TS API
ID generators
Six wrappers around the built-in idgen.Generator. They return the next free value for the corresponding entity; counters are restored from the DB on server start (MAX(id) + 1). Plugins that create an entity on the server side must take the ID via these helpers so it does not collide with existing DB records.
TsAgentGenID() int64 // entity "agent", table Agents.Id
TsTaskGenID() int64 // entity "task", table Tasks.TaskId
TsCredGenID() int64 // entity "cred", table Credentials.CredId
TsScreenGenID() int64 // entity "screen", table Screenshots.ScreenId
TsTargetGenID() int64 // entity "target", table Targets.TargetId
TsFileGenID() int64 // entity "file", table Downloads.FileIdAgent Functions
TsAgentIsExists
Checks if an agent exists by ID.
TsAgentIsExists(agentId int64) boolReturns: bool — true if agent exists
TsAgentGetById
Reads one in-memory session. The second result is false when the id is unknown or the agent was removed.
TsAgentIdByUID
Linear search for an agent by UID (optional identifier filled by the listener/agent plugin, not overlapping with agentId).
Returns: the found agentId and true; (0, false) if no agent has this UID or uid is empty.
TsAgentList
JSON array of every in-memory session (AgentData as stored, including the session key). An empty server marshals as null, not [].
TsAgentCatalog
JSON array of registered agent types, sorted by name. Each item is {name, listeners, axs}. axs is the agent AxScript and is omitted when empty.
TsAgentCreate
Creates a new agent on first connection.
agentCrc
string
CRC/watermark of the agent type
agentUid
[]byte
Unique agent UID (agentId is generated server-side)
beat
[]byte
Initial data from agent (heartbeat)
listenerName
string
Listener name
ExternalIP
string
Agent's external IP
Async
bool
Asynchronous mode
Returns: adaptix.AgentData, error
Events:
agent.new(Pre/Post hooks)
TsAgentProcessData
Processes data received from an agent.
agentId
int64
Agent ID
bodyData
[]byte
Data from agent
Events: agent.activate (post only), and only when Mark was "Inactive". The mark is cleared, the row is saved, then the post hook runs.
TsAgentUpdateData
Updates agent data (sleep, jitter, killdate, workingtime).
TsAgentUpdateDataPartial
Partial update of agent data. updateData is any struct/map that JSON-marshals to an object with keys from the table below; only present fields are applied.
Supported fields (JSON key → AgentData field):
internal_ip
InternalIP
string
external_ip
ExternalIP
string
gmt_offset
GmtOffset
int
acp
ACP
int
oemcp
OemCP
int
pid
Pid
string
tid
Tid
string
arch
Arch
string
elevated
Elevated
bool
process
Process
string
os
Os
int
os_desc
OsDesc
string
domain
Domain
string
computer
Computer
string
username
Username
string
impersonated
Impersonated
string
tags
Tags
string
mark
Mark
string
color
Color
string ("bg-fg" hex, RGB-validated)
listener
Listener
string
a_session_key
SessionKey
string (stored as []byte; not emitted in TYPE_AGENT_UPDATE)
custom_data
CustomData
string (stored as []byte; not emitted in TYPE_AGENT_UPDATE)
sleep
Sleep
uint
jitter
Jitter
uint
working_time
WorkingTime
int (packed: (startH<<24)|(startM<<16)|(endH<<8)|endM)
kill_date
KillDate
int (unix seconds)
Notes:
Changing
Markis silently ignored if the current mark is already"Terminated"(terminal state).Setting
Mark = "Disconnect"also updatesLastTickto the current time.Coloraccepts"<bg>-<fg>"hex ("#1e3050-#ffffff"); each half is checked as a valid RGB, and an empty half keeps the previous value.Empty
updateData(no recognized fields) is a no-op: the function returnsnil, nothing is written to the DB, no sync packet is sent.Fields not listed are ignored.
Crc,Id,UID,Name,CreateTime,Async, andTargetIdcannot be modified through this API.LastTickchanges only as a side effect ofMark = "Disconnect", or throughTsAgentSetTick.Activeis a runtime flag on theAgentstruct, not part ofAgentData.
Typical call from a plugin (for example inside OnDispatch for sleep):
TsAgentTerminate
Terminates an agent.
Actions performed:
Cancels all active downloads
Stops all tunnels
Closes terminals
Clears task queues
Removes pivot links
Events:
agent.terminate(Pre/Post hooks)
TsAgentSetTick
Updates the agent's last response time.
TsAgentConsoleOutput
Outputs a message to the agent console.
agentId
int64
Agent ID
client
string
Initiator operator name (used for filtering in non-team mode)
messageType
int
Message type (5=INFO, 6=ERROR, 7=SUCCESS)
message
string
Message header
clearText
string
Message text
store
bool
Save to the DB
TsAgentBuildExecute
Runs an external command during agent build, redirecting output to the build WebSocket channel.
builderId
string
Builder ID (empty string for synchronous execution)
workingDir
string
Working directory for the command
program
string
Executable
args
...string
Command-line arguments
Note: If builderId is empty, the command runs synchronously without output to the WebSocket. Otherwise stdout/stderr are redirected to the build channel.
TsAgentBuildLog
Sends a log message to the agent's WebSocket build channel.
builderId
string
Builder ID
status
int
Status: BUILD_LOG_NONE=0, INFO=1, ERROR=2, SUCCESS=3
message
string
Message text
TsAgentEncryptData / TsAgentDecryptData
Session-key encrypt and decrypt. Both return an error if the agent has been removed.
TsSetAgentDeliveryFunc / TsRemoveAgentDeliveryFunc / TsGetAgentDeliveryFunc
Per-agent push callback. TsTaskCreate calls it in a goroutine so a listener can deliver a task without waiting for the next poll. DeliveryFunc is func(agentId int64, taskData TaskData) error.
TsAgentGetHosted* Functions
Retrieve tasks for sending to an agent. All functions pack tasks while respecting a size limit. They do not write to the agent console — dequeue is not a send. The task queue (HostedQueue) is a safe.PriorityQueue with FIFO inside each priority level; Pop() returns the highest-priority item first.
StatTasks is counted after OnDispatch. Each known task type has its own {Count, Bytes} (Task, Job, Browser, Tunnel, Proxy, Local, Other). Helpers: stats.Commands() (TASK+JOB), stats.Total(), stats.Of(taskType), stat.SizeString().
TsAgentGetHostedAll
Gets all available tasks: regular tasks, tunnel tasks, tunnel data, and pivot tasks.
agentId
int64
Agent ID
maxDataSize
int
Maximum data size (bytes)
Returns: Packed bytes, operator-visible note, error.
A nested TsAgentGetHostedAll for a child should not write a console line for that child.
TsAgentGetHostedTasks
Gets hosted tasks without pivot. maxCount <= 0 means unlimited.
agentId
int64
Agent ID
maxCount
int
Max tasks, or <= 0 for unlimited
maxDataSize
int
Max data size in bytes
The teamserver does not write a console line. After a successful send the listener formats its own text from StatTasks and the bytes it actually wrote (FormatByteSize(len(wire))). stats.Packed is size after PackTasks, before listener wrapping.
Framed transports: the listener prints with adaptix.NoteFrameSent / NoteFrameRecv after TsFrameGetChunk or TsFrameGetChunkSticky, or after a completed TsFramePut, TsFramePutDecoded, or TsFramePutStream. TsFrameTakeStatTasks and TsFrameTakeStatRecv fire once per blob.
TsAgentBuildEmptyTasks
Packs an empty task blob with the agent session key.
Task Functions
TsTaskRunningExists
Checks if a task is running.
TsTaskCreate
Creates a new task.
A task created with taskData.Completed = true (a command that finished on the server) does not enter the HostedQueue. It is finalized immediately: task.complete post hook and a sync broadcast.
Events:
task.create(Pre/Post hooks)
TsTaskUpdate
Updates the task with execution results.
Events:
task.complete(post only) when this update finalizes the task (Completedon a synced task or job). An update that only parks the task for a client hook does not emit it. Cancel goes throughTsTaskCanceland does not emittask.complete.task.update_job(post only) on every update of aTASK_TYPE_JOBtask, before that job is finalized.task.startis declared and is not emitted.
TsTaskCancel
Cancels a task — both one still queued and one already dispatched to the agent.
agentId
int64
Agent ID
taskId
int64
Task ID
Task still in
agent.HostedQueue(not yet taken byTsTaskGetAvailableAllorTsTaskGetAvailableTasks) — removed from the queue and finalized as canceled:Completed=true,MessageType=MESSAGE_ERROR,Message="Task canceled",FinishDate=now;OnCompleteruns. Sync tasks are updated in the DB and broadcast as a task update; others are removed from the client.Task already dispatched (in
agent.RunningTasks) is cancelable too: removed fromRunningTasks,TsFrameResetDownstreamdrops the rest of that downstream session, server AxScript hooks for that task are unregistered, then the same finalization.
Frame Manager Functions
Frame Manager is shared infrastructure for protocol-independent fragmentation/reassembly of large messages between server and agent. It extracts the duplicated logic from listener plugins. It supports three upstream-assembly modes, auto-detected from the first call to the corresponding method:
Byte-offset mode (
TsFramePutwithtotalSize > 0,chunkCount == 0): the caller knows the total size in bytes and addresses by byte offset.Chunk-index mode (
TsFramePutwithchunkCount > 0): the caller knows the chunk count and addresses by chunk index.Stream mode (
TsFramePutStream): the total size is unknown up front; chunks arrive with an incrementingseqNum, and theisLastflag signals completion.
Encoding/decoding (compression, frame headers) is performed by the plugin. The plugin passes an encode callback to TsFrameGetChunk and decodes the data returned by TsFramePut/TsFramePutStream itself.
TsFrameHasPending
Returns true if the agent has outgoing data in its downstream session, tasks in HostedQueue, pivot tasks for child agents, or orphaned TASK/BROWSER tasks in RunningTasks (see the requeue above).
TsFramePut
Accepts an upstream fragment from the listener and places it into the reassembly buffer. When assembly is complete, returns the assembled raw block (the plugin decodes/decompresses it and calls TsAgentProcessData).
sessionId
string
Session ID (usually agentId)
index
uint32
Byte offset or chunk index (depends on the mode)
data
[]byte
Fragment contents
totalSize
uint32
Full message size (byte-offset mode); 0 for chunk-index mode
chunkCount
uint16
Number of chunks (chunk-index mode); 0 for byte-offset mode
Returns: complete — fully assembled; nextExpected — next expected offset/index; received — how much has been received; sackBitmap — SACK bitmap of acknowledged chunks; assembled — the fully assembled blob (only when complete=true).
TsFramePutStream
Accepts an upstream chunk in stream mode. Chunks arrive with an increasing seqNum; out-of-order arrivals are buffered. When a chunk with isLast = true arrives and all preceding seqNums have been collected — the function returns the assembled raw block.
sessionId
int64
Session ID (usually agentId)
seqNum
uint32
Chunk sequence number (starting at 0)
data
[]byte
Chunk contents
isLast
bool
true — this chunk is the last
Returns: complete — the stream is fully assembled; assembled — the assembled data (only when complete=true). Duplicate seqNums are ignored; a repeated TsFramePutStream for an already-finished session returns (true, nil).
TsFramePutDecoded
A TsFramePut variant (byte-offset mode): after the reassembly completes, the decode callback is applied to the assembled block. If decoding returns an error — assembled = nil (the listener can drop the session instead of dispatching garbage).
Returns: the same values as TsFramePut (complete, nextExpected, received, sackBitmap, assembled), but assembled is the result of decode(assembled).
TsFrameGetChunk
Returns the next downstream chunk for an agent. Creates a downstream session on the first call (including pulling tasks from HostedQueue, packing and encrypting by the agent, applying encode).
sessionId
string
Session ID
reqOffset
uint32
Requested offset
maxChunkSize
int
Max bytes in a chunk (transport-dependent, e.g., 160 for DNS UDP)
encode
func([]byte) []byte
Optional callback to prepare the full payload (compression + frame); nil — no transformation
Returns: total — total payload size, offset — actual chunk offset, data — chunk contents, taskNonce — session nonce (for subsequent ACK), isEmpty — no data to send.
TsFrameGetChunkSticky
The downstream session is marked sticky: when maxAttempts is exceeded it is not evicted — the attempt counter resets instead, and the session is released only by the idle timeout or via TsFrameAckDelivery. The attempt counter is incremented only on repeated requests for the same offset — requesting a new offset resets it.
TsFrameAckDelivery
Acknowledges to the agent that the entire downstream message has been delivered. Releases the downstream session.
TsFrameTakeStatTasks / TsFrameTakeStatRecv
Atomically take the statistics accumulated by the Frame Manager for a session. Framed transports print "N bytes sent" after TsFrameGetChunk or TsFrameGetChunkSticky, or after a completed TsFramePut, TsFramePutDecoded, or TsFramePutStream.
TsFrameResetUpstream / TsFrameResetDownstream
Reset an unfinished upstream or downstream session (e.g., when desync is detected or an agent is explicitly reloaded).
Used on task/upload cancellation: resetting the downstream session prevents the agent from receiving the canceled task's tail on its next poll.
Client GUI Functions
Functions for synchronizing data with GUI clients (File Browser, Process Manager). These functions send results only to the client that initiated the request.
TsClientGuiDisksWindows
Sends the list of Windows drives to the client.
taskData
adaptix.TaskData
Task data
drives
[]adaptix.ListingDrivesDataWin
Drive list
TsClientGuiFilesWindows
Sends the list of Windows files to the client.
taskData
adaptix.TaskData
Task data
path
string
Directory path
files
[]adaptix.ListingFileDataWin
File list
TsClientGuiFilesUnix
Sends the list of Unix/Linux files to the client.
taskData
adaptix.TaskData
Task data
path
string
Directory path
files
[]adaptix.ListingFileDataUnix
File list
TsClientGuiFilesStatus
Sends the file operation status (delete, rename, etc.) to the client.
taskData
adaptix.TaskData
Task data with MessageType and Message for status
TsClientGuiProcessWindows
Sends the list of Windows processes to the client.
taskData
adaptix.TaskData
Task data
process
[]adaptix.ListingProcessDataWin
Process list
TsClientGuiProcessUnix
Sends the list of Unix/Linux processes to the client.
taskData
adaptix.TaskData
Task data
process
[]adaptix.ListingProcessDataUnix
Process list
Credentials Functions
TsCredentilsAdd
Adds credentials.
Credential structure:
Events:
credentials.add(Pre/Post hooks)
TsCredentilsEdit
Events:
credentials.edit(Pre/Post hooks)
TsCredentialsSetTag
TsCredentilsDelete
Events:
credentials.remove(Pre/Post hooks)
Download/Upload Functions
TsDownloadAdd
Initializes a file download. fileId comes from TsFileGenID.
Events:
download.start(Pre/Post hooks)
TsDownloadUpdate
Updates download state.
1
RUNNING
Download in progress
2
STOPPED
Paused
3
FINISHED
Completed
4
CANCELED
Cancelled
TsDownloadClose
Finishes a download.
Events:
download.finish(Pre/Post hooks)
TsDownloadSave
Saves a file directly (from memory).
TsDownloadGet
One transfer record. The in-memory map is checked first; otherwise the DB row is returned. Unknown id is "File not found: <id>". No event.
TsDownloadGetFilepath
Returns the local path to the downloaded file.
Returns: Full path to the file on the server.
Note: Works only for completed downloads (state=FINISHED).
TsDownloadDelete
Deletes downloaded files.
Events:
download.remove(Pre/Post hooks)
TsDownloadSetTag
Update of a tag on a group of downloads.
fileIds
[]int64
Array of download FileIds
tag
string
New tag; empty string clears it
TsUploadAdd / TsUploadAddContent
Initialize an upload of a file to an agent. TsUploadAdd reads the file from disk (localPath). TsUploadAddContent takes bytes in memory and optional memory-artifact fields. fileId comes from TsFileGenID.
canceled
bool
false → TsUploadClose(CANCELED) rejects with an error; the UI Cancel button is disabled. For artifacts without an agent-side break command. Regular file uploads — true.
kind
int
TRANSFER_KIND_FILE = 0 (regular file) or TRANSFER_KIND_MEMORY = 1 (BOF / shellcode / .NET)
artname
string
Operator-friendly label for Kind=MEMORY (BOF / shellcode name). For FILE — empty string.
arttype
string
Category for Kind=MEMORY ("bof" / "shellcode" / "dotnet"). For FILE — empty string.
Events: upload.start (Pre/Post hooks).
TsUploadGetChunk
Returns the next chunk of the upload file. Used by the agent plugin when preparing a portion of data to send to the agent.
fileId
int64
Upload session ID
chunkSize
int
Desired chunk size (bytes)
needApprove
bool
true — Progress is incremented only after TsUploadApprove; false — immediately
Returns: a slice of the read bytes; nil with no error means the file has already been fully sent.
TsUploadApprove
Acknowledges delivery of the next chunk of upload data to the agent. Used when needApprove = true, where the agent explicitly confirms receipt of a chunk before Progress is incremented.
TsUploadClose
Closes the upload session (reason — TRANSFER_STATE_FINISHED or TRANSFER_STATE_CANCELED).
If reason == TRANSFER_STATE_CANCELED and the upload has Cancellable == false (memory artifact without an agent-side break) — returns upload %d is not cancellable. TsAgentRemove and TsUploadDelete still close that upload. After a successful close, state and progress are saved.
Events: upload.finish (Pre/Post hooks).
TsUploadGet
Returns the current snapshot of an upload session. The in-memory map is checked first; otherwise the stored row is returned (finished or canceled). Same shape as TsDownloadGet.
TsUploadDelete
Cancel and remove uploads. Active records are closed as canceled even when Cancellable is false, then the ids are deleted. Clients receive a transfer-delete for each upload. Backs POST /upload/delete.
Listener Functions
TsListenerGet
Returns the data of a running listener.
Parameters:
listenerName— listener instance name.
Returns: the ListenerData and an existence flag (false — listener not found; an empty name returns false immediately).
TsListenerGetProfile
Gets a profile for agent generation.
Returns: watermark, profile bytes, error
TsListenerInteralHandler
Handles internal requests (pivot agents).
Returns: child agent id (int64) and an error.
TsListenerList / TsListenerCatalog
Running listeners, and the listener types registered by extenders.
Pivot Functions
TsPivotCreate
Creates a pivot connection.
Events:
pivot.create(Pre/Post hooks)
TsPivotDelete
Events:
pivot.remove(Pre/Post hooks)
TsGetPivotInfoByName / TsGetPivotInfoById
Screenshot Functions
TsScreenshotAdd
Adds a screenshot.
Events:
screenshot.add(Pre/Post hooks)
TsScreenshotNote
Updates the note for a screenshot.
TsScreenshotDelete
Deletes a screenshot.
Actions:
Deletes the file from disk
Removes the record from the DB
Synchronizes with clients
Events:
screenshot.remove(Pre/Post hooks)
Target Functions
TsTargetsAdd
Adds new targets (hosts). Duplicates are automatically ignored.
Target structure:
Events:
target.add(Pre/Post hooks)
TsTargetsEdit
Edits an existing target.
targetId
int64
Target ID
computer
string
Computer name
domain
string
Domain
address
string
IP address
os
int
OS type (1/2/3)
osDesk
string
OS description
tag
string
Tag
info
string
Additional info
alive
bool
Is alive
Events:
target.edit(Pre/Post hooks)
TsTargetSetTag
Sets a tag for a group of targets.
TsTargetDelete
Deletes targets.
Events:
target.remove(Pre/Post hooks)
Tunnel Functions
TsTunnelStart
Starts the created tunnel.
Returns: TaskId for tracking
Events:
tunnel.start(Pre/Post hooks)
TsTunnelCreate* Functions
Functions for creating tunnels of different types. Return TunnelId.
TsTunnelCreateSocks4
Creates a SOCKS4 proxy.
AgentId
int64
Agent ID
Info
string
Tunnel description
Lhost
string
Bind address
Lport
int
Bind port
TsTunnelCreateSocks5
Creates a SOCKS5 proxy with optional authentication.
AgentId
int64
Agent ID
Info
string
Tunnel description
Lhost
string
Bind address
Lport
int
Bind port
UseAuth
bool
Use authentication
Username
string
Username (if UseAuth)
Password
string
Password (if UseAuth)
TsTunnelCreateLportfwd
Creates a local port forward.
AgentId
int64
Agent ID
Info
string
Tunnel description
Lhost
string
Local address
Lport
int
Local port
Thost
string
Target address (on agent)
Tport
int
Target port
TsTunnelCreateRportfwd
Creates a reverse port forward.
AgentId
int64
Agent ID
Info
string
Tunnel description
Lport
int
Port on agent
Thost
string
Target address (on server)
Tport
int
Target port
TsTunnelUpdateRportfwd
Updates reverse port forward status after the agent response.
tunnelId
int
Tunnel ID (numeric)
result
bool
Whether the tunnel was created on the agent
Returns: TaskId, message, error
TsTunnelStop* Functions
Functions for stopping tunnels.
TsTunnelStop
Stops a tunnel by ID.
Events:
tunnel.stop(Pre/Post hooks)
TsTunnelStopSocks
Stops a SOCKS proxy by agent and port.
TsTunnelStopLportfwd
Stops a local port forward.
TsTunnelStopRportfwd
Stops a reverse port forward. Sends a close command to the agent.
TsTunnelChannelExists
Checks whether the tunnel channel exists.
TsTunnelGetPipe
Gets pipes for reading/writing tunnel data.
Returns: PipeReader for reading data from the server, PipeWriter for writing data to the tunnel.
TsTunnelConnection* Functions
Functions for managing tunnel connections.
TsTunnelConnectionData
Sends data to the tunnel channel.
TsTunnelConnectionResume
Resumes the connection after a successful connection on the agent side.
AgentId
int64
Agent ID
channelId
int64
Channel ID
ioDirect
bool
true = direct transfer without buffering
TsTunnelConnectionClose
Closes the channel connection.
channelId
int64
ChannelId ID
writeOnly
bool
To ensure sufficient time for reading and sending data over a socket. Used in async payloads such as HTTP.
TsTunnelConnectionHalt
Closes the connection with a SOCKS error.
channelId
int64
Channel ID
errorCode
byte
SOCKS5 error code (1-8)
TsTunnelConnectionAccept
Accepts an incoming connection for reverse port forward.
TsTunnelConnectionBindReply
Reports a SOCKS5 BIND channel phase change to the server (the agent's response to TunnelCallbacks.BindTCP).
channelId
int64
Channel ID
phase
int
TUNNEL_BIND_LISTENING (2) or TUNNEL_BIND_ACCEPTED (3)
atyp
int
address type: ADDRESS_TYPE_IPV4 (1) / DOMAIN (3) / IPV6 (4)
addr
[]byte
bind address (4 / 16 bytes, or domain)
port
int
actual port bound on the agent
TsTunnelPause
Pause tunnels connection to client
TsTunnelResume
Recume tunnels connection to client
Terminal Functions
Functions for managing interactive terminal sessions via the agent.
TsAgentTerminalCloseChannel
Closes the terminal channel and notifies the client.
terminalId
int64
Terminal session ID
status
string
Close status/reason
TsTerminalConnExists
Checks whether a terminal connection exists.
terminalId
int64
Terminal session ID
Returns: true if the session exists
TsTerminalConnResume
Resumes the terminal connection after a successful start on the agent.
agentId
int64
Agent ID
terminalId
int64
Terminal session ID
ioDirect
bool
true = direct transfer without buffering
TsTerminalConnData
Sends data to the terminal session (output from the agent).
terminalId
int64
Terminal session ID
data
[]byte
Data to send
TsTerminalConnClose
Closes the terminal session.
terminalId
int64
Terminal session ID
reason
string
Close reason
TsTerminalGetPipe
Gets pipes for terminal input/output.
Returns: PipeReader for reading input from the client, PipeWriter for writing agent output.
Service Functions
TsPluginServiceSendDataAll
Sends data to all clients on behalf of the service.
TsPluginServiceSendDataClient
Sends data to a specific client on behalf of the service.
AxScript Server Functions
Server-side AxScript engine functions. Allow loading and executing scripts on the server side, defining commands and hooks without client participation.
TsAxScriptLoadUser
Loads a user AxScript on the server.
name
string
Script name
script
string
Script content
TsAxScriptUnloadUser
Unloads a user AxScript from the server.
TsAxScriptList
Returns a JSON list of loaded scripts.
TsAxScriptCommands
Returns a JSON list of registered server-side commands.
TsAxScriptResolveHooks
Resolves server-side hooks for an agent command. Used when processing commands where the client did not provide a hook/handler.
agentName
string
Agent type name
agentId
int64
Agent ID
listenerRegName
string
Registered listener name
os
int
Agent OS type
cmdline
string
Command line
args
map[string]interface{}
Command arguments
client
string
Operator client name
Returns: hookId, handlerId, preHookHandled (true if Pre hook fully handled the command), error
TsAxScriptParseAndExecute
Parses and executes a raw command via the server-side AxScript engine.
agentId
int64
Agent ID
username
string
Operator name
cmdline
string
Command line
TsAxScriptIsServerHook
True when id is a hook registered by a teamserver script rather than a client script.
Event Hook Functions
Generic event-hook registration. Unlike the narrow TsEventHookOnPost / TsEventHookOnPre wrappers, these methods take explicit phase and priority — multiple hooks on one event are ordered by priority.
TsEventHookRegister
Registers an event hook with an explicit phase and priority.
Parameters:
eventType
string
Event type (e.g. "task.create", "agent.new", "upload.finish")
name
string
Hook name (used for bulk unregister via TsEventHookUnregisterByName).
phase
int
0 — synchronous, before the action; 1 — asynchronous, after the action.
priority
int
Priority within the phase. Calls run in priority order
handler
func(event any) error
Handler function; receives the event as any (type-asserted by the plugin).
Returns: the hook ID (string).
TsEventHookOnPre / TsEventHookOnPost
Registers a pre or post hook at the default priority and returns the hook id. Neither call emits an event.
TsEventHookUnregister
Unregisters one hook by the id returned from TsEventHookRegister.
Returns true when a hook with that id was removed.
TsEventHookUnregisterByName
Unregisters all hooks registered under the given name.
Returns: the number of hooks removed (0 if none found).
TsEventHookSetEnabled
Enables/disables a registered hook without unregistering it.
Extender Data Functions
Functions for storing extender data in the database.
TsExtenderDataSave
Saves extender data to the database.
TsExtenderDataLoad
Loads extender data from the database.
TsExtenderDataDelete
Deletes data by key from the database.
TsExtenderDataKeys
Returns a list of saved extender keys.
TsExtenderDataDeleteAll
Deletes all extender data from the database.
Endpoint Functions
Functions for registering HTTP endpoints.
TsEndpointRegister
Registers a protected endpoint (uses the teamserver's shared JWT authentication).
method
string
HTTP method (GET, POST...)
path
string
Endpoint path
handler
func(username string, body []byte) (int, []byte)
Handler
Handler parameters:
username— authenticated usernamebody— request body
Handler returns:
int— HTTP status code[]byte— response body
TsEndpointUnregister
Unregisters an endpoint.
TsEndpointExists
Checks whether an endpoint exists.
TsEndpointRegisterPublic
Registers a public endpoint (no authentication).
method
string
HTTP method (GET, POST...)
path
string
Endpoint path
handler
func(body []byte) (int, []byte)
Handler
TsEndpointUnregisterPublic
Unregisters a public endpoint.
TsEndpointExistsPublic
Checks whether a public endpoint exists.
Logging Functions
Functions for emitting entries to the centralized LogManager. Entries are kept in a 5000-element RAM ring buffer (oldest are evicted), printed to stdout (status Debug only if the server runs with --debug), and batch-broadcast to every subscribed client every 50 ms / 100 entries via the WebSocket.
The Source field is conventionally prefixed by owner type so the client can filter by source:
server:<file>
built-in server code
listener:<name>
listener plugins
agent:<id>
per-agent activity
axscript:<file>
user-supplied AxScript
service:<name>
service plugins
Level is the nesting depth (0 = top-level); the client renders deeper levels with extra indentation.
TsLogAdd
Emits one entry to the LogManager.
status
adaptix.LogStatus
LogStatusDebug(0) / LogStatusInfo(1) / LogStatusSuccess(2) / LogStatusWarn(3) / LogStatusError(4)
level
int
Nesting depth
source
string
Source. If category is empty and source contains :, the part before the first colon becomes the source and the rest becomes the category
category
string
Category. Empty lets the manager split it out of source
format
string
fmt.Sprintf format
args
...any
Format arguments
TsLogWriter
Returns an io.Writer adapter that marshals each line written to it as a separate LogEntry.
status
adaptix.LogStatus
Severity for every entry
source
string
Source tag for every entry
category
string
Category for every entry. Empty is allowed
Typical use inside a listener plugin:
Payload Functions
The payload store — generated agent artifacts (Payloads table, content on the server disk).
TsPayloadRegister
Stores a payload: metadata row in the DB + content on disk (with SHA1/SHA256/MD5).
TsPayloadRemove
Remove payload from payload storage.
Utility Functions
TsConvertCpToUTF8
Converts a string from a code page to UTF-8.
Supported code pages:
866 (Russian DOS)
1251 (Cyrillic Windows)
1252 (Western European Windows)
936 (Chinese GBK)
65001 (UTF-8)
and many others...
TsConvertUTF8toCp
Converts UTF-8 to the agent's code page.
TsWin32Error
Returns a description of a Windows error code.
Data Types
adaptix.AgentData
adaptix.TaskData
adaptix.ListenerData
adaptix.TransferData
adaptix.TunnelData
adaptix.PivotData
adaptix.CredsData
adaptix.TargetData
adaptix.ScreenData
adaptix.StatTasks / adaptix.TaskStat
Agent task statistics (returned by TsAgentGetHostedAll, TsAgentGetHostedTasks, and TsFrameTakeStatTasks).
Helpers: stat.Of(taskType) — the stat for a task type; stat.Commands() — Task+Job; stat.Total() — sum of all categories; stat.Empty(); stat.SizeString() — human-readable size (FormatByteSize).
axc2 helpers (command arguments and notes)
The github.com/Adaptix-Framework/axc2/v2 package provides helpers for parsing args map[string]any inside CreateCommand and ready-made console notes.
Constants
Last updated