Skip to content

API: Commands

This section covers command templates and how to send commands to agents via the API.

List Command Plugins

Retrieve a list of available command plugins:

1
2
GET /api/v1/plugins/commands HTTP/1.1
Authorization: Bearer {JWT_TOKEN}

List Command Templates

Get a list of command templates:

1
2
GET /api/v1/command-templates HTTP/1.1
Authorization: Bearer {JWT_TOKEN}

Command Template Details

Fetch details for a specific command template:

1
2
GET /api/v1/command-templates/{COMMAND_TEMPLATE_ID} HTTP/1.1
Authorization: Bearer {JWT_TOKEN}

Send a Command to an Agent

Issue a command by specifying the template and configuration. Optionally, include extra execution configuration with "execConf".

Request:

1
2
3
4
5
6
7
8
9
POST /api/v1/agents/{AGENT_GUID}/commands HTTP/1.1
Authorization: Bearer {JWT_TOKEN}
Content-Type: application/json

{
  "template": "{COMMAND_TEMPLATE_ID}",
  "configuration": {COMMAND_CONFIGURATION},
  "execConf": {EXECUTION_CONFIGURATION}  // Optional
}

Examples

Example 1 – Basic Command

Run a simple command, such as "whoami", using the "cmd" template:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
POST /api/v1/agents/{AGENT_GUID}/commands HTTP/1.1
Authorization: Bearer {JWT_TOKEN}
Content-Type: application/json

{
  "template": "cmd",
  "configuration": {
    "command": "whoami"
  }
}

Example 2 – Spawning a New Process

Spawn a new process with the "spawn" template.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
POST /api/v1/agents/{AGENT_GUID}/commands HTTP/1.1
Authorization: Bearer {JWT_TOKEN}
Content-Type: application/json

{
  "template": "spawn",
  "configuration": {
    "payloadId": "{PAYLOAD_ID}", // must be of type SHELLCODE
    "encryptedCommunication": true
  },
  "execConf": {
    "execType": "NEW",
    "executable": "C:\\Windows\\System32\\notepad.exe",
    "suspended": false
    "username": "tuoni",
    "password": "PassW$ord"
  }
}

Retrieve Agent Commands

Get all commands sent to a specific agent:

1
2
GET /api/v1/agents/{AGENT_GUID}/commands HTTP/1.1
Authorization: Bearer {JWT_TOKEN}

Retrieve All Commands

List all commands issued across agents:

1
2
GET /api/v1/commands HTTP/1.1
Authorization: Bearer {JWT_TOKEN}

Get Command Result

Fetch the result for a specific command:

1
2
GET /api/v1/commands/{COMMAND_ID} HTTP/1.1
Authorization: Bearer {JWT_TOKEN}