Payload Generation¶
Stentor's payload generation system produces implants in 17 output formats for every major delivery scenario -- from standard Windows executables to MOTW-bypassing containers and browser-based HTML smuggling. All payloads are generated on-demand via the API, cross-compiled on the Relay agent with optional Garble obfuscation, and stored in the backend for download or auto-hosting.
Generation Pipeline¶
The following diagram shows how a payload moves from API request to deployable binary:
sequenceDiagram
participant Op as Operator
participant BE as Backend
participant Relay as Relay (Kali)
Op->>BE: POST /api/v1/payloads/generate
BE->>BE: Validate request, resolve listener to C2 URL
BE->>Relay: Dispatch via WebSocket
Relay->>Relay: Cross-compile implant (Go build)
Relay->>Relay: Garble obfuscation (if enabled)
Relay->>Relay: Donut shellcode conversion (if shellcode)
Relay-->>BE: Return binary + metadata
BE->>BE: Store payload in database
BE-->>Op: Return payload ID, hash, size, artifacts In This Section¶
- Payload Formats -- Complete reference for all 17 output formats including generation API examples, format-specific configuration options, OPSEC considerations, detection surface, and a format selection guide.
- Code Signing -- Upload code-signing certificates, sign payloads with Authenticode signatures, and manage encrypted certificate storage for trusted payload delivery.
- Evasion Kits -- Sleep masking, syscall obfuscation, BeaconGate, AMSI/ETW patching, and custom kit injection for payload-level evasion.
Quick Start¶
Generate a basic 64-bit EXE payload with a single API call:
curl -s -X POST https://stentor.app/api/v1/payloads/generate \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"delivery_type": "exe",
"implant_variant": "standalone",
"listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
"architecture": "x64"
}' | jq '{id, filename, hash, size}'
See Payload Formats for all available formats and advanced configuration options.