JustC2 Docs
JustC2 Docs
Comenzar
Comenzar

profile.yaml Reference

Overview

The profile.yaml file is located in the same directory as the justserver binary (typically dist/). It defines all server parameters including network configuration, authentication, TLS, and plugin loading.

Complete Example

Teamserver:
  interface: "0.0.0.0"
  port: 4321
  endpoint: "/endpoint"
  password: "MySecurePassword123!"
  only_password: true
  operators:
    operator1: "pass1"
    operator2: "pass2"
  cert: "server.rsa.crt"
  key: "server.rsa.key"
  extenders:
    - "extenders/beacon_listener_http/config.yaml"
    - "extenders/beacon_listener_smb/config.yaml"
    - "extenders/beacon_listener_tcp/config.yaml"
    - "extenders/beacon_listener_dns/config.yaml"
    - "extenders/beacon_agent/config.yaml"
    - "extenders/gopher_listener_tcp/config.yaml"
    - "extenders/gopher_agent/config.yaml"
  axscripts:
    # - "Extension-Kit/extension-kit.axs"
  access_token_live_hours: 12
  refresh_token_live_hours: 168

HttpServer:
  error:
    status: 404
    headers:
      Content-Type: "text/html; charset=UTF-8"
      Server: "nginx/1.26.2"
    page: "404page.html"
  http:
    max_header_bytes: 8192
    read_header_timeout_sec: 0
    read_timeout_sec: 0
    write_timeout_sec: 0
    idle_timeout_sec: 0
    request_timeout_sec: 300
    request_timeout_message: "504 Gateway Timeout"
    disable_keep_alives: false
    enable_http2: true
  tls:
    min_version: "TLS1.2"
    max_version: "TLS1.3"
    prefer_server_cipher_suites: false
    cipher_suites:
      - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
      - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
      - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
      - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
      - "TLS_RSA_WITH_AES_128_GCM_SHA256"
      - "TLS_RSA_WITH_AES_256_GCM_SHA384"

Teamserver Section

Network

FieldTypeDefaultDescription
interfacestring"0.0.0.0"IP address to bind the server to. Use 0.0.0.0 for all interfaces or a specific IP to restrict access.
portint4321TCP port for the teamserver’s HTTPS API and WebSocket endpoint.
endpointstring"/endpoint"URL path prefix for all API routes. All client requests go to https://host:port/endpoint/.... Changing this helps avoid fingerprinting.

Authentication

FieldTypeDefaultDescription
passwordstringrequiredMaster password for the teamserver. Used when only_password is true.
only_passwordbooltrueIf true, any username is accepted with the master password. If false, each operator must use their specific username/password from the operators map.
operatorsmap{}Map of username: password pairs. Only used when only_password is false.

Password-Only Mode

When only_password: true, operators connect with any username and the shared master password. This is simpler but provides no per-operator accountability.

Operator Mode

When only_password: false, each operator must authenticate with their specific username and password from the operators map. This provides individual accountability and allows the server to track which operator executed each action.

TLS Certificates

FieldTypeDescription
certstringPath to the TLS certificate file (PEM format), relative to the server binary location.
keystringPath to the TLS private key file (PEM format), relative to the server binary location.

Plugins

FieldTypeDescription
extenderslistPaths to extender config.yaml files, relative to the server binary location. Each extender is loaded at startup.
axscriptslistPaths to AxScript extension files (.axs).

Token Lifetimes

FieldTypeDefaultDescription
access_token_live_hoursint12How many hours an access JWT token remains valid.
refresh_token_live_hoursint168How many hours a refresh JWT token remains valid (default: 7 days).

HttpServer Section

See HTTP Server Configuration for the detailed HttpServer reference.

Security Recommendations

  1. Change the default password — Never use "pass" in production
  2. Use operator mode for multi-operator engagements — Set only_password: false and define individual credentials
  3. Change the endpoint — Replace /endpoint with a custom, non-obvious path
  4. Restrict the interface — Bind to a specific IP if the server has multiple interfaces
  5. Shorten token lifetimes for high-security engagements
  6. Customize the error page — The default 404 page and headers should match your cover story (e.g., appear as nginx, Apache, or IIS)
Prev
Docker Deployment
Next
SSL/TLS Setup