Session Commands

Sessions are currently connected Ghost implants.

Here, we have a Mutual TLS listener running on port 8443:

We execute the implant on the target system, and the shell receives a notification:

We can now list sessions, and see the new session that registered previously (notice the prompt now showing (1) session connected):

We can see various informations about the implant (user, host, C2 address, os/platform, workspace, etc...)

We can now interact with this session:

Some things happen here:

• A new prompt is displayed, showing the change in context. It shows:
  • The name of the Agent.
  • The combination User@Host of the target.
  • Directly tied to it, the Current Working Directory of the implant.
  • The workspace tied to the Implant (the current workspace if no workspace is tied to it)
• A new menu context exists, and commands available to the shell are now only implant-specific.

We also print more information, in the above picture, and we can see things like precise OS version, UserID, GroupID, ProcessID, MTLS host:port combination, etc...

NOTE: You can customize the implant prompt, go check Implant Config.

If we want to go back to the main menu, without killing the session:

Once we are done, we can kill the implant session: