⚠️ Xenon is in an early state of release. It is not opsec safe and could contain memory issues causing crashes. Test thoroughly if planning to use in a live environment.

OPSEC Disclaimer

Xenon makes no claims about evasion. The default configuration will not be OPSEC safe. The goal for Xenon is to allow the operator to customize features in order to accomplish their goals.

Quick Start

Installing Xenon on an already existing Mythic server is very easy. If you do not have a Mythic server set up yet, to do that go to Mythic project page.

For further customizations and evasion refer to the Wiki.

From the Mythic install directory, use the following command to install Xenon as the root user:

./mythic-cli install github https://github.com/MythicAgents/Xenon.git

From the Mythic install directory, use the following command to install Xenon as a non-root user:

sudo -E ./mythic-cli install github https://github.com/MythicAgents/Xenon.git

Features

• Modular command inclusion
• Malleable C2 Profiles
• Supported comms: httpx, smb, tcp
• Uses forge for BOF modules and SharpCollections
• Async BOF Support (async BeaconAPIs)
• User-Defined Reflective Dll Loaders (based on Crystal Palace)
• Compatible with CS Process Inject Kits

Supported Commands

Command	Usage	Description
pwd	pwd	Show present working directory.
ls	ls [path]	List directory information for <directory>.
cd	cd <directory>	Change working directory.
cp	cp <source file> <destination file>	Copy a file to a new destination.
rm	rm <path|file>	Remove a directory or file.
mkdir	mkdir <path>	Create a new directory.
getuid	getuid	Get the current identity.
make_token	make_token <DOMAIN> <username> <password> [LOGON_TYPE]	Create a token and impersonate it using plaintext credentials.
steal_token	steal_token <pid>	Steal and impersonate the token of a target process.
rev2self	rev2self	Revert identity to the original process's token.
ps	ps	List host processes.
shell	shell <command>	Runs {command} in a terminal.
remote_exec	remote_exec -Module [module] -Target [target] -Command [command + args] [-Domain [domain]] [-Username [username]] [-Password [password]]	Execute a command on a remote machine using WMI, WinRM, or SCShell.
sleep	sleep <seconds> [jitter]	Change sleep timer and jitter.
inline_execute	inline_execute -BOF [COFF.o] [-Arguments [optional arguments]]	Execute a Beacon Object File in the current process thread and see output. Warning: Incorrect argument types can crash the Agent process.
async_execute	async_execute -BOF [COFF.o] [-Arguments [optional arguments]]	Execute a Beacon Object File asynchronously in a background thread. Output streams via task updates. Supports BeaconWakeup / BeaconGetStopJobEvent.
jobs	jobs	List running async BOF jobs and their Mythic task UUIDs.
jobkill	jobkill <task_uuid>	Stop a running async BOF by Mythic agent task UUID (signals BeaconGetStopJobEvent).
usermon	usermon [-Interval 3000]	Async login monitor (WTS session poll). Live alerts stream on this task. Stop with jobkill <usermon_task_uuid>.
keylogger	keylogger [-Interval 30000]	Async keylogger: buffers keystrokes and dumps on an interval. Live output on this task. Stop with jobkill <keylogger_task_uuid>.
inline_execute_assembly	inline_execute_assembly -Assembly [file] [-Arguments [assembly args] [--patchexit] [--amsi] [--etw]]	Execute a .NET Assembly in the current process using @EricEsquivel's BOF "Inline-EA" (e.g., inline_execute_assembly -Assembly SharpUp.exe -Arguments "audit" --patchexit --amsi --etw)
execute_assembly	execute_assembly -Assembly [SharpUp.exe] [-Arguments [assembly arguments]]	Execute a .NET Assembly in a remote processes and retrieve the output.
execute_dll	execute_dll -File [mimikatz.x64.dll]	Execute a Dynamic Link Library as PIC. (e.g., execute_dll -File mimikatz.x64.dll)
spawnto	spawnto -path [C:\Windows\System32\svchost.exe]	Set the full path of the process to use for spawn & inject commands.
powerchell	powerchell -Command <command>	Execute PowerShell script using PowerChell post-ex DLL.
powershell_import	powershell_import -File [script.ps1] | --clear	Import PowerShell script to cache.
download	download -path <file path>	Download a file off the target system (supports UNC path).
upload	upload (modal)	Upload a file to the target machine by selecting a file from your computer.
status	status	List C2 connection hosts and their status.
link	link <target> [<named pipe>|<tcp_port>]	Connect to an SMB/TCP Link Agent.
unlink	unlink <Display Id>	Disconnect from an SMB/TCP Link Agent.
socks	socks <start/stop> <port number>	Enable SOCKS 5 compliant proxy to send data to the target network.
rportfwd	rportfwd -Action {start|stop} -Port [port] -RemoteIP [ip] -RemotePort [port]	Reverse port forward.
kill	kill [pid]	Kill a process by PID.
register_process_inject_kit	register_process_inject_kit (pops modal)	Register a custom BOF to use for process injection (CS compatible). See documentation for requirements.
exit	exit	Task the implant to exit.

---

Async BOF Commands

Long-running Beacon Object Files run in a background thread and stream output with task updates. Stop them with jobkill using the Mythic agent task UUID (see jobs).