BeaconTCP Listener

Overview#

BeaconTCP is an internal (bind) listener that opens its own TCP port, independent of the teamserver’s HTTP server. Beacon agents connect directly to this port using a raw TCP protocol.

Characteristics#

Creating a BeaconTCP Listener#

1. Open the Listeners tab
2. Click Create
3. Select BeaconTCP
4. Configure:
   • Name — Unique name (e.g., tcp-pivot)
   • Bind Host — Interface to listen on
   • Bind Port — TCP port to open
5. Click Start

How It Works#

1. The listener opens a dedicated TCP socket on the configured port
2. Beacon agents establish raw TCP connections to this port
3. Data is exchanged using the Beacon binary protocol
4. The listener manages connection state independently from the teamserver’s HTTP server

Use Cases#

• Internal pivoting — When agents on an internal network can’t reach the HTTP listener
• Bind connections — An agent on a compromised host connects back to this listener
• Lab environments — Simpler setup without HTTP overhead
• Chained pivots — Used in combination with agent-to-agent pivoting

OPSEC Notes#

• Opens a new port on the server — ensure firewall rules are appropriate
• Raw TCP traffic may be easier to detect than HTTP on monitored networks
• Best used for internal network pivoting rather than initial access
• Consider the port number carefully — common ports (80, 443, 8080) may be less suspicious