Demon Console Commands

Demon Console Commands

The built-in command set available in a Demon agent console, from client/src/Havoc/Demon/ConsoleInput.cc. (Python-registered commands can extend this; see Client Python API. The repo's original WIKI.MD command list is outdated; this table is from source.)

Command	Description
help	show command help
sleep <seconds> [jitter%]	set sleep delay / jitter
checkin	force a check-in with metadata
exit thread / exit process	kill the agent (thread-level or process-level; bare exit is rejected; an argument is required)
interactive	put the agent into interactive mode (sleep 0;0); also overrides working hours
job list / job suspend <id> / job resume <id> / job kill <id>	manage running jobs
task list / task clear	manage queued tasks
proc list / proc kill <pid> / proc modules <pid> / proc grep <pid> <pattern> / proc memory <pid> <protection>	process operations (proc memory takes a numeric protection argument)
proc create <app> [args] [--suspended|--normal] [--silent] [--no-pipe]	spawn a process; default is normal; --suspended starts suspended, --silent suppresses console window, --no-pipe skips the output pipe
proc blockdll on|off	block non-Microsoft DLLs in the agent's processes (process mitigation policy)
transfer list / transfer stop <id> / transfer resume <id> / transfer remove <id>	manage file transfers
dir [path]	list directory; flags /s (recursive), /f, /d, /b, /starts <str>, /contains <str>, /ends <str>
ls [path]	alias of dir (same flags)
download <remote> [local]	download file to loot
upload <local> <remote>	upload file
cd <path> / pwd	change / print working directory
cp <src> <dst> / mv <src> <dst> / remove <path> / mkdir <path> / cat <path>	filesystem ops
type <path>	alias of cat
move <src> <dst>	alias of mv
screenshot	take a screenshot (saved to loot)
shell <cmd>	run via cmd.exe /c
powershell <cmd>	run via powershell
inline-execute <bof.o> [args]	run a BOF/COFF object
shellcode inject <pid> <file> / shellcode spawn <file> / shellcode execute <file>	shellcode injection/execution
dll inject <pid> <dll> [args] / dll spawn <dll> [args]	reflective DLL injection / spawn
dotnet list-versions / dotnet inline-execute <assembly> [args]	CLR / inline .NET execution
token getuid / token list / token find / token steal <pid> / token impersonate <id> / token make <domain\user> <pass> / token privs-list / token privs-get / token revert / token remove <id> / token clear	token vault
net domain / net logons <host> / net sessions <host> / net computers / net dclist / net share <host> / net localgroup <host> <group> / net group / net users	network/domain recon
config implant.verbose <true|false>	toggle verbose output
config implant.sleep-mask <true|false>	toggle sleep mask; ⚠️ the client sends config sub-command 1, but the implant's CommandConfig() has no case for it (Command.c:1963-2179), so this currently has no effect; set sleep-mask via the Payload dialog instead
config implant.sleep-obf <true|false>	enable/disable sleep obfuscation
config implant.sleep-obf.start-addr <addr>	sleep obfuscation start address
config implant.sleep-obf.technique <tech>	⚠️ not implemented client-side; prints "Not implemented" (ConsoleInput.cc:1940-1946); use the Payload dialog's Sleep Technique instead
config implant.coffee.veh <true|false> / config implant.coffee.threaded <true|false>	BOF execution options
config memory.alloc <n> / config memory.execute <n>	memory API choice as a numeric value (client validates is_number), e.g. 1 = Win32, 2 = syscall, not win32|syscall strings
config inject.technique <tech>	⚠️ commented out client-side (TODO in ConsoleInput.cc:1988-2000); the implant config value 150 is unreachable from the console
config inject.spoofaddr <addr>	⚠️ not implemented client-side; prints "Not implemented" (ConsoleInput.cc:2004-2009)
config inject.spawn64 <path> / config inject.spawn32 <path>	sacrificial process paths for spawn-and-inject
config killdate <date> / config workinghours <mask>	runtime limits (see below)
pivot list / pivot connect <pipe> / pivot disconnect <id>	SMB pivot chaining (see Tunneling)
rportfwd add <lport> <fwdhost> <fwdport> / rportfwd list / rportfwd remove <id> / rportfwd clear	reverse port-forward
socks add <port> / socks list / socks kill <id> / socks clear	SOCKS5 proxy through the agent (see Tunneling)
luid	current logon session LUID
klist [/all]	kerberos ticket list
purge	purge kerberos tickets
ptt <ticket>	pass-the-ticket
clear	clear the console screen (local operator action)
__debug	debug/diagnostic command

Boolean config values are validated as true|false (ConsoleInput.cc:1884-1908); on/off is not accepted.

Argument details vary per command; type help <command> in the console for the authoritative usage string registered by the client.

Runtime limits: config killdate / config workinghours

• WorkingHours (config workinghours 8:30-17:00, 0 to disable) is evaluated in the victim-local timezone: the implant calls GetLocalTime() and compares against the packed start/end times (InWorkingHours(), payloads/Demon/src/core/Command.c). Outside working hours the implant does not check in; it sleeps until the next start-of-hours (SleepTime(), src/core/Obf.c), staying obfuscated/encrypted in memory during that sleep when a sleep-obfuscation technique is active. Setting sleep 0 (interactive mode) overrides working hours: the implant stays active regardless.
• KillDate (config killdate "2023-10-02 15:04:05", 0 to disable) is parsed with Go's time.Parse (no zone → UTC; the client help text says "GMT 0") and converted to a Windows FILETIME. Once the victim's system time passes it, the implant sends a final DEMON_KILL_DATE (93) package and self-terminates immediately (ReachedKillDate()/KillDate(), Command.c). The teamserver rejects kill dates in the past.