Downloads

Overview#

JustC2 provides a file download system that allows operators to transfer files from compromised hosts to the teamserver. Downloads are tracked in real-time and can be managed through the Downloads tab.

Initiating a Download#

Downloads are typically initiated through the agent console by using file download commands. The agent reads the file on the target and sends its content back to the teamserver in chunks through the C2 channel.

Download States#

Downloads Tab#

The Downloads tab displays all downloads with:

Managing Downloads#

Syncing Downloads#

Downloads are synchronized with the teamserver. When a new operator connects, they can sync existing downloads to view their status.

Click Sync on a download to retrieve the file locally from the teamserver to the client machine.

Deleting Downloads#

Right-click a download → Delete to remove the download record and optionally the downloaded file from the teamserver.

Download Flow#

Operator → Download command → Agent reads file
                                    ↓
                              Chunks sent via C2
                                    ↓
                              Teamserver writes file
                                    ↓
                              Progress updated → Downloads tab
                                    ↓
                              Client can sync/download

1. The operator issues a download command through the console
2. The agent opens the file on the target and reads it in chunks
3. Each chunk is sent as part of the agent’s check-in response
4. The teamserver writes the chunks to a local file, tracking progress
5. The operator can sync the completed file to their local machine

Notes#

• Download speed is limited by the agent’s check-in interval and C2 channel bandwidth
• Large files are transferred in chunks across multiple check-ins
• Canceled downloads can potentially be resumed by re-initiating the download
• Downloaded files are stored on the teamserver’s disk in the data directory