wiki created

documentation-payload/Cazalla/_index.md

@@ -0,0 +1,91 @@
++++
+title = "Cazalla"
+chapter = true
+weight = 100
++++
+
+**Cazalla** is a lightweight Windows implant written in C, designed for the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic).
+
+
+
+## Overview
+
+Cazalla provides essential post-exploitation capabilities including:
+
+- **File System Operations** - Navigate, read, write, and manage files
+- **Process Management** - Enumerate, terminate, and interact with processes
+- **Token Manipulation** - Steal and impersonate security tokens
+- **Network Tunneling** - SOCKS5 proxy and reverse port forwarding
+- **Credential Harvesting** - Automatic credential detection from files
+- **Keylogging** - Low-level keyboard input capture
+- **Full Mythic Integration** - Process Browser, File Browser, OPSEC checking
+
+## Command Categories
+
+### File System (9 commands)
+- `ls` - List directory contents
+- `cd` - Change directory
+- `pwd` - Print working directory
+- `cat` - Read file contents
+- `cp` - Copy files
+- `mkdir` - Create directory
+- `rm` - Delete file/directory
+- `download` - Download file from target
+- `upload` - Upload file to target
+
+### Process Management (2 commands)
+- `ps` - List processes
+- `kill` - Terminate process
+
+### Token Operations (5 commands)
+- `list_tokens` - Enumerate tokens
+- `steal_token` - Steal process token
+- `make_token` - Create token from credentials
+- `rev2self` - Revert to original token
+- `whoami` - Display current context
+
+### Network Tunneling (2 commands)
+- `socks` - Start/stop SOCKS5 proxy
+- `rpfwd` - Start/stop reverse port forwarding
+
+### System Operations (4 commands)
+- `shell` - Execute shell commands
+- `screenshot` - Capture desktop screenshot
+- `keylog_start` - Start keylogger
+- `keylog_stop` - Stop keylogger
+
+### Control (2 commands)
+- `sleep` - Adjust beacon interval
+- `exit` - Terminate agent
+
+## Key Features
+
+### Process Browser Integration
+Cazalla automatically updates Mythic's Process Browser, allowing you to interact with processes directly from the UI.
+
+### File Browser Integration
+Seamlessly browse the target's file system through Mythic's File Browser.
+
+### OPSEC Checking
+Built-in operational security checking warns operators before executing risky commands.
+
+### Context Tracking
+Automatic tracking and display of current working directory and active token impersonation.
+
+## Installation
+
+See the [Getting Started Guide] for installation and setup instructions.
+
+## Documentation
+
+- **Commands Reference** - Complete documentation of all commands
+- **Getting Started** - Installation and first steps
+- **Features Overview** - Detailed feature explanations
+- **OPSEC Guide** - Operational security considerations
+- **Usage Examples** - Practical examples and use cases
+- **Troubleshooting** - Common issues and solutions
+
+---
+
+**Developed by:** Kaseya OFSTeam
+