Beacon Agent

Overview#

Beacon is JustC2’s full-featured agent, designed for comprehensive post-exploitation on Windows, Linux, and macOS targets. It supports multiple communication protocols and provides a rich set of commands for interacting with compromised systems.

Supported Platforms#

Communication Protocols#

Beacon can be configured to use any of the following protocols:

A single Beacon agent is compiled for one listener/protocol (multi_listeners: false). To use a different protocol, generate a new payload.

Agent Configuration#

When generating a Beacon payload, you can configure:

Timing#

• Sleep — Interval between check-ins (seconds)
• Jitter — Randomization percentage applied to the sleep interval (0-100%)
• Kill Date — Date after which the agent self-terminates
• Working Hours — Time window during which the agent operates

Identity#

• Watermark — Unique identifier embedded in the agent (be4c0149 for Beacon)
• Session Key — Encryption key for C2 communication

Capabilities#

File System#

• Browse directories and files
• Upload and download files
• Execute commands and scripts

Process Management#

• List running processes
• View process details (PID, PPID, user context, architecture)

Network#

• SOCKS4 and SOCKS5 proxy tunnels
• Local and reverse port forwarding
• Network enumeration

Credential Operations#

• Credential harvesting
• Credential storage and management

System#

• Screenshot capture
• Interactive terminal sessions
• System information gathering
• Privilege information

Pivoting#

• Parent-child agent relationships
• Traffic forwarding through agent chains
• Cross-protocol pivoting (e.g., HTTP agent relaying to SMB agent)

Agent Lifecycle#

1. Generation — Payload is compiled from source with the selected configuration
2. Deployment — The payload is executed on the target system
3. Check-in — The agent contacts its listener and registers with the teamserver
4. Tasking — The operator queues commands; the agent retrieves them on each check-in
5. Execution — The agent executes tasks and returns results
6. Termination — The agent is terminated via command, kill date, or manual removal