Execute

Execute

The Execute tab is a terminal-style interface for running commands on a compromised target. It supports four kinds of backends:

1. A web shell that you generated on the Generate tab and deployed.
2. An active session or beacon on a Sliver-C2 teamserver.
3. A callback on a Mythic-C2 server.
4. Any custom execution backend registered by a plugin (see Plugins).

Streamer mode bars the sliver (name) > and mythic (name) > session prompts, the connected session and callback names beside them, the web shell's target URL, path and auth key, the Mythic URL, username and API token, and the pasted Sliver Operator Config — which carries the teamserver address and the operator's mTLS key and certificate, and so is the single most costly field on the page to leave on a stream. See Settings.

Web shell mode

After you have deployed a generated shell, fill in:

• Target URL: the scheme and host of the target (for example, https://app.example.com).
• Shell path: the path where your shell lives (for example, /uploads/x.php).
• Auth key: the UUID printed when you generated the shell.

Type commands into the terminal pane and press enter. Commands are base64-encoded, sent to the shell, and the response is decoded and displayed inline.

Sliver mode

If you prefer running commands through an established C2 channel, toggle into Sliver mode. You will need to have connected to a Sliver teamserver first and picked an active session or beacon. See Sliver-C2 for the connection flow.

In Sliver mode, commands are dispatched through the Sliver RPC interface. Output is streamed back into the same terminal pane. File downloads, screenshots, and process dumps can be retrieved and are cached server-side briefly for you to fetch.

Mythic mode

Switch into Mythic mode to drive callbacks on a Mythic server. Connect with a server URL and either an API token or a username and password, list callbacks, and select one to work.

A handful of commands are handled by Joro — listing callbacks, selecting one, listing tasks, uploading and downloading files. Everything else you type is issued as a task to the selected callback, so the available command set is whatever that agent supports. See Mythic-C2 for the connection flow and the full command list.

Plugin exec providers

The Execute tab is extensible. A plugin of type exec_provider can register itself as an additional backend and appear in the backend picker alongside web shell and Sliver. Each provider defines its own connect/disconnect flow and command dispatch, with a UI form auto-generated from the provider's config schema.

Install plugins and manage their lifecycle from Settings → Plugins (see Plugins). Once an exec provider plugin is loaded, picking it here shows its configuration form (any fields the plugin declares), a connect button, and the same terminal pane used for the built-in backends.

Switching backends

You can switch between backends at any time. Settings for each are remembered independently, so you can leave a web shell session configured while you work on a Sliver implant, a Mythic callback, or a plugin-provided backend, and come back to it later.