Angerona/documentation-payload/Cazalla/commands

Cazalla Commands

Complete documentation for all Cazalla agent commands, organized by category.

File System Commands

• ls - List directory contents
• cd - Change directory
• pwd - Print working directory
• cat - Read file contents (with credential detection)
• cp - Copy files
• mkdir - Create directory
• rm - Delete file/directory
• download - Download file from target
• upload - Upload file to target

Process Management Commands

• ps - List processes
• kill - Terminate process

Token Operations

• list_tokens - Enumerate tokens
• steal_token - Steal process token
• make_token - Create token from credentials
• rev2self - Revert to original token
• whoami - Display current context

Network Tunneling

• socks - Start/stop SOCKS5 proxy
• rpfwd - Start/stop reverse port forwarding

System Operations

• shell - Execute shell commands
• browser_info - Identify installed browsers
• browser_dump - Dump browser credentials
• screenshot - Capture desktop screenshot
• keylog_start - Start keylogger
• keylog_stop - Stop keylogger

Credential Access

• samdump - Dump SAM database (NTLM hashes)

Code Execution

• inline_execute - Execute Beacon Object Files (BOFs)
• inline_execute_assembly - Execute .NET assemblies in-process

Control Commands

• sleep - Adjust beacon interval
• exit - Terminate agent

---

Back to Cazalla Documentation