Generating Payloads

Overview#

JustC2 generates agent payloads on demand by compiling source code at runtime. This means each payload can be uniquely configured with different listener profiles, sleep intervals, and build parameters.

Prerequisites#

For payload generation to work, the server requires:

1. Go 1.26.5+ installed and available in $PATH on the server machine
2. Agent source code present in the extender directories:
   • dist/extenders/beacon_agent/src_beacon/ for Beacon agents
   • dist/extenders/gopher_agent/src_gopher/ for Gopher agents

Generating via the Client#

Step 1: Ensure a Listener is Running#

Before generating an agent, you need at least one active listener. The agent will be configured to connect to this listener.

Step 2: Open the Agent Generator#

1. In JustClient, navigate to the agent generation dialog
2. Select the agent type (Beacon or Gopher)

Step 3: Configure the Agent#

Step 4: Build#

Click Generate to start the build process. The build log panel shows real-time compilation output:

[*] Build process start
[*] Generating listener profiles...
[+] Profile generated for BeaconHTTP
[*] Compiling agent...
[+] Build successful
[+] File saved: /path/to/payload
----- Build process finished -----

Step 5: Deploy#

The generated payload is saved to your local machine. Deploy it to the target system using your preferred delivery method.

Build Process Details#

Beacon Build#

The Beacon builder:

1. Calls GenerateProfiles() to create transport profiles for the selected listener
2. Calls BuildPayload() with the profiles and agent configuration
3. Compiles the Beacon source with embedded configuration
4. Returns the compiled binary

Gopher Build#

The Gopher builder compiles a Go binary with:

GOWORK=off CGO_ENABLED=0 GOOS=<target_os> GOARCH=<target_arch> \
    go build -trimpath -ldflags="-s -w" -o <output_path>

Key flags:

• GOWORK=off — Ignores the Go workspace file
• CGO_ENABLED=0 — Static compilation (no C dependencies)
• -trimpath — Removes local paths from the binary
• -ldflags="-s -w" — Strips symbol and debug information

One-Shot Builds#

JustC2 also supports “sync once” builds via the API (/agent/generate), which compile and return the payload in a single request without storing it on the server.

Troubleshooting#

“Build failed” error#

Check the build log for details. Common causes:

• Go not installed — Ensure Go 1.26.5+ is in $PATH on the server
• Missing source — Verify agent source directories exist in the extender directories
• Module errors — The axc2 module must be accessible; check go.mod and replace directives

Payload doesn’t connect#

• Verify the listener is running and accessible from the target network
• Check the agent address configuration matches the actual listener endpoint
• Confirm firewall rules allow the traffic
• Ensure the TLS certificate is accessible (for HTTPS listeners)

Large binary size#

• Go binaries are inherently larger than C binaries
• The -s -w ldflags are already applied to strip debug info
• UPX compression can be applied post-build to further reduce size