Session Management

Overview#

Every agent that checks in with the teamserver creates a session. Sessions are the primary way operators interact with compromised hosts.

Session Information#

Each session provides:

Session States#

Sessions are indicated by OS-specific icons with color coding:

• Blue — Active, checking in normally
• Red — Active with elevated privileges
• Grey — Stale (missed expected check-ins)

Interacting with Sessions#

Opening the Console#

Double-click a session row or right-click → Interact to open the agent console. The console provides a command-line interface for executing commands on the target.

Context Menu Actions#

Right-click a session for:

• Interact — Open the agent console
• Set Tag — Apply organizational tags
• Set Mark — Apply a mark indicator
• Set Color — Color-code the session row for visual organization
• Update Data — Modify session metadata
• Remove — Remove the session from the UI (does not terminate the agent)
• Terminate — Send a kill command to the agent

Organizing Sessions#

Tags#

Tags are free-text labels for grouping sessions:

• initial-access — First compromised host
• dc — Domain controller
• web-server — Web server target
• pivot — Used for network pivoting

Colors#

Color-code sessions to visually categorize them at a glance in the sessions table and graph.

Marks#

Marks provide a secondary visual indicator for flagging sessions that need attention.

Session Lifecycle#

Agent executes → Check-in → Session created → Active
                                                ↓
                               ┌─── Tasking ←──┤
                               │                ↓
                               └──► Results → Console output
                                                ↓
                                    Terminate / Kill date / Stale

1. The agent payload executes on the target
2. The agent checks in with its listener
3. The teamserver creates a session record
4. Operators interact via the console and queue tasks
5. The agent retrieves tasks on each check-in and returns results
6. The session ends when terminated, the kill date passes, or the agent goes stale