For the complete documentation index, see llms.txt. This page is also available as Markdown.

TS API

ID generators

Six wrappers around the built-in idgen.Generator. They return the next free value for the corresponding entity; counters are restored from the DB on server start (MAX(id) + 1). Plugins that create an entity on the server side must take the ID via these helpers so it does not collide with existing DB records.

TsAgentGenID()  int64   // entity "agent",  table Agents.Id
TsTaskGenID()   int64   // entity "task",   table Tasks.TaskId
TsCredGenID()   int64   // entity "cred",   table Credentials.CredId
TsScreenGenID() int64   // entity "screen", table Screenshots.ScreenId
TsTargetGenID() int64   // entity "target", table Targets.TargetId
TsFileGenID()   int64   // entity "file",   table Downloads.FileId

Agent Functions

TsAgentIsExists

Checks if an agent exists by ID.

TsAgentIsExists(agentId int64) bool

Returns: bool — true if agent exists


TsAgentGetById

Reads one in-memory session. The second result is false when the id is unknown or the agent was removed.


TsAgentIdByUID

Linear search for an agent by UID (optional identifier filled by the listener/agent plugin, not overlapping with agentId).

Returns: the found agentId and true; (0, false) if no agent has this UID or uid is empty.


TsAgentList

JSON array of every in-memory session (AgentData as stored, including the session key). An empty server marshals as null, not [].


TsAgentCatalog

JSON array of registered agent types, sorted by name. Each item is {name, listeners, axs}. axs is the agent AxScript and is omitted when empty.


TsAgentCreate

Creates a new agent on first connection.

Parameter
Type
Description

agentCrc

string

CRC/watermark of the agent type

agentUid

[]byte

Unique agent UID (agentId is generated server-side)

beat

[]byte

Initial data from agent (heartbeat)

listenerName

string

Listener name

ExternalIP

string

Agent's external IP

Async

bool

Asynchronous mode

Returns: adaptix.AgentData, error

Events:

  • agent.new (Pre/Post hooks)


TsAgentProcessData

Processes data received from an agent.

Parameter
Type
Description

agentId

int64

Agent ID

bodyData

[]byte

Data from agent

Events: agent.activate (post only), and only when Mark was "Inactive". The mark is cleared, the row is saved, then the post hook runs.


TsAgentUpdateData

Updates agent data (sleep, jitter, killdate, workingtime).


TsAgentUpdateDataPartial

Partial update of agent data. updateData is any struct/map that JSON-marshals to an object with keys from the table below; only present fields are applied.

Supported fields (JSON key → AgentData field):

JSON key
AgentData field
Type

internal_ip

InternalIP

string

external_ip

ExternalIP

string

gmt_offset

GmtOffset

int

acp

ACP

int

oemcp

OemCP

int

pid

Pid

string

tid

Tid

string

arch

Arch

string

elevated

Elevated

bool

process

Process

string

os

Os

int

os_desc

OsDesc

string

domain

Domain

string

computer

Computer

string

username

Username

string

impersonated

Impersonated

string

tags

Tags

string

mark

Mark

string

color

Color

string ("bg-fg" hex, RGB-validated)

listener

Listener

string

a_session_key

SessionKey

string (stored as []byte; not emitted in TYPE_AGENT_UPDATE)

custom_data

CustomData

string (stored as []byte; not emitted in TYPE_AGENT_UPDATE)

sleep

Sleep

uint

jitter

Jitter

uint

working_time

WorkingTime

int (packed: (startH<<24)|(startM<<16)|(endH<<8)|endM)

kill_date

KillDate

int (unix seconds)

Notes:

  • Changing Mark is silently ignored if the current mark is already "Terminated" (terminal state).

  • Setting Mark = "Disconnect" also updates LastTick to the current time.

  • Color accepts "<bg>-<fg>" hex ("#1e3050-#ffffff"); each half is checked as a valid RGB, and an empty half keeps the previous value.

  • Empty updateData (no recognized fields) is a no-op: the function returns nil, nothing is written to the DB, no sync packet is sent.

  • Fields not listed are ignored. Crc, Id, UID, Name, CreateTime, Async, and TargetId cannot be modified through this API. LastTick changes only as a side effect of Mark = "Disconnect", or through TsAgentSetTick. Active is a runtime flag on the Agent struct, not part of AgentData.

Typical call from a plugin (for example inside OnDispatch for sleep):


TsAgentTerminate

Terminates an agent.

Actions performed:

  1. Cancels all active downloads

  2. Stops all tunnels

  3. Closes terminals

  4. Clears task queues

  5. Removes pivot links

Events:

  • agent.terminate (Pre/Post hooks)


TsAgentSetTick

Updates the agent's last response time.


TsAgentConsoleOutput

Outputs a message to the agent console.

Parameter
Type
Description

agentId

int64

Agent ID

client

string

Initiator operator name (used for filtering in non-team mode)

messageType

int

Message type (5=INFO, 6=ERROR, 7=SUCCESS)

message

string

Message header

clearText

string

Message text

store

bool

Save to the DB


TsAgentBuildExecute

Runs an external command during agent build, redirecting output to the build WebSocket channel.

Parameter
Type
Description

builderId

string

Builder ID (empty string for synchronous execution)

workingDir

string

Working directory for the command

program

string

Executable

args

...string

Command-line arguments

Note: If builderId is empty, the command runs synchronously without output to the WebSocket. Otherwise stdout/stderr are redirected to the build channel.


TsAgentBuildLog

Sends a log message to the agent's WebSocket build channel.

Parameter
Type
Description

builderId

string

Builder ID

status

int

Status: BUILD_LOG_NONE=0, INFO=1, ERROR=2, SUCCESS=3

message

string

Message text


TsAgentEncryptData / TsAgentDecryptData

Session-key encrypt and decrypt. Both return an error if the agent has been removed.


TsSetAgentDeliveryFunc / TsRemoveAgentDeliveryFunc / TsGetAgentDeliveryFunc

Per-agent push callback. TsTaskCreate calls it in a goroutine so a listener can deliver a task without waiting for the next poll. DeliveryFunc is func(agentId int64, taskData TaskData) error.


TsAgentGetHosted* Functions

Retrieve tasks for sending to an agent. All functions pack tasks while respecting a size limit. They do not write to the agent console — dequeue is not a send. The task queue (HostedQueue) is a safe.PriorityQueue with FIFO inside each priority level; Pop() returns the highest-priority item first.

StatTasks is counted after OnDispatch. Each known task type has its own {Count, Bytes} (Task, Job, Browser, Tunnel, Proxy, Local, Other). Helpers: stats.Commands() (TASK+JOB), stats.Total(), stats.Of(taskType), stat.SizeString().

TsAgentGetHostedAll

Gets all available tasks: regular tasks, tunnel tasks, tunnel data, and pivot tasks.

Parameter
Type
Description

agentId

int64

Agent ID

maxDataSize

int

Maximum data size (bytes)

Returns: Packed bytes, operator-visible note, error.

A nested TsAgentGetHostedAll for a child should not write a console line for that child.

TsAgentGetHostedTasks

Gets hosted tasks without pivot. maxCount <= 0 means unlimited.

Parameter
Type
Description

agentId

int64

Agent ID

maxCount

int

Max tasks, or <= 0 for unlimited

maxDataSize

int

Max data size in bytes

The teamserver does not write a console line. After a successful send the listener formats its own text from StatTasks and the bytes it actually wrote (FormatByteSize(len(wire))). stats.Packed is size after PackTasks, before listener wrapping.

Framed transports: the listener prints with adaptix.NoteFrameSent / NoteFrameRecv after TsFrameGetChunk or TsFrameGetChunkSticky, or after a completed TsFramePut, TsFramePutDecoded, or TsFramePutStream. TsFrameTakeStatTasks and TsFrameTakeStatRecv fire once per blob.

TsAgentBuildEmptyTasks

Packs an empty task blob with the agent session key.


Task Functions

TsTaskRunningExists

Checks if a task is running.


TsTaskCreate

Creates a new task.

A task created with taskData.Completed = true (a command that finished on the server) does not enter the HostedQueue. It is finalized immediately: task.complete post hook and a sync broadcast.

Events:

  • task.create (Pre/Post hooks)


TsTaskUpdate

Updates the task with execution results.

Events:

  • task.complete (post only) when this update finalizes the task (Completed on a synced task or job). An update that only parks the task for a client hook does not emit it. Cancel goes through TsTaskCancel and does not emit task.complete.

  • task.update_job (post only) on every update of a TASK_TYPE_JOB task, before that job is finalized. task.start is declared and is not emitted.


TsTaskCancel

Cancels a task — both one still queued and one already dispatched to the agent.

Parameter
Type
Description

agentId

int64

Agent ID

taskId

int64

Task ID

  • Task still in agent.HostedQueue (not yet taken by TsTaskGetAvailableAll or TsTaskGetAvailableTasks) — removed from the queue and finalized as canceled: Completed=true, MessageType=MESSAGE_ERROR, Message="Task canceled", FinishDate=now; OnComplete runs. Sync tasks are updated in the DB and broadcast as a task update; others are removed from the client.

  • Task already dispatched (in agent.RunningTasks) is cancelable too: removed from RunningTasks, TsFrameResetDownstream drops the rest of that downstream session, server AxScript hooks for that task are unregistered, then the same finalization.


Frame Manager Functions

Frame Manager is shared infrastructure for protocol-independent fragmentation/reassembly of large messages between server and agent. It extracts the duplicated logic from listener plugins. It supports three upstream-assembly modes, auto-detected from the first call to the corresponding method:

  • Byte-offset mode (TsFramePut with totalSize > 0, chunkCount == 0): the caller knows the total size in bytes and addresses by byte offset.

  • Chunk-index mode (TsFramePut with chunkCount > 0): the caller knows the chunk count and addresses by chunk index.

  • Stream mode (TsFramePutStream): the total size is unknown up front; chunks arrive with an incrementing seqNum, and the isLast flag signals completion.

Encoding/decoding (compression, frame headers) is performed by the plugin. The plugin passes an encode callback to TsFrameGetChunk and decodes the data returned by TsFramePut/TsFramePutStream itself.


TsFrameHasPending

Returns true if the agent has outgoing data in its downstream session, tasks in HostedQueue, pivot tasks for child agents, or orphaned TASK/BROWSER tasks in RunningTasks (see the requeue above).


TsFramePut

Accepts an upstream fragment from the listener and places it into the reassembly buffer. When assembly is complete, returns the assembled raw block (the plugin decodes/decompresses it and calls TsAgentProcessData).

Parameter
Type
Description

sessionId

string

Session ID (usually agentId)

index

uint32

Byte offset or chunk index (depends on the mode)

data

[]byte

Fragment contents

totalSize

uint32

Full message size (byte-offset mode); 0 for chunk-index mode

chunkCount

uint16

Number of chunks (chunk-index mode); 0 for byte-offset mode

Returns: complete — fully assembled; nextExpected — next expected offset/index; received — how much has been received; sackBitmap — SACK bitmap of acknowledged chunks; assembled — the fully assembled blob (only when complete=true).


TsFramePutStream

Accepts an upstream chunk in stream mode. Chunks arrive with an increasing seqNum; out-of-order arrivals are buffered. When a chunk with isLast = true arrives and all preceding seqNums have been collected — the function returns the assembled raw block.

Parameter
Type
Description

sessionId

int64

Session ID (usually agentId)

seqNum

uint32

Chunk sequence number (starting at 0)

data

[]byte

Chunk contents

isLast

bool

true — this chunk is the last

Returns: complete — the stream is fully assembled; assembled — the assembled data (only when complete=true). Duplicate seqNums are ignored; a repeated TsFramePutStream for an already-finished session returns (true, nil).


TsFramePutDecoded

A TsFramePut variant (byte-offset mode): after the reassembly completes, the decode callback is applied to the assembled block. If decoding returns an error — assembled = nil (the listener can drop the session instead of dispatching garbage).

Returns: the same values as TsFramePut (complete, nextExpected, received, sackBitmap, assembled), but assembled is the result of decode(assembled).


TsFrameGetChunk

Returns the next downstream chunk for an agent. Creates a downstream session on the first call (including pulling tasks from HostedQueue, packing and encrypting by the agent, applying encode).

Parameter
Type
Description

sessionId

string

Session ID

reqOffset

uint32

Requested offset

maxChunkSize

int

Max bytes in a chunk (transport-dependent, e.g., 160 for DNS UDP)

encode

func([]byte) []byte

Optional callback to prepare the full payload (compression + frame); nil — no transformation

Returns: total — total payload size, offset — actual chunk offset, data — chunk contents, taskNonce — session nonce (for subsequent ACK), isEmpty — no data to send.


TsFrameGetChunkSticky

The downstream session is marked sticky: when maxAttempts is exceeded it is not evicted — the attempt counter resets instead, and the session is released only by the idle timeout or via TsFrameAckDelivery. The attempt counter is incremented only on repeated requests for the same offset — requesting a new offset resets it.


TsFrameAckDelivery

Acknowledges to the agent that the entire downstream message has been delivered. Releases the downstream session.


TsFrameTakeStatTasks / TsFrameTakeStatRecv

Atomically take the statistics accumulated by the Frame Manager for a session. Framed transports print "N bytes sent" after TsFrameGetChunk or TsFrameGetChunkSticky, or after a completed TsFramePut, TsFramePutDecoded, or TsFramePutStream.


TsFrameResetUpstream / TsFrameResetDownstream

Reset an unfinished upstream or downstream session (e.g., when desync is detected or an agent is explicitly reloaded).

Used on task/upload cancellation: resetting the downstream session prevents the agent from receiving the canceled task's tail on its next poll.


Client GUI Functions

Functions for synchronizing data with GUI clients (File Browser, Process Manager). These functions send results only to the client that initiated the request.

TsClientGuiDisksWindows

Sends the list of Windows drives to the client.

Parameter
Type
Description

taskData

adaptix.TaskData

Task data

drives

[]adaptix.ListingDrivesDataWin

Drive list


TsClientGuiFilesWindows

Sends the list of Windows files to the client.

Parameter
Type
Description

taskData

adaptix.TaskData

Task data

path

string

Directory path

files

[]adaptix.ListingFileDataWin

File list


TsClientGuiFilesUnix

Sends the list of Unix/Linux files to the client.

Parameter
Type
Description

taskData

adaptix.TaskData

Task data

path

string

Directory path

files

[]adaptix.ListingFileDataUnix

File list


TsClientGuiFilesStatus

Sends the file operation status (delete, rename, etc.) to the client.

Parameter
Type
Description

taskData

adaptix.TaskData

Task data with MessageType and Message for status


TsClientGuiProcessWindows

Sends the list of Windows processes to the client.

Parameter
Type
Description

taskData

adaptix.TaskData

Task data

process

[]adaptix.ListingProcessDataWin

Process list


TsClientGuiProcessUnix

Sends the list of Unix/Linux processes to the client.

Parameter
Type
Description

taskData

adaptix.TaskData

Task data

process

[]adaptix.ListingProcessDataUnix

Process list


Credentials Functions

TsCredentilsAdd

Adds credentials.

Credential structure:

Events:

  • credentials.add (Pre/Post hooks)


TsCredentilsEdit

Events:

  • credentials.edit (Pre/Post hooks)


TsCredentialsSetTag


TsCredentilsDelete

Events:

  • credentials.remove (Pre/Post hooks)


Download/Upload Functions

TsDownloadAdd

Initializes a file download. fileId comes from TsFileGenID.

Events:

  • download.start (Pre/Post hooks)


TsDownloadUpdate

Updates download state.

State
Value
Description

1

RUNNING

Download in progress

2

STOPPED

Paused

3

FINISHED

Completed

4

CANCELED

Cancelled


TsDownloadClose

Finishes a download.

Events:

  • download.finish (Pre/Post hooks)


TsDownloadSave

Saves a file directly (from memory).


TsDownloadGet

One transfer record. The in-memory map is checked first; otherwise the DB row is returned. Unknown id is "File not found: <id>". No event.


TsDownloadGetFilepath

Returns the local path to the downloaded file.

Returns: Full path to the file on the server.

Note: Works only for completed downloads (state=FINISHED).


TsDownloadDelete

Deletes downloaded files.

Events:

  • download.remove (Pre/Post hooks)


TsDownloadSetTag

Update of a tag on a group of downloads.

Parameter
Type
Description

fileIds

[]int64

Array of download FileIds

tag

string

New tag; empty string clears it


TsUploadAdd / TsUploadAddContent

Initialize an upload of a file to an agent. TsUploadAdd reads the file from disk (localPath). TsUploadAddContent takes bytes in memory and optional memory-artifact fields. fileId comes from TsFileGenID.

Parameter
Type
Description

canceled

bool

false → TsUploadClose(CANCELED) rejects with an error; the UI Cancel button is disabled. For artifacts without an agent-side break command. Regular file uploads — true.

kind

int

TRANSFER_KIND_FILE = 0 (regular file) or TRANSFER_KIND_MEMORY = 1 (BOF / shellcode / .NET)

artname

string

Operator-friendly label for Kind=MEMORY (BOF / shellcode name). For FILE — empty string.

arttype

string

Category for Kind=MEMORY ("bof" / "shellcode" / "dotnet"). For FILE — empty string.

Events: upload.start (Pre/Post hooks).


TsUploadGetChunk

Returns the next chunk of the upload file. Used by the agent plugin when preparing a portion of data to send to the agent.

Parameter
Type
Description

fileId

int64

Upload session ID

chunkSize

int

Desired chunk size (bytes)

needApprove

bool

true — Progress is incremented only after TsUploadApprove; false — immediately

Returns: a slice of the read bytes; nil with no error means the file has already been fully sent.


TsUploadApprove

Acknowledges delivery of the next chunk of upload data to the agent. Used when needApprove = true, where the agent explicitly confirms receipt of a chunk before Progress is incremented.


TsUploadClose

Closes the upload session (reason — TRANSFER_STATE_FINISHED or TRANSFER_STATE_CANCELED).

If reason == TRANSFER_STATE_CANCELED and the upload has Cancellable == false (memory artifact without an agent-side break) — returns upload %d is not cancellable. TsAgentRemove and TsUploadDelete still close that upload. After a successful close, state and progress are saved.

Events: upload.finish (Pre/Post hooks).


TsUploadGet

Returns the current snapshot of an upload session. The in-memory map is checked first; otherwise the stored row is returned (finished or canceled). Same shape as TsDownloadGet.


TsUploadDelete

Cancel and remove uploads. Active records are closed as canceled even when Cancellable is false, then the ids are deleted. Clients receive a transfer-delete for each upload. Backs POST /upload/delete.


Listener Functions

TsListenerGet

Returns the data of a running listener.

Parameters:

  • listenerName — listener instance name.

Returns: the ListenerData and an existence flag (false — listener not found; an empty name returns false immediately).


TsListenerGetProfile

Gets a profile for agent generation.

Returns: watermark, profile bytes, error


TsListenerInteralHandler

Handles internal requests (pivot agents).

Returns: child agent id (int64) and an error.


TsListenerList / TsListenerCatalog

Running listeners, and the listener types registered by extenders.


Pivot Functions

TsPivotCreate

Creates a pivot connection.

Events:

  • pivot.create (Pre/Post hooks)


TsPivotDelete

Events:

  • pivot.remove (Pre/Post hooks)


TsGetPivotInfoByName / TsGetPivotInfoById


Screenshot Functions

TsScreenshotAdd

Adds a screenshot.

Events:

  • screenshot.add (Pre/Post hooks)


TsScreenshotNote

Updates the note for a screenshot.


TsScreenshotDelete

Deletes a screenshot.

Actions:

  1. Deletes the file from disk

  2. Removes the record from the DB

  3. Synchronizes with clients

Events:

  • screenshot.remove (Pre/Post hooks)


Target Functions

TsTargetsAdd

Adds new targets (hosts). Duplicates are automatically ignored.

Target structure:

Events:

  • target.add (Pre/Post hooks)


TsTargetsEdit

Edits an existing target.

Parameter
Type
Description

targetId

int64

Target ID

computer

string

Computer name

domain

string

Domain

address

string

IP address

os

int

OS type (1/2/3)

osDesk

string

OS description

tag

string

Tag

info

string

Additional info

alive

bool

Is alive

Events:

  • target.edit (Pre/Post hooks)


TsTargetSetTag

Sets a tag for a group of targets.


TsTargetDelete

Deletes targets.

Events:

  • target.remove (Pre/Post hooks)


Tunnel Functions

TsTunnelStart

Starts the created tunnel.

Returns: TaskId for tracking

Events:

  • tunnel.start (Pre/Post hooks)


TsTunnelCreate* Functions

Functions for creating tunnels of different types. Return TunnelId.

TsTunnelCreateSocks4

Creates a SOCKS4 proxy.

Parameter
Type
Description

AgentId

int64

Agent ID

Info

string

Tunnel description

Lhost

string

Bind address

Lport

int

Bind port

TsTunnelCreateSocks5

Creates a SOCKS5 proxy with optional authentication.

Parameter
Type
Description

AgentId

int64

Agent ID

Info

string

Tunnel description

Lhost

string

Bind address

Lport

int

Bind port

UseAuth

bool

Use authentication

Username

string

Username (if UseAuth)

Password

string

Password (if UseAuth)

TsTunnelCreateLportfwd

Creates a local port forward.

Parameter
Type
Description

AgentId

int64

Agent ID

Info

string

Tunnel description

Lhost

string

Local address

Lport

int

Local port

Thost

string

Target address (on agent)

Tport

int

Target port

TsTunnelCreateRportfwd

Creates a reverse port forward.

Parameter
Type
Description

AgentId

int64

Agent ID

Info

string

Tunnel description

Lport

int

Port on agent

Thost

string

Target address (on server)

Tport

int

Target port


TsTunnelUpdateRportfwd

Updates reverse port forward status after the agent response.

Parameter
Type
Description

tunnelId

int

Tunnel ID (numeric)

result

bool

Whether the tunnel was created on the agent

Returns: TaskId, message, error


TsTunnelStop* Functions

Functions for stopping tunnels.

TsTunnelStop

Stops a tunnel by ID.

Events:

  • tunnel.stop (Pre/Post hooks)

TsTunnelStopSocks

Stops a SOCKS proxy by agent and port.

TsTunnelStopLportfwd

Stops a local port forward.

TsTunnelStopRportfwd

Stops a reverse port forward. Sends a close command to the agent.


TsTunnelChannelExists

Checks whether the tunnel channel exists.


TsTunnelGetPipe

Gets pipes for reading/writing tunnel data.

Returns: PipeReader for reading data from the server, PipeWriter for writing data to the tunnel.


TsTunnelConnection* Functions

Functions for managing tunnel connections.

TsTunnelConnectionData

Sends data to the tunnel channel.

TsTunnelConnectionResume

Resumes the connection after a successful connection on the agent side.

Parameter
Type
Description

AgentId

int64

Agent ID

channelId

int64

Channel ID

ioDirect

bool

true = direct transfer without buffering

TsTunnelConnectionClose

Closes the channel connection.

Parameter
Type
Description

channelId

int64

ChannelId ID

writeOnly

bool

To ensure sufficient time for reading and sending data over a socket. Used in async payloads such as HTTP.

TsTunnelConnectionHalt

Closes the connection with a SOCKS error.

Parameter
Type
Description

channelId

int64

Channel ID

errorCode

byte

SOCKS5 error code (1-8)

TsTunnelConnectionAccept

Accepts an incoming connection for reverse port forward.


TsTunnelConnectionBindReply

Reports a SOCKS5 BIND channel phase change to the server (the agent's response to TunnelCallbacks.BindTCP).

Parameter
Type
Description

channelId

int64

Channel ID

phase

int

TUNNEL_BIND_LISTENING (2) or TUNNEL_BIND_ACCEPTED (3)

atyp

int

address type: ADDRESS_TYPE_IPV4 (1) / DOMAIN (3) / IPV6 (4)

addr

[]byte

bind address (4 / 16 bytes, or domain)

port

int

actual port bound on the agent


TsTunnelPause

Pause tunnels connection to client


TsTunnelResume

Recume tunnels connection to client


Terminal Functions

Functions for managing interactive terminal sessions via the agent.

TsAgentTerminalCloseChannel

Closes the terminal channel and notifies the client.

Parameter
Type
Description

terminalId

int64

Terminal session ID

status

string

Close status/reason


TsTerminalConnExists

Checks whether a terminal connection exists.

Parameter
Type
Description

terminalId

int64

Terminal session ID

Returns: true if the session exists


TsTerminalConnResume

Resumes the terminal connection after a successful start on the agent.

Parameter
Type
Description

agentId

int64

Agent ID

terminalId

int64

Terminal session ID

ioDirect

bool

true = direct transfer without buffering


TsTerminalConnData

Sends data to the terminal session (output from the agent).

Parameter
Type
Description

terminalId

int64

Terminal session ID

data

[]byte

Data to send


TsTerminalConnClose

Closes the terminal session.

Parameter
Type
Description

terminalId

int64

Terminal session ID

reason

string

Close reason


TsTerminalGetPipe

Gets pipes for terminal input/output.

Returns: PipeReader for reading input from the client, PipeWriter for writing agent output.


Service Functions

TsPluginServiceSendDataAll

Sends data to all clients on behalf of the service.


TsPluginServiceSendDataClient

Sends data to a specific client on behalf of the service.


AxScript Server Functions

Server-side AxScript engine functions. Allow loading and executing scripts on the server side, defining commands and hooks without client participation.

TsAxScriptLoadUser

Loads a user AxScript on the server.

Parameter
Type
Description

name

string

Script name

script

string

Script content


TsAxScriptUnloadUser

Unloads a user AxScript from the server.


TsAxScriptList

Returns a JSON list of loaded scripts.


TsAxScriptCommands

Returns a JSON list of registered server-side commands.


TsAxScriptResolveHooks

Resolves server-side hooks for an agent command. Used when processing commands where the client did not provide a hook/handler.

Parameter
Type
Description

agentName

string

Agent type name

agentId

int64

Agent ID

listenerRegName

string

Registered listener name

os

int

Agent OS type

cmdline

string

Command line

args

map[string]interface{}

Command arguments

client

string

Operator client name

Returns: hookId, handlerId, preHookHandled (true if Pre hook fully handled the command), error


TsAxScriptParseAndExecute

Parses and executes a raw command via the server-side AxScript engine.

Parameter
Type
Description

agentId

int64

Agent ID

username

string

Operator name

cmdline

string

Command line


TsAxScriptIsServerHook

True when id is a hook registered by a teamserver script rather than a client script.


Event Hook Functions

Generic event-hook registration. Unlike the narrow TsEventHookOnPost / TsEventHookOnPre wrappers, these methods take explicit phase and priority — multiple hooks on one event are ordered by priority.

TsEventHookRegister

Registers an event hook with an explicit phase and priority.

Parameters:

Parameter
Type
Description

eventType

string

Event type (e.g. "task.create", "agent.new", "upload.finish")

name

string

Hook name (used for bulk unregister via TsEventHookUnregisterByName).

phase

int

0 — synchronous, before the action; 1 — asynchronous, after the action.

priority

int

Priority within the phase. Calls run in priority order

handler

func(event any) error

Handler function; receives the event as any (type-asserted by the plugin).

Returns: the hook ID (string).


TsEventHookOnPre / TsEventHookOnPost

Registers a pre or post hook at the default priority and returns the hook id. Neither call emits an event.


TsEventHookUnregister

Unregisters one hook by the id returned from TsEventHookRegister.

Returns true when a hook with that id was removed.


TsEventHookUnregisterByName

Unregisters all hooks registered under the given name.

Returns: the number of hooks removed (0 if none found).


TsEventHookSetEnabled

Enables/disables a registered hook without unregistering it.


Extender Data Functions

Functions for storing extender data in the database.

TsExtenderDataSave

Saves extender data to the database.


TsExtenderDataLoad

Loads extender data from the database.


TsExtenderDataDelete

Deletes data by key from the database.


TsExtenderDataKeys

Returns a list of saved extender keys.


TsExtenderDataDeleteAll

Deletes all extender data from the database.


Endpoint Functions

Functions for registering HTTP endpoints.

TsEndpointRegister

Registers a protected endpoint (uses the teamserver's shared JWT authentication).

Parameter
Type
Description

method

string

HTTP method (GET, POST...)

path

string

Endpoint path

handler

func(username string, body []byte) (int, []byte)

Handler

Handler parameters:

  • username — authenticated username

  • body — request body

Handler returns:

  • int — HTTP status code

  • []byte — response body


TsEndpointUnregister

Unregisters an endpoint.


TsEndpointExists

Checks whether an endpoint exists.


TsEndpointRegisterPublic

Registers a public endpoint (no authentication).

Parameter
Type
Description

method

string

HTTP method (GET, POST...)

path

string

Endpoint path

handler

func(body []byte) (int, []byte)

Handler


TsEndpointUnregisterPublic

Unregisters a public endpoint.


TsEndpointExistsPublic

Checks whether a public endpoint exists.


Logging Functions

Functions for emitting entries to the centralized LogManager. Entries are kept in a 5000-element RAM ring buffer (oldest are evicted), printed to stdout (status Debug only if the server runs with --debug), and batch-broadcast to every subscribed client every 50 ms / 100 entries via the WebSocket.

The Source field is conventionally prefixed by owner type so the client can filter by source:

Prefix
Owner

server:<file>

built-in server code

listener:<name>

listener plugins

agent:<id>

per-agent activity

axscript:<file>

user-supplied AxScript

service:<name>

service plugins

Level is the nesting depth (0 = top-level); the client renders deeper levels with extra indentation.

TsLogAdd

Emits one entry to the LogManager.

Parameter
Type
Description

status

adaptix.LogStatus

LogStatusDebug(0) / LogStatusInfo(1) / LogStatusSuccess(2) / LogStatusWarn(3) / LogStatusError(4)

level

int

Nesting depth

source

string

Source. If category is empty and source contains :, the part before the first colon becomes the source and the rest becomes the category

category

string

Category. Empty lets the manager split it out of source

format

string

fmt.Sprintf format

args

...any

Format arguments


TsLogWriter

Returns an io.Writer adapter that marshals each line written to it as a separate LogEntry.

Parameter
Type
Description

status

adaptix.LogStatus

Severity for every entry

source

string

Source tag for every entry

category

string

Category for every entry. Empty is allowed

Typical use inside a listener plugin:


Payload Functions

The payload store — generated agent artifacts (Payloads table, content on the server disk).

TsPayloadRegister

Stores a payload: metadata row in the DB + content on disk (with SHA1/SHA256/MD5).


TsPayloadRemove

Remove payload from payload storage.



Utility Functions

TsConvertCpToUTF8

Converts a string from a code page to UTF-8.

Supported code pages:

  • 866 (Russian DOS)

  • 1251 (Cyrillic Windows)

  • 1252 (Western European Windows)

  • 936 (Chinese GBK)

  • 65001 (UTF-8)

  • and many others...


TsConvertUTF8toCp

Converts UTF-8 to the agent's code page.


TsWin32Error

Returns a description of a Windows error code.


Data Types

adaptix.AgentData


adaptix.TaskData


adaptix.ListenerData


adaptix.TransferData


adaptix.TunnelData


adaptix.PivotData


adaptix.CredsData


adaptix.TargetData


adaptix.ScreenData


adaptix.StatTasks / adaptix.TaskStat

Agent task statistics (returned by TsAgentGetHostedAll, TsAgentGetHostedTasks, and TsFrameTakeStatTasks).

Helpers: stat.Of(taskType) — the stat for a task type; stat.Commands() — Task+Job; stat.Total() — sum of all categories; stat.Empty(); stat.SizeString() — human-readable size (FormatByteSize).


axc2 helpers (command arguments and notes)

The github.com/Adaptix-Framework/axc2/v2 package provides helpers for parsing args map[string]any inside CreateCommand and ready-made console notes.


Constants

Last updated