+++
title = "Cazalla"
chapter = true
weight = 100
+++

**Cazalla** is a lightweight Windows implant written in C, designed for the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic).



## Overview

Cazalla provides essential post-exploitation capabilities including:

- **File System Operations** - Navigate, read, write, and manage files
- **Process Management** - Enumerate, terminate, and interact with processes
- **Token Manipulation** - Steal and impersonate security tokens
- **Network Tunneling** - SOCKS5 proxy and reverse port forwarding
- **Credential Harvesting** - Automatic credential detection from files
- **Keylogging** - Low-level keyboard input capture
- **Full Mythic Integration** - Process Browser, File Browser, OPSEC checking

## Command Categories

### File System (9 commands)
- `ls` - List directory contents
- `cd` - Change directory
- `pwd` - Print working directory
- `cat` - Read file contents
- `cp` - Copy files
- `mkdir` - Create directory
- `rm` - Delete file/directory
- `download` - Download file from target
- `upload` - Upload file to target

### Process Management (2 commands)
- `ps` - List processes
- `kill` - Terminate process

### Token Operations (5 commands)
- `list_tokens` - Enumerate tokens
- `steal_token` - Steal process token
- `make_token` - Create token from credentials
- `rev2self` - Revert to original token
- `whoami` - Display current context

### Network Tunneling (2 commands)
- `socks` - Start/stop SOCKS5 proxy
- `rpfwd` - Start/stop reverse port forwarding

### System Operations (5 commands)
- `shell` - Execute shell commands
- `browser_info` - Identify installed browsers
- `screenshot` - Capture desktop screenshot
- `keylog_start` - Start keylogger
- `keylog_stop` - Stop keylogger

### Control (2 commands)
- `sleep` - Adjust beacon interval
- `exit` - Terminate agent

## Key Features

### Process Browser Integration
Cazalla automatically updates Mythic's Process Browser, allowing you to interact with processes directly from the UI.

### File Browser Integration
Seamlessly browse the target's file system through Mythic's File Browser.

### OPSEC Checking
Built-in operational security checking warns operators before executing risky commands.

### Context Tracking
Automatic tracking and display of current working directory and active token impersonation.

## Installation

See the [Getting Started Guide] for installation and setup instructions.

## Documentation

- **Commands Reference** - Complete documentation of all commands
- **Getting Started** - Installation and first steps
- **Features Overview** - Detailed feature explanations
- **OPSEC Guide** - Operational security considerations
- **Logging & Syslog** - System logging and syslog configuration
- **Usage Examples** - Practical examples and use cases
- **Troubleshooting** - Common issues and solutions

---

**Developed by:** Kaseya OFSTeam