pyOracle2 tool for performing padding oracle attacks.

`pywhisker`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the pyWhisker tool for manipulating the msDS-KeyCredentialLink attribute of a target user or computer.

`rejetto_hfs_exec`

Phase: exploit | Source: cli/commands/exploit_migrated.py

HttpFileServer version 2.3. Vulnerable using the module rejetto_hfs_exec of metasploit

`rev`

Phase: exploit | Source: cli/commands/exploit.py

Copies a reverse shell one-liner to the clipboard.

`seo`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Performs a web seo fingerprinting scan using lazyseo.py.

`sharpshooter`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes a payload creation framework for the retrieval and execution of arbitrary CSharp source code.

`shellfire`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Runs Shellfire with various options and allows generating payloads.

`shellshock`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes a Shellshock attack against a target.

`sireprat`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Command sireprat: Automates the setup and usage of SirepRAT to perform various attacks on a Windows IoT Core device.

`sqli`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Asks the user for the URL, database, table, and columns, and then executes the Python script

`sqli_mssql_test`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Initiates a reverse MSSQL shell by starting an HTTP server to handle incoming connections and exfiltrate data.

`sqlmap`

Phase: exploit | Source: cli/commands/exploit.py

Runs SQLMap against the target URL for SQL injection testing.

`sqsh`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the Impacket sqsh tool for manipulating ownership of Active Directory objects.

`ss`

Phase: exploit | Source: cli/commands/recon.py

Search all exploit sources and map findings to the next LazyOwn command.

`sshexploit`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Exploits OpenSSH vulnerability CVE-2023-38408 via the PKCS#11 feature of the ssh-agent.

`stealth_on`

Phase: exploit | Source: cli/commands/pwn.py

Enable stealth mode for subsequent operations.

`template_helper_serializer`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Handles the creation and serialization of a template helper.

`ticketer`

Phase: exploit | Source: cli/commands/exploit.py

Runs Impacket ticketer for golden/silver ticket creation.

`unicode_WAFbypass`

Phase: exploit | Source: cli/commands/exploit_migrated.py

We open a Netcat listener on port 443 and attempt to exploit NodeJS deserialization by sending the

`upload_bypass`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Command upload_bypass: Automates the installation and execution of Upload_Bypass for performing file upload bypass tests.

`utf`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Encode a given payload into UTF-16 escape sequences.

`winbase64payload`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Creates a base64 encoded payload specifically for Windows to execute a PowerShell command or download a file using self.params['lhost'].

`wrapper`

Phase: exploit | Source: cli/commands/exploit.py

Copies LFI php-wrapper payloads to the clipboard.

`www`

Phase: exploit | Source: cli/commands/exploit.py

Starts a simple HTTP server on the configured port to serve payloads.

`xss`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Executes the XSS (Cross-Site Scripting) vulnerability testing procedure

`xsstrike`

Phase: exploit | Source: cli/commands/exploit_migrated.py

Command xsstrike: Installs and runs XSStrike for finding XSS vulnerabilities.

04. Post-Exploitation

`add2find`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Add a new custom command to the 'find' system, saved in user_commands.json.

`adversary`

Phase: postexp | Source: cli/commands/postexp_migrated.py

LazyOwn RedTeam Adversary Emulator, you can configure your own adversaries in adversary.json

`adversary_yaml`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Execute adversary from YAML in lazyadversaries/*.yaml

`aes_pe`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Encrypt with AES and random key to PE EXE file, to usage with loaders.

`apt_proxy`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Configures the local machine with internet access to act as an APT proxy for a machine without internet access.

`apt_repo`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Creates a comprehensive local APT repository with enhanced dependency resolution.

`atomic_lazyown`

Phase: postexp | Source: cli/commands/postexp.py

Execute atomic red-team tests via LazyOwn.

`bin2shellcode`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Converts a binary file to a shellcode string in C or Nim format.

`convert_remcomsvc_from_file`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Converts the Python REMCOMSVC byte string from remcomsvc.py to Golang byte slice format, prints a sample, and saves it to sessions/remcomsvc.go. see lazyaddon GoPEInjection

`cports`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Generates a command to display TCP and UDP ports and copies it to the clipboard.

`create_synthetic`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Create a basic synthetic playbook from Nmap CSV when LLM fails.

`createpayload`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Generates an obfuscated payload to evade AV detection using the payloadGenerator tool. thanks to smokeme

`d3monizedshell`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Executes the D3m0n1z3dShell tool for persistence in Linux.

`disableav`

Phase: postexp | Source: cli/commands/postexp.py

Create a VBS script to attempt disabling Windows Defender.

`exe2bin`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Trasnform file .exe into binary file.

`exe2donutbin`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Trasnform file .exe into donut binary file.

`extract_yaml`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Extract YAML from an existing debug file and try to create a playbook.

`find`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Automates command execution based on a list of aliases and commands.

`follina`

Phase: postexp | Source: cli/commands/postexp.py

Run the Follina (CVE-2022-30190) exploit setup.

`hex2shellcode`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Convert raw hex payload from msfvenom into NASM-compatible shellcode format.

`internet_proxy`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Configures the local machine with internet access to act as a proxy for a machine without internet access.

`issue_command_to_c2`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Exec command in the client using the C2. download: command you must put the file in sessions/temp_upload or use download_c2 command

`lazywebshell`

Phase: postexp | Source: cli/commands/postexp.py

Run LazyOwn webshell server on port 8888.

`mimikatzpy`

Phase: postexp | Source: cli/commands/postexp.py

Run Mimikatz over Python (impacket style).

`ofuscate_payload`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Obfuscates a shell script by encoding it in Base64 and prepares a command to decode and execute it.

`ofuscate_string`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Ofuscate a string into Go code.

`ofuscatesh`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Obfuscates a shell script by encoding it in Base64 and prepares a command to decode and execute it.

`ofuscatorps1`

Phase: postexp | Source: cli/commands/postexp.py

Obfuscate a PowerShell script.

`path2hex`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Convert a binary path to x64 little-endian hex code for shellcode injection.

`pezorsh`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Executes the PEzor tool to pack executables or shellcode with custom configurations.

`pip_proxy`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Configures the local machine with internet access to act as a pip proxy for a machine without internet access.

`pip_repo`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Sets up a local pip repository to serve Python packages for installation on a compromised machine without internet access.

`powershell_cmd_stager`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Generate and execute a PowerShell command stager to run a .ps1 script.

`rmfromfind`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Remove a custom command by index (as shown in 'find').

`rubeus`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Copies a command to the clipboard for downloading and running Rubeus.

`scavenger`

Phase: postexp | Source: cli/commands/postexp.py

Run the Scavenger post-exploitation data collector.

`scp`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Copies the local "sessions" directory to a remote host using scp, leveraging sshpass for automated authentication.

`service_ssh`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Creates a systemd service file for a specified binary and generates a script to enable and start the service.

`sessionsshstrace`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Attach strace to a running process and log output to a file.

`shellcode`

Phase: postexp | Source: cli/commands/postexp.py

Generate and manage shellcode.

`shellcode2elf`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Convert shellcode into an ELF file and infect it.

`shellcode2sylk`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Converts shellcode to SYLK format and saves the result to a file.

`shellcode_search`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Search the shell-storm API for shellcodes using the provided keywords.

`ssh_cmd`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Perform Remote Execution Command through SSH using configured start_user. See help grisun0 for backdoor user configuration.

`yara_scan`

Phase: postexp | Source: cli/commands/postexp_migrated.py

Scan files or directories with YARA rules for malware/IOCs.

05. Persistence

`asprevbase64`

Phase: persist | Source: cli/commands/persist_migrated.py

Creates a base64 encoded ASP reverse shell payload and copies it to the clipboard.

`backdoor_factory`

Phase: persist | Source: cli/commands/persist_migrated.py

Creates a backdoored executable using backdoor-factory.

`beaconcfg`

Phase: persist | Source: cli/commands/persist_migrated.py

Generate a C2 beacon profile with traffic morphing and domain fronting.

`conptyshell`

Phase: persist | Source: cli/commands/persist.py

Download ConPtyShell and prepare a PowerShell run command.

`createrevshell`

Phase: persist | Source: cli/commands/persist.py

Create a bash reverse shell script in sessions/.

`createwebshell`

Phase: persist | Source: cli/commands/persist.py

Create web shells (JPG-disguised PHP, p0wny-shell, ASP).

`createwinrevshell`

Phase: persist | Source: cli/commands/persist.py

Create a Windows reverse shell (PowerShell).

`darkarmour`

Phase: persist | Source: cli/commands/persist_migrated.py

Uses the darkarmour tool to generate an undetectable version of a PE executable.

`dr0p1t`

Phase: persist | Source: cli/commands/persist_migrated.py

Execute the Dr0p1t tool to create a stealthy malware dropper.

`ftp`

Phase: persist | Source: cli/commands/persist_migrated.py

Connects to an ftp host using credentials from a file and a specified port.

`generate_revshell`

Phase: persist | Source: cli/commands/persist_migrated.py

Generate a reverse shell in various programming languages.

`grisun0`

Phase: persist | Source: cli/commands/persist_migrated.py

Creates and copies a shell command to add a new user, assign a password, add the user to the sudo group, and switch to the user.

`grisun0w`

Phase: persist | Source: cli/commands/persist_migrated.py

Creates and copies a PowerShell command to add a new user, assign a password, add the user to the Administrators group, and switch to the user.

`ivy`

Phase: persist | Source: cli/commands/persist_migrated.py

Generates payloads using Ivy with various options. Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.

`knokknok`

Phase: persist | Source: cli/commands/persist_migrated.py

Send special string to trigger a reverse shell, with the command 'c2 client_name'

`listener_go`

Phase: persist | Source: cli/commands/persist_migrated.py

Configures and starts a listener for a specified victim.

`listener_py`

Phase: persist | Source: cli/commands/persist_migrated.py

Configures and starts a listener for a specified victim.

`msfpc`

Phase: persist | Source: cli/commands/persist_migrated.py

Generates payloads using MSFvenom Payload Creator (MSFPC).

`paranoid_meterpreter`

Phase: persist | Source: cli/commands/persist_migrated.py

Creates and deploys a paranoid Meterpreter payload and listener with SSL/TLS pinning and UUID tracking.

`pwncat`

Phase: persist | Source: cli/commands/persist_migrated.py

Runs pwncat with the specified port for listening. SELFINJECT

`pwncatcs`

Phase: persist | Source: cli/commands/persist.py

Start a pwncat-cs reverse shell listener.

`rdp`

Phase: persist | Source: cli/commands/persist_migrated.py

Reads credentials from a file, encrypts the password, and executes the RDP connection command.

`revwin`

Phase: persist | Source: cli/commands/persist.py

Create a Windows reverse shell executable.

`scarecrow`

Phase: persist | Source: cli/commands/persist_migrated.py

Executes ScareCrow with various options for bypassing EDR solutions and executing shellcode.

`service`

Phase: persist | Source: cli/commands/persist_migrated.py

Creates a systemd service file for a specified binary and generates a script to enable and start the service.

`setoolKits`

Phase: persist | Source: cli/commands/persist_migrated.py

Executes the SEToolKit workflow to generate a Meterpreter payload

`toctoc`

Phase: persist | Source: cli/commands/persist_migrated.py

Sends a magic packet to the Chinese malware.

`veil`

Phase: persist | Source: cli/commands/persist_migrated.py

Generates payloads using Veil-Evasion with various options. Veil-Evasion is a payload creation framework

`weevely`

Phase: persist | Source: cli/commands/persist_migrated.py

Connect to PHP backdoor using Weevely, protected with the given password.

`weevelygen`

Phase: persist | Source: cli/commands/persist_migrated.py

Generate a PHP backdoor using Weevely, protected with the given password.

`wmi_lateral`

Phase: persist | Source: cli/commands/persist.py

Execute a command on a remote host via WMI.

`wmi_persist`

Phase: persist | Source: cli/commands/persist.py

Create WMI Event Subscription persistence (fileless, no disk write).

`wmi_scheduled_task`

Phase: persist | Source: cli/commands/persist.py

Create a scheduled task for persistence via WMI.

06. Privilege Escalation

`crystal_ball`

Phase: privesc | Source: cli/commands/crystal_ball.py

Analyze linpeas/winpeas output and rank privesc vectors with exact commands.

`gtfo`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Look up a binary in GTFOBins and LOLBas parquet knowledge bases.

`juicypotato`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Serve JuicyPotato over HTTP for Windows privilege escalation.

`les`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Run Linux Exploit Suggester against a kernel version.

`linpeas`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Serve linpeas.sh over HTTP and print the target one-liner.

`printspoofer`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Serve PrintSpoofer over HTTP for Windows privilege escalation.

`privesc_cmd_by_os`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Prepare and send a linpeas/winpeas command to a C2 client.

`privesc_suggest`

Phase: privesc | Source: cli/commands/crystal_ball.py

Quick alias for crystal_ball --auto.

`pspy`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Serve the pspy process monitor over HTTP.

`responder`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Run Responder on the configured device with elevated privileges.

`smbserver`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Stand up an Impacket SMB server with three relay variants.

`sudo`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Re-launch the framework with root privileges when missing.

`sudo_privesc`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Analyse sudo -l output and cross-reference with GTFOBins.

`suid_check`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Print SUID/SGID enumeration commands ready to paste on the target.

`whoami_priv`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Print privilege enumeration commands for the target OS.

`winpeas`

Phase: privesc | Source: cli/commands/privilege_escalation.py

Serve a winPEAS variant over HTTP and print the target one-liner.

07. Credential Access

`addusers`

Phase: cred | Source: cli/commands/cred_migrated.py

Opens or creates the users.txt file in the sessions directory for editing using nano.

`adsso_spray`

Phase: cred | Source: cli/commands/cred_migrated.py

Performs a password spray attack on Azure Active Directory Seamless Single Sign-On (SSO) using a specified list of users.

`cewl`

Phase: cred | Source: cli/commands/cred.py

Generate a wordlist from a website with cewl.

`crack_cisco_7_password`

Phase: cred | Source: cli/commands/cred_migrated.py

Crack a Cisco Type 7 password hash and display the plaintext.

`createcredentials`

Phase: cred | Source: cli/commands/cred_migrated.py

Creates a credentials.txt file in the sessions directory with the specified username and password.

`createhash`

Phase: cred | Source: cli/commands/cred_migrated.py

Creates a hash.txt file in the sessions directory with the specified hash value and analyzes it using Name-the-hash.

`createmail`

Phase: cred | Source: cli/commands/cred_migrated.py

Generate email permutations based on a full name and self.params['domain'], then save them to a file.

`createusers_and_hashs`

Phase: cred | Source: cli/commands/cred_migrated.py

Command createusers_and_hashs: Extracts usernames and hashes from a dump file.

`cred`

Phase: cred | Source: cli/commands/cred_migrated.py

Display the credentials stored in the credentials.txt file and copy the password to the clipboard.

`creds_py`

Phase: cred | Source: cli/commands/cred.py

Extract credentials from a file or command output.

`crunch`

Phase: cred | Source: cli/commands/cred.py

Generate wordlists with crunch.

`cubespraying`

Phase: cred | Source: cli/commands/cred_migrated.py

Command cubespraying: Automates the installation and usage of CubeSpraying for performing credential spraying attacks.

`dacledit`

Phase: cred | Source: cli/commands/cred_migrated.py

Execute the dacledit.py command for a specific user or all users listed in the users.txt file.

`generatedic`

Phase: cred | Source: cli/commands/cred_migrated.py

Generates a wordlist based on a target name and a list of characters, with various combinations.

`hashcat`

Phase: cred | Source: cli/commands/cred.py

Run hashcat password cracking.

`hydra`

Phase: cred | Source: cli/commands/cred.py

Run Hydra for online password attacks.

`john2hash`

Phase: cred | Source: cli/commands/cred.py

Convert a hash to John the Ripper format.

`john2keepas`

Phase: cred | Source: cli/commands/cred_migrated.py

List all .kdbx files in the 'sessions' directory, let the user select one, and run the

`john2zip`

Phase: cred | Source: cli/commands/cred_migrated.py

List all .zip files in the 'sessions' directory, let the user select one, and run the command

`keepass`

Phase: cred | Source: cli/commands/cred_migrated.py

Open a .kdbx file and print the titles and contents of all entries. The password can be provided through

`medusa`

Phase: cred | Source: cli/commands/cred.py

Run Medusa for online password attacks.

`passtightvnc`

Phase: cred | Source: cli/commands/cred_migrated.py

Decrypts TightVNC passwords using Metasploit.

`passwordspray`

Phase: cred | Source: cli/commands/cred_migrated.py

Perform password spraying using crackmapexec with the provided parameters.

`refill_password`

Phase: cred | Source: cli/commands/cred_migrated.py

Generate a list of possible passwords by filling each asterisk in the input with user-specified characters.

`rocky`

Phase: cred | Source: cli/commands/cred_migrated.py

Reduces a wordlist based on the specified password length.

`searchhash`

Phase: cred | Source: cli/commands/cred_migrated.py

Helps to find hash types in Hashcat by searching through its help output.

`smalldic`

Phase: cred | Source: cli/commands/cred_migrated.py

Handles the creation of temporary files for users and passwords based on a small dictionary.

`spraykatz`

Phase: cred | Source: cli/commands/cred.py

Run SprayKatz for credential spraying.

`sshkey`

Phase: cred | Source: cli/commands/cred.py

Generate an SSH key pair.

`transform`

Phase: cred | Source: cli/commands/cred_migrated.py

Transforms the input string based on user-defined casing style.

`username_anarchy`

Phase: cred | Source: cli/commands/cred_migrated.py

Generate usernames using the username-anarchy tool based on user input.

08. Lateral Movement

`addcli`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Add a client to execute c2 commands

`bitm`

Phase: lateral | Source: cli/commands/bitm.py

Browser-in-the-Middle attack manager.

`bloodyAD`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Execute the bloodyAD.py command for a specific user or all users listed in the users.txt file.

`chisel`

Phase: lateral | Source: cli/commands/lateral.py

Run chisel for quick tunneling.

`dcomexec`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Executes the Impacket dcomexec tool to run commands on a remote system using DCOM.

`dominion`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Execute a fully automated Active Directory domain takeover.

`getTGT`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Requests a Ticket Granting Ticket (TGT) using the Impacket tool with provided credentials.

`gospherus`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Command gospherus: Clones and uses the Gopherus tool to generate gopher payloads for various services.

`id_rsa`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Create an SSH private key file and connect to a remote host using SSH.

`lateral_mov_lin`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Perform lateral movement by downloading and installing LazyOwn on a remote Linux machine.

`ligolo`

Phase: lateral | Source: cli/commands/lateral.py

Run Ligolo-ng for advanced pivoting.

`mssqlcli`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Attempts to connect to an MSSQL server using the mssqlclient.py tool with Windows authentication.

`nc`

Phase: lateral | Source: cli/commands/lateral.py

Netcat listener or connect.

`ngrok`

Phase: lateral | Source: cli/commands/lateral.py

Start ngrok tunnel.

`penelope`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Command penelope: Installs and runs Penelope for handling reverse and bind shells.

`regeorg`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Executes the reGeorg tool for HTTP(s) tunneling through a SOCKS proxy.

`rnc`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Runs nc with rlwrap the specified port for listening.

`set_proxychains`

Phase: lateral | Source: cli/commands/lateral.py

Configure proxychains for the current session.

`shadowsocks`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Execute the Shadowsocks tool to create a secure tunnel for network traffic.

`socat`

Phase: lateral | Source: cli/commands/lateral.py

Run socat for port forwarding.

`ssh`

Phase: lateral | Source: cli/commands/lateral.py

SSH to a remote host (custom port).

`sshd`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Starts the SSH service and displays its status.

`stormbreaker`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Command stormbreaker: Automates the installation and usage of Storm-Breaker for performing various network attacks.

`targetedKerberoas`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Executes the targetedKerberoast tool for extracting Kerberos service tickets.

`tord`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Execute the tor.sh script with the specified port or default to port 80 if no port is provided.

`upload_c2`

Phase: lateral | Source: cli/commands/lateral_migrated.py

upload command in the client using the C2 to upload a file

`vpn`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Connect to a VPN by selecting from available .ovpn files.

`wifipass`

Phase: lateral | Source: cli/commands/lateral_migrated.py

This function generates a PowerShell script that retrieves saved Wi-Fi passwords on a Windows system.

`wmiexec`

Phase: lateral | Source: cli/commands/lateral.py

Execute commands via WMI.

`wmiexecpro`

Phase: lateral | Source: cli/commands/lateral_migrated.py

Executes wmiexec-pro with various options for WMI operations.

09. Data Exfiltration

`adgetpass`

Phase: exfil | Source: cli/commands/exfiltration.py

Generate a PowerShell script to extract Azure AD Connect credentials.

`decrypt`

Phase: exfil | Source: cli/commands/exfiltration.py

Decrypt an XOR-encrypted file using the matching key.

`dns_beacon`

Phase: exfil | Source: cli/commands/dns_exfil.py

Start a DNS tunneling beacon.

`dns_beacon_status`

Phase: exfil | Source: cli/commands/dns_exfil.py

Show status of all DNS beacons.

`dns_exfil_listen`

Phase: exfil | Source: cli/commands/dns_exfil.py

Start a DNS exfiltration listener on UDP port 53.

`download_c2`

Phase: exfil | Source: cli/commands/exfiltration.py

Download a file from the C2 implant via the upload command.

`dpapi_blob`

Phase: exfil | Source: cli/commands/dpapi.py

Decrypt a DPAPI blob offline.

`dpapi_harvest`

Phase: exfil | Source: cli/commands/dpapi.py

Harvest all DPAPI-protected credentials from the local machine.

`dpapi_masterkeys`

Phase: exfil | Source: cli/commands/dpapi.py

List and extract DPAPI master keys.

`dploot`

Phase: exfil | Source: cli/commands/exfiltration.py

Run dploot to loot DPAPI-protected secrets.

`encrypt`

Phase: exfil | Source: cli/commands/exfiltration.py

Encrypt a file with XOR using a caller-supplied key.

`evidence`

Phase: exfil | Source: cli/commands/exfiltration.py

Encode the sessions/ tree into a video file or decode one back.

`evilwinrm`

Phase: exfil | Source: cli/commands/exfiltration.py

Drive Evil-WinRM through password, hash or kerberos-only auth.

`exfil_auto`

Phase: exfil | Source: cli/commands/exfiltration.py

Auto-detect flags and sensitive files, then exfiltrate.

`exfil_discord`

Phase: exfil | Source: cli/commands/exfiltration.py

Exfiltrate a file via Discord webhook.

`exfil_dns`

Phase: exfil | Source: cli/commands/exfiltration.py

Exfiltrate data via DNS tunneling.

`exfil_gcs`

Phase: exfil | Source: cli/commands/exfiltration.py

Upload a file to Google Cloud Storage.

`exfil_http`

Phase: exfil | Source: cli/commands/exfiltration.py

Exfiltrate a file via HTTP POST to a controlled server.

`exfil_s3`

Phase: exfil | Source: cli/commands/exfiltration.py

Upload a file to an AWS S3 bucket.

`exfil_start_server`

Phase: exfil | Source: cli/commands/dns_exfil.py

Start all required exfiltration listeners.

`exfil_telegram`

Phase: exfil | Source: cli/commands/exfiltration.py

Exfiltrate a file via Telegram Bot API.

`getadusers`

Phase: exfil | Source: cli/commands/exfiltration.py

Run impacket-GetADUsers to enumerate AD accounts on the DC.

`getnthash_py`

Phase: exfil | Source: cli/commands/exfiltration.py

Recover the NT hash from a Kerberos U2U TGS via PKINITtools.

`getuserspns`

Phase: exfil | Source: cli/commands/exfiltration.py

Run impacket-GetUserSPNs to request roastable service tickets.

`gitdumper`

Phase: exfil | Source: cli/commands/exfiltration.py

Install git-dumper if missing and pull a remote .git tree.

`gmsadumper`

Phase: exfil | Source: cli/commands/exfiltration.py

Run gMSADumper to read gMSA password blobs visible to the user.

`http_exfil_server`

Phase: exfil | Source: cli/commands/dns_exfil.py

Start a minimal HTTP exfiltration receiver.

`reg_py`

Phase: exfil | Source: cli/commands/exfiltration.py

Query a remote registry hive with impacket-reg.py over hash auth.

`rsync`

Phase: exfil | Source: cli/commands/exfiltration.py

Push the sessions/ tree to rhost over SCP with sshpass.

`samdump2`

Phase: exfil | Source: cli/commands/exfiltration.py

Run samdump2 against sessions/SYSTEM and sessions/SAM.

`secretsdump`

Phase: exfil | Source: cli/commands/exfiltration.py

Run impacket-secretsdump for SAM, credentials, or NTDS payloads.

`smb_exfil`

Phase: exfil | Source: cli/commands/dns_exfil.py

Exfiltrate files to an SMB share on the attacker machine.

`stage`

Phase: exfil | Source: cli/commands/exfiltration.py

Stage data for exfiltration: compress, encrypt, and split.

`unzip`

Phase: exfil | Source: cli/commands/exfiltration.py

Extract a zip archive located under sessions/.

`upload_gofile`

Phase: exfil | Source: cli/commands/exfiltration.py

Upload a file from sessions/ to Gofile via its HTTP API.

10. Command & Control

`apt_playbook`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

List, validate, and run APT playbooks based on public threat reports.

`atomic_agent`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Generates and synchronizes atomic agent scripts.

`atomic_gen`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Generates test and cleanup scripts for a given Atomic Red Team technique ID.

`atomic_tests`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Executes Atomic Red Team tests based on user-selected platform and test.

`attack_plan`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Executes a multi-step APT simulation plan based on Atomic Red Team test IDs.

`automsf`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Try to check if Vulnerable using the module passed by argument of lazyown example automsf exploit/windows/iis/iis_webdav_upload_asp to use in metasploit

`c2`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Handle C2 server setup and agent compilation.

`c2_beacon_cmd`

Phase: c2 | Source: cli/commands/command_and_control.py

Queue a command for execution on a connected beacon.

`c2_beacons`

Phase: c2 | Source: cli/commands/command_and_control.py

List all active beacon sessions with their last-seen timestamps.

`c2_implant`

Phase: c2 | Source: cli/commands/command_and_control.py

Generate a compiled implant payload for the target platform.

`c2_keygen`

Phase: c2 | Source: cli/commands/command_and_control.py

Generate a fresh AES-256 key for beacon encryption.

`c2_quickstart`

Phase: c2 | Source: cli/commands/command_and_control.py

Quick C2 setup: generate key, prepare implant dir, print beacon commands.

`c2_status`

Phase: c2 | Source: cli/commands/command_and_control.py

Show consolidated C2 status: listeners, beacons, implants, and sessions.

`caldera`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Installs and starts the Caldera server.

`caldera_export`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Export a LazyOwn playbook to CALDERA ability YAML.

`caldera_import`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Import CALDERA abilities into LazyOwn playbooks.

`duckyspark`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

duckyspark Compiles and uploads an .ino sketch to a Digispark device using Arduino CLI and Micronucleus.

`emp3r0r`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Command emp3r0r Downloads and sets up the Emperor server for local exploitation.

`empire`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Generates payloads using PowerShell Empire with various options.

`generate_playbook`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Generates a playbook that integrates Atomic Red Team tests and MITRE ATT&CK techniques.

`iis_webdav_upload_asp`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

(CVE-2017-7269). Vulnerable using the module iis_webdav_upload_asp of metasploit

`listener`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Manage C2 listeners: list, add, start, stop, remove.

`mitre_test`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Interacts with the MITRE ATT&CK framework using the STIX 2.0 format.

`msf`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Automates various Metasploit tasks including scanning for vulnerabilities, setting up reverse shells, and creating payloads.

`msfrpc`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Connects to the msfrpcd daemon and allows remote control of Metasploit.

`my_playbook`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Generates a playbook from your custom technique database.

`sandbox`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Toggle or query Docker sandbox mode.

`sliver_server`

Phase: c2 | Source: cli/commands/command_and_control_migrated.py

Starts the Sliver server and generates a client configuration file for connecting clients.

11. Reporting

`apropos`

Phase: report | Source: cli/commands/report_migrated.py

Search for commands matching the given parameter in the cmd interface and optionally extend the search using the system's apropos command.

`banners`

Phase: report | Source: cli/commands/report.py

Manage custom banners for the framework.

`c2asm`

Phase: report | Source: cli/commands/report_migrated.py

Display C and ASM code side by side in a curses-based interface.

`camphish`

Phase: report | Source: cli/commands/report_migrated.py

Executes the camphish tool for Grab cam shots from target's phone front camera or PC webcam just sending a link.

`create_session_json`

Phase: report | Source: cli/commands/report.py

Create the session JSON report file.

`createjsonmachine`

Phase: report | Source: cli/commands/report_migrated.py

Create a new JSON payload file based on the template provided in payload.json.

`createjsonmachine_batch`

Phase: report | Source: cli/commands/report_migrated.py

Create multiple JSON payload files based on a CSV input file from HackerOne.

`createtargets`

Phase: report | Source: cli/commands/report.py

Create targets file from nmap scan.

`download_malwarebazar`

Phase: report | Source: cli/commands/report_migrated.py

Download a malware sample from MalwareBazaar using its SHA256 hash.

`extract_ports`

Phase: report | Source: cli/commands/report_migrated.py

Extracts open ports and IP address information from a specified file.

`eyewitness`

Phase: report | Source: cli/commands/report.py

Run EyeWitness for web screenshot capture.

`eyewitness_py`

Phase: report | Source: cli/commands/report_migrated.py

Automates EyeWitness installation and execution without requiring user input.

`gen_report`

Phase: report | Source: cli/commands/report_enhanced.py

Generate enhanced professional penetration test reports.

`get_avaible_actions`

Phase: report | Source: cli/commands/report_migrated.py

Get list de supported acctions.

`gowitness`

Phase: report | Source: cli/commands/report.py

Run gowitness for web screenshot capture.

`gpt`

Phase: report | Source: cli/commands/report.py

Query GPT/Groq AI for analysis and reporting.

`img2vid`

Phase: report | Source: cli/commands/report_migrated.py

Generates an MP4 video from PNG images found in the sessions/captured_images directory.

`lazyreport`

Phase: report | Source: cli/commands/report_migrated.py

Generate a professional red team report from session data.

`malwarebazar`

Phase: report | Source: cli/commands/report.py

Search Malware Bazaar for malware samples.

`morse`

Phase: report | Source: cli/commands/report_migrated.py

Interactive Morse Code Converter.

`name_the_hash`

Phase: report | Source: cli/commands/report_migrated.py

Identify hash type using nth after retrieving it with get_hash().

`nmapscripthelp`

Phase: report | Source: cli/commands/report_migrated.py

Provides help to find and display information about Nmap scripts.

`process_scans`

Phase: report | Source: cli/commands/report_migrated.py

Processes CSV files with scan results and vulnerability data to generate a Shodan-like JSON database.

`pth_net`

Phase: report | Source: cli/commands/report_migrated.py

Executes the Pass-the-Hash (PTH) Net tool to change the password of an Active Directory account.

`pup`

Phase: report | Source: cli/commands/report_migrated.py

Processes HTML content from a specified URL using the pup utility and a default CSS selector.

`vulns`

Phase: report | Source: cli/commands/report.py

Display or manage vulnerabilities.

12. Miscellaneous

`EOF`

Phase: misc | Source: cli/commands/misc_migrated.py

Handle the end-of-file (EOF) condition.

`acknowledgearp`

Phase: misc | Source: cli/commands/misc_migrated.py

Configures the system to acknowledge ARP requests by setting a kernel parameter.

`acknowledgeicmp`

Phase: misc | Source: cli/commands/misc_migrated.py

Configures the system to respond to ICMP echo requests by setting a kernel parameter.

`addalias`

Phase: misc | Source: cli/commands/misc_migrated.py

Add a new alias with support for placeholders like {rhost}, {lhost}, {lport}, etc.

`addhosts`

Phase: misc | Source: cli/commands/misc_migrated.py

Adds an entry to the /etc/hosts file, mapping an IP address to a domain name.

`aliass`

Phase: misc | Source: cli/commands/misc_migrated.py

Prints all configured aliases and their associated commands.

`assign`

Phase: misc | Source: cli/commands/misc_migrated.py

assign a parameter value, persist to payload.json and refresh aliases.

`back`

Phase: misc | Source: cli/commands/module_manager.py

Leave the current module context.

Phase: misc | Source: cli/commands/misc_migrated.py

Show the banner

`base64decode`

Phase: misc | Source: cli/commands/misc_migrated.py

Decodes a Base64 encoded string.

`base64encode`

Phase: misc | Source: cli/commands/misc_migrated.py

Encodes a given string into Base64 format.

`browse`

Phase: misc | Source: cli/commands/misc_migrated.py

Open the sessions/ TUI browser.

`campaign`

Phase: misc | Source: cli/commands/campaign.py

Export or import an entire campaign as a portable package.

`catalog`

Phase: misc | Source: cli/commands/catalog.py

Browse the command catalog.

`chainmode`

Phase: misc | Source: cli/commands/misc_migrated.py

Toggle interactive kill-chain chaining after every command.

`check_update`

Phase: misc | Source: cli/commands/misc_migrated.py

Checks for updates by comparing the local version with the remote version.

`clean`

Phase: misc | Source: cli/commands/misc_migrated.py

Deletes files and directories in the sessions directory, excluding specified files and directories.

`clock`

Phase: misc | Source: cli/commands/misc_migrated.py

Displays the current date and time, and runs a custom shell script.

`clone_site`

Phase: misc | Source: cli/commands/misc_migrated.py

Clone a website and serve the files in sessions/{url_cloned}.

`collab_join`

Phase: misc | Source: cli/commands/misc_migrated.py

Print the multi-operator collaboration join URL and SSE endpoint.

`config_banner`

Phase: misc | Source: cli/commands/misc_migrated.py

Open a Powerlevel10k-style wizard to toggle prompt segments.

`cred_mark_failed`

Phase: misc | Source: cli/commands/automation.py

Mark a credential as failed against a host.

`cred_reuse`

Phase: misc | Source: cli/commands/automation.py

Analyze captured credentials and suggest spray targets.

`cron`

Phase: misc | Source: cli/commands/misc_migrated.py

Schedules a command to run at a specified time.

`ctx`

Phase: misc | Source: cli/commands/misc_migrated.py

Print a single-line operator context: rhost, lhost, domain, phase, os, creds.

`daemon_approve`

Phase: misc | Source: cli/commands/misc_migrated.py

Approve or veto the daemon's currently-pending action.

`daemon_focus`

Phase: misc | Source: cli/commands/misc_migrated.py

Restrict the autonomous daemon to a set of focus targets.

`daemon_mode`

Phase: misc | Source: cli/commands/misc_migrated.py

Switch the autonomous daemon between auto, approval and paused modes.

`daemon_pause`

Phase: misc | Source: cli/commands/misc_migrated.py

Pause the autonomous daemon before its next step.

`daemon_resume`

Phase: misc | Source: cli/commands/misc_migrated.py

Resume the autonomous daemon (switch mode to auto).

`daemon_veto`

Phase: misc | Source: cli/commands/misc_migrated.py

Add or clear vetoed command first-tokens for the autonomous daemon.

`dashboard`

Phase: misc | Source: cli/commands/misc_migrated.py

Launch the full-screen LazyOwn operator dashboard (Textual TUI).

`db_creds`

Phase: misc | Source: cli/commands/database.py

List or add credentials.

`db_export`

Phase: misc | Source: cli/commands/database.py

Export database table to CSV.

`db_hosts`

Phase: misc | Source: cli/commands/database.py

List or add hosts in the active workspace.

`db_import`

Phase: misc | Source: cli/commands/database.py

Import scan results into the database.

`db_init`

Phase: misc | Source: cli/commands/database.py

Initialize the database (creates schema if not exists).

`db_loot`

Phase: misc | Source: cli/commands/database.py

List or add loot items.

`db_notes`

Phase: misc | Source: cli/commands/database.py

List or add notes.

`db_services`

Phase: misc | Source: cli/commands/database.py

List all services in the active workspace.

`db_status`

Phase: misc | Source: cli/commands/database.py

Show entity counts for the active workspace.

`db_vulns`

Phase: misc | Source: cli/commands/database.py

List or add vulnerabilities.

`db_workspace`

Phase: misc | Source: cli/commands/database.py

Manage workspaces (list, create, switch, delete).

`decode`

Phase: misc | Source: cli/commands/misc_migrated.py

Decode a string using the specified shift value and substitution key.

`doctor`

Phase: misc | Source: cli/commands/misc_migrated.py

Preflight environment health check — verify the install is ready.

`download_resources`

Phase: misc | Source: cli/commands/misc_migrated.py

Downloads resources into the sessions directory.

`encode`

Phase: misc | Source: cli/commands/misc_migrated.py

Encodes a string using the specified shift value and substitution key.

`encoderpayload`

Phase: misc | Source: cli/commands/misc_migrated.py

Applies various obfuscations to a given command line string to create multiple obfuscated versions.

`encodewinbase64`

Phase: misc | Source: cli/commands/misc_migrated.py

Encodes a given payload into a Base64 encoded string suitable for Windows PowerShell execution.

`engage`

Phase: misc | Source: cli/commands/misc_migrated.py

Drive a single target through the full kill-chain in one command.

`exit`

Phase: misc | Source: cli/commands/misc_migrated.py

Exit the command line interface.

`explore`

Phase: misc | Source: cli/commands/misc_migrated.py

Show exploration coverage and addon/tool suggestions per service.

`fixel`

Phase: misc | Source: cli/commands/misc_migrated.py

Fixes file permissions and line endings in the project directories.

`fixperm`

Phase: misc | Source: cli/commands/misc_migrated.py

Fix permissions for LazyOwn shell scripts.

`gencert`

Phase: misc | Source: cli/commands/misc_migrated.py

Generates a certificate authority (CA), client certificate, and client key.

`generate`

Phase: misc | Source: cli/commands/payload_generation.py

Generate a payload.

`getseclist`

Phase: misc | Source: cli/commands/misc_migrated.py

Get the SecLists wordlist from GitHub.

`god_nodes`

Phase: misc | Source: cli/commands/misc_migrated.py

Show the most-connected nodes ("god nodes") from the graph.

`graph`

Phase: misc | Source: cli/commands/misc_migrated.py

Generates a graph from JSON payload files containing URL, RHOST, and RPORT.

`graph_overlay`

Phase: misc | Source: cli/commands/misc_migrated.py

Open the graph overlay over the graphify knowledge graph.

`graph_search`

Phase: misc | Source: cli/commands/misc_migrated.py

Fuzzy search the graphify knowledge graph for nodes by label.

`gym`

Phase: misc | Source: cli/commands/redteam_gym.py

Red Team Gym — gamified pentest training with ELO scoring.

`h`

Phase: misc | Source: cli/commands/misc_migrated.py

Open a new window within a tmux session using the LazyOwn RedTeam Framework.

`hex_to_plaintext`

Phase: misc | Source: cli/commands/misc_migrated.py

Converts hexadecimal data from a file to plain text.

`hooks`

Phase: misc | Source: cli/commands/automation.py

Conditional hooks management — list, enable, disable, add, remove rules.

`hooks_add`

Phase: misc | Source: cli/commands/automation.py

Add a new conditional hook rule (JSON string).

`hooks_enable`

Phase: misc | Source: cli/commands/automation.py

Enable or disable a hook rule.

`hooks_fire`

Phase: misc | Source: cli/commands/automation.py

Manually fire a hook event for testing.

`hooks_list`

Phase: misc | Source: cli/commands/automation.py

List all conditional hook rules.

`hooks_remove`

Phase: misc | Source: cli/commands/automation.py

Remove a hook rule by name.

`hunt`

Phase: misc | Source: cli/commands/misc_migrated.py

Run an autonomous exploitation chain against a target.

`ignorearp`

Phase: misc | Source: cli/commands/misc_migrated.py

Configures the system to ignore ARP requests by setting a kernel parameter.

`ignoreicmp`

Phase: misc | Source: cli/commands/misc_migrated.py

Configures the system to ignore ICMP echo requests by setting a kernel parameter.

`ip`

Phase: misc | Source: cli/commands/misc_migrated.py

Displays IP addresses of network interfaces and copies the IP address from the tun0 interface to the clipboard.

`ip2asn`

Phase: misc | Source: cli/commands/misc_migrated.py

Command to get ASN for a given IP address.

`ip2hex`

Phase: misc | Source: cli/commands/misc_migrated.py

Convert an IPv4 address into its hexadecimal representation.

`ipp`

Phase: misc | Source: cli/commands/misc_migrated.py

Displays IP addresses of network interfaces and prints the IP address from the tun0 interface.

`karma`

Phase: misc | Source: cli/commands/misc_migrated.py

Show ELO score, karma rank and exploration progress for this operator.

`kick`

Phase: misc | Source: cli/commands/misc_migrated.py

Handles the process of sending a spoofed ARP packet to a specified IP address with a given MAC address.

`killchain`

Phase: misc | Source: cli/commands/misc_migrated.py

Show the unified kill-chain progress and control auto-refresh.

`l00t`

Phase: misc | Source: cli/commands/misc_migrated.py

Unified loot: show, search, reuse, graph, and mark credentials.

`lab`

Phase: misc | Source: cli/commands/lab.py

Manage local CTF practice labs.

`lazyscript`

Phase: misc | Source: cli/commands/misc_migrated.py

Executes commands defined in a lazyscript file.

`links`

Phase: misc | Source: cli/commands/misc_migrated.py

Displays a list of useful links and allows the user to select and copy a link to the clipboard.

`list`

Phase: misc | Source: cli/commands/misc_migrated.py

Lists all available scripts in the modules directory.

`listaliases`

Phase: misc | Source: cli/commands/misc_migrated.py

List all available aliases.

`load_session`

Phase: misc | Source: cli/commands/misc_migrated.py

Load the session from the sessionLazyOwn.json file and display the status of various parameters.

`lock_target`

Phase: misc | Source: cli/commands/collaboration.py

Acquire an advisory lock on a target to prevent tool collisions.

Phase: misc | Source: cli/commands/cli_auth.py

Authenticate against users.json (same users as lazyc2.py).