AxFunction

Data Model

agents

Get information about all agents calling back to this Adaptix teamserver.

AGENT[id] ax.agents();

// AGENT STRUCT
string agent["id"]
string agent["type"]
string agent["listener"]
string agent["external_ip"]
string agent["internal_ip"]
string agent["domain"]
string agent["computer"]
string agent["username"]
string agent["impersonated"]
string agent["process"]
string agent["arch"]
int    agent["pid"]
int    agent["tid"]
int    agent["gmt"]
bool   agent["elevated"]
string agent["tags"]
bool   agent["async"]
int    agent["sleep"]
string agent["os_full"]

Example

var agents = ax.agents(); 

for (var id in agents) {
    ax.log("Agent ID: " + id);
    var agent = agents[id];
    for (var key in agent) {
        ax.log("  " + key + ": " + agent[key]);
    }
}

credentials

Returns a list of credentials.

CRED[id] ax.credentials()

// CRED STRUCT
cred["id"]
cred["username"]
cred["password"]
cred["realm"]
cred["type"]
cred["tag"]
cred["date"]
cred["storage"]
cred["agent_id"]
cred["host"]

Example

var creds = ax.credentials(); 

for (var id in creds) {
    ax.log("Cred ID: " + id);
    var cred = creds[id];
    for (var key in cred) {
        ax.log("  " + key + ": " + cred[key]);
    }
}

Functions

The following is a list of AxScript's functions:

agents

See here

agent_info

Get information from a agent session's metadata.

any ax.agent_info(string id, string property)

id - agent ID
property - CRED property (see here)

Example

ax.agent_info("47ca27cf", "username");
ax.agent_info("47ca27cf", "pid");

agent_set_color

Set color for agent's item in Session Table

void ax.agent_set_color(string[] ids, string background, string foreground, bool reset);

ids - array of agent ids
background - item background color in hex RGB
foreground - item text color in hex RGB
reser - if true, reset the color to default

Example

ax.agent_set_color(["47ca27cf"], "008000", "000000", false);

agent_set_impersonate

Set impersonate for agent's item in Session Table

void ax.agent_set_impersonate(string id, string impersonate, bool elevated);

id - agent ID
impersonate - impersonated user
elevated - is impersonated user elevated

Example

ax.agent_set_impersonate("47ca27cf", "SYSTEM", true);

agent_set_mark

Set mark for agent's item in Session Table

void ax.agent_set_mark(string id, string mark);

id - agent ID
mark - agent's mark ("Terminated", "Inactive", "Disconnect", empty "" for active).

Example

ax.agent_set_mark("47ca27cf", "Inactive");

agent_set_tag

Set tag for agent's item in Session Table

void ax.agent_set_tag(string id, string tag);

id - agent ID
tag - agent's tag

Example

ax.agent_set_tag("47ca27cf", "long");

arch

Returns the architecture of agent session (e.g., x86 or x64)

string ax.arch(string id);

id - agent ID

Example

ax.arch("47ca27cf");

bof_pack

Pack arguments in a way that's suitable for BOF APIs to unpack. To transmit binary data to the server, the function will encode it in base64.

string ax.bof_pack(string types, any[] args);

types - a set of comma separated string types for BOF's arguments
args - array of BOF's arguments

Type

Description

Unpack With (C)

bytes

binary data

BeaconDataExtract

int

4-byte integer

BeaconDataInt

short

2-byte short integer

BeaconDataShort

cstr

zero-terminated+encoded string

BeaconDataExtract

wstr

zero-terminated wide-char string

(wchar_t *)BeaconDataExtract

Example

ax.bof_pack("bytes,int,short,cstr,wstr", ["bytes_str", 123, 12, "c_string", "w_string"]);

copy_to_clipboard

Copy text to client's clipboard.

void ax.copy_to_clipboard(string text);

Example

ax.copy_to_clipboard("stored data");

console_message

Print an output message and text to the agent console.

void ax.console_message(string id, string message, string type = "", string text = "");

id - agent ID
message - brief message
type - message type ("info", "success", or "error")
text - text output

Example

ax.console_message("47ca27cf", "Info message\n", "info", "This is\nmulti line\ntext");
ax.console_message("47ca27cf", "Error message\n", "error");

credentials

See here

credentials_add

Save the specified credentials in Credentials Manager

void ax.credentials_add(string username, string password, string realm = "", string type = "password", string tag = "", string storage = "manual", string host = "");

username - creds username
password - creds secret
realm - creds domain/realm
type - creds type (possible "password", "hash", "rc4", "aes128", "aes256", "token")
tag - creds tag
storage - creds container (possible "browser", "dpapi", "database", "sam", "lsass", "ntds", "manual")
host - the host where the credentials were stored

Example

ax.credentials_add("user", "P@ssw0rd", "dom.local", "password", "", "dpapi", `SERVER12`);

file_basename

Returns the filename

string ax.file_basename(string path);

path - full filename

Example

ax.file_basename("/tmp/test.txt");

file_exists

Checks if a file exists

bool ax.file_exists(string path);

path - full filename

Example

ax.file_exists("/tmp/test.txt");

file_read

Reads a file and returns base64 encoded contents

string ax.file_read(string path);

path - full filename

Example

ax.file_read("/tmp/test.txt");

format_time

Convert UNIX Epoch Time to date/time string value.

string ax.format_time(string format, int unixtime);

format - datetime format (e.g. "dd/MM/yyyy hh:mm:ss")
unixtime - UNIX Epoch Time value

Example

ax.format_time("dd/MM hh:mm", ax.ticks());

interfaces

Returns a list of network interfaces of the teamserver

string[] ax.interfaces()

Example

ax.interfaces()

is64

Check if a session is on an x64 system or not

bool ax.is64(string id);

id - agent ID

Example

ax.is64("47ca27cf");

isadmin

Check if a session has admin rights

bool ax.isadmin(string id);

id - agent ID

Example

ax.isadmin("47ca27cf");

log / log_error

Print text to AxScript Console.

void ax.log(string text);
void ax.log_error(string text);

Example

ax.log("log");
ax.log_error("log");

open_agent_console

Open the console to interact with a agent

void ax.open_agent_console(string id);

id - agent ID

open_access_tunnel

Open the tunnel creation dialog window

void ax.open_access_tunnel(string id, bool socks4, bool socks5, bool lportfwd, bool rportfwd);

id - agent ID
socks4 - is agent support socks4
socks5 - is agent support socks5
lportfwd - is agent support local port forwarding
rportfwd - is agent support reverse port forwarding

Example

ax.open_access_tunnel("47ca27cf", true, true, false, false);

open_browser_files

Open the File Browser for a agent

void ax.open_browser_files(string id);

id - agent ID

open_browser_process

Open the Process Browser for a agent

void ax.open_browser_process(string id);

id - agent ID

open_remote_terminal

Open the Interactive Terminal for a agent

void ax.open_remote_terminal(string id);

id - agent ID

prompt_open_file

Show a file open dialog.

string prompt_open_file(string caption = "Select file", string filter = "");

caption - title of the dialog
filter - filter for selecting files

Example

ax.prompt_open_file("Select AxScript", "AxScript Files (*.axs)");

prompt_open_dir

Show a directory open dialog.

string prompt_open_dir(string caption = "Select directory");

caption - title of the dialog

Example

ax.prompt_open_dir("Open directory");

prompt_save_file

Show a file save dialog.

string prompt_save_file(string filename, string caption = "Select file", string filter = "");

filename - default filename
caption - title of the dialog
filter - filter for selecting files

Example

ax.prompt_save_file("/tmp/creds.txt", "Save file");

register_commands_group

See here

script_import

Import AxScript script into current script's env.

string script_import(string path);

path - path to script file

script_load

Load a new script to AxScript Manager

string script_load(string path);

path - path to script file

script_unload

Unload a script from the AxScript Manager

string script_unload(string path);

path - path to script file

script_dir

Returns the directory where the script is located.

string script_dir();

show_message

Shows a message to the user in a dialog box. Use this function to relay information.

void show_message(string title, string text);

title - title of the dialog
text - the message text

Example

ax.show_message("Info", "This is text");

ticks

UNIX Epoch Time value

int ticks();

PreviousIntroduction NextAxCommand type

Last updated 5 days ago

Data Model

agents

credentials

Functions

agents

agent_info

agent_set_color

agent_set_impersonate

agent_set_mark

agent_set_tag

arch

bof_pack

copy_to_clipboard

console_message

credentials

credentials_add

create_command

create_commands_group

execute_alias

execute_browser

execute_command

file_basename

file_exists

file_read

format_time

interfaces

is64

isadmin

log / log_error

open_agent_console

open_access_tunnel

open_browser_files

open_browser_process

open_remote_terminal

prompt_open_file

prompt_open_dir

prompt_save_file

register_commands_group

script_import

script_load

script_unload

script_dir

show_message

ticks