The console

One console. Everywhere you are.

The operator console runs entirely in the browser, served by the teamserver itself. The desktop client renders the same console natively for operators who want an install. The mockups below are redrawn from the real panel — what you see here is what you see in the license.

PANEL v2.2 DESKTOP CLIENT 0.5.26 LANGUAGES EN · RU DRAWN FROM THE REAL PANEL
Walkthrough

Four views, one operation.

Dashboard for the estate, the agents table for the fleet, the workspace for the host in front of you, the builder for the artifacts you ship. Switch between the mockups — or let the tour walk you through them.

https://teamserver.internal — dashboard LIVE
/ Search agents… (Ctrl+F) 🌍 All Countries All Status
mo admin
Dashboard Agents WS-ACCT-04×
TOTAL31all campaigns
ACTIVE24+6 today
PENDING3approval queue
DEAD42 recoverable
ALERTS2critical health
AGENTS OVER TIME30D
OS DISTRIBUTION
Windows 19 Linux 5 Embedded 4 macOS 3
MODULE USAGE7D
shells148
files96
socks41
bof37
GEOGRAPHIC DISTRIBUTIONSCROLL TO ZOOM · CLICK TO FILTER
Map of agent check-ins
DE 9US 7NL 4FI 3SG 2
AV / EDR COVERAGEAS REPORTED
Defender18
CrowdStrike6
SentinelOne3
none detected4
TOP COUNTRIES
DE9
US7
NL4
FI3
SG2
LIVE EVENTS
14:32 build finished · windows / exe-minimal-mem
14:31 ghost chain ack · WS-ACCT-04
14:31 socks started · :1080 via SRV-DB-02
14:29 new agent · NAS-EDGE-01 · pending
14:28 operator sign-in · m.okafor · 2FA
CAMPAIGNS
NORTH 14 ACME-Q3 9 LAB 3
OPERATORS
mojapk
Fig. 01 — Dashboard · all campaignsIllustrative rendering

Five counters, the fleet-over-time chart, OS distribution, module usage, a map you zoom and click to filter, AV/EDR coverage as agents report it, top countries, and the live event stream — with campaign chips and online operators along the bottom.

https://teamserver.internal — agents · campaign: NORTH LIVE
/ Search agents… (Ctrl+F) 🌍 All Countries All Status
mo admin
Dashboard Agents WS-ACCT-04×
31Total ● 24Active ○ 3Pending ✕ 4Dead 19Windows 5Linux 4Emb 3macOS ● 2Alerts
AGENTS — CAMPAIGN: NORTH6 of 31 · sortable, configurable columns
WS-ACCT-04accounting · Win 11 x64 · C 1.12DEF
10.20.8.14 DE active · 60s ±20% Healthy → 00:42
SRV-DB-02database · Server 2022 · GoCS
10.20.4.9 DE active · 120s ±10% Healthy → 02:10
NAS-EDGE-01branch-nas · QTS 5 · static armv7
192.168.4.22 NL idle · 900s fixed Stale → 04:55
MAC-DESIGN-3studio · macOS 15 · arm64
10.20.9.31 US active · 60s ±20% Healthy → 00:19
UBUNTU-EDGE-2untrusted · awaiting approval
10.24.1.7 SG pending · 30s ±10% approvereject —
Fig. 02 — Agents · campaign filterIllustrative rendering

A stats bar with totals and OS counts, country/status/campaign filters, and columns you can show, hide, reorder, and resize. Aliases and campaigns are server-side and filter the whole console. Health is computed from timing and check-ins — a slow agent never looks like a lost one. Pending agents wait for an explicit approve or reject; rejecting asks you to type REJECT and triggers the agent’s self-destruct.

https://teamserver.internal — workspace · WS-ACCT-04 LIVE
/ Search agents… (Ctrl+F) 🌍 All Countries All Status
mo admin
Dashboard Agents WS-ACCT-04×
WS-ACCT-04 DESKTOP-9F2 · Windows 11 23H2 x64 · C agent 1.12 · axis-v1
activehigh integrityNORTHDefender
10.20.8.14IP
6d 4huptime
9,412check-ins
312tasks
SYSTEM
OSWindows 11 23H2
Build22631
AV / EDRDefender
SOCKS PROXYRUNNING
127.0.0.1:1080stop
Routevia existing channel · since 14:31
TIMING
Interval / jitter60s ±20%
Next check-in→ 00:42
STEALTHACTIVE
ETWpatched
AMSIpatched
ShelliShellFilesSOCKSBOFElevate
Fig. 03 — Workspace · WS-ACCT-04 overviewIllustrative rendering

Every agent opens as its own tab, with a grouped nav on the left and the overview first: SOCKS with a one-click start and stop, timing, and stealth state. Shells are color-coded — black for CMD, blue for PowerShell, purple for the in-process Phantom shell. Sections that don’t apply to the host — BOF on Linux, elevation on a static embedded agent — simply don’t appear.

https://teamserver.internal — builder modal over the agents table LIVE
/ Search agents… (Ctrl+F) 🌍 All Countries All Status
mo admin
Dashboard Agents
Agent Builder ×
AgentStagerGhost MSICode Signing
Targets
windows / x64 · exe-minimal-mem✓
linux / x64 · static—
msi · ghost-stream—
Connection
Traffic profilems-graph
Interval / jitter60s ±20%
Ghost-Chainpush · auto
Evasion
Unhook NTDLLon
Block non-Microsoft DLLson
Persistence
MethodGhost-Svchost
Build
BUILD LOGLIVE
14:33 polymorph pass · 4 regions
14:33 profile applied · ms-graph
14:32 link · ok · 61 KB
14:32 compile · done · 6.1s
14:32 compile · started
ARTIFACTSNORTH
agent-north-04.exeexe-minimal-mem
61 KB ok
stager-linux-02elf · static
— building
ghost-stream-north.msimsi · signed
412 KB ok
Fig. 04 — Builder modal · agent tabIllustrative rendering

The builder opens over the console: agent, stager, Ghost MSI, and code-signing tabs; targets, connection, timing, evasion, and persistence sections; payload pool and API paths; a live log; and artifacts with download and cancel. Polymorphism is per customer across the batch — your builds never share signatures with another licensee’s.

Web and desktop

Same console, two carriers.

Both talk to the same API on the same server. Nothing is gated behind the install.

Default

Web panel

Served by the teamserver over HTTPS. Every operator feature: dashboard, agents, workspace, builder, stagers, BOF store, audit, server administration. Per-operator language — English or Russian — remembered per browser.

This is the “C2 on the go” console: an operator account and a browser are the whole workstation.

Optional · v0.5.26

Desktop client

Multiple server profiles, credentials in the OS keychain, tray and native notifications, its own updater. The licensed build adds a wizard that deploys a fresh teamserver onto a host you administer.

The panel loses nothing if you never install it.

Surface anatomy

What the console is made of.

01

Dashboard

The estate at a glance: five counters, agents over time, OS distribution, module usage, a zoomable map with click-to-filter, AV/EDR coverage as reported by agents, top countries, live events, and the campaign and operator strips.

teamview
02

Agents

The fleet as a table: sortable columns you can show, hide, reorder, and resize; country, status, and campaign filters; a stats bar with OS counts and alerts. Pending agents wait for an explicit approve or reject — reject is type-to-confirm and triggers self-destruct.

fleet ops
03

Workspace

One tab per agent: a grouped nav — General, Main, Modules, Persistence, Config, Management — showing only what applies to the host. Overview, history, client info, color-coded shells, files, SOCKS, BOF, timing, stealth, evasion, updates, and Ghost-Chain state.

per host
04

Builder

A modal over the console: agent, stager, Ghost MSI, and code-signing tabs. Targets, connection, timing, evasion, and persistence per build; payload pool and API paths; a live log; artifacts with download and cancel.

toolchain
05

Stagers & BOF repository

Stager management — token minting and revocation, payload upload, per-token use status — and a server-side BOF repository of Beacon-compatible objects, single files or archives with companion scripts.

delivery
06

Server & governance

Activity log with export; user management with roles; TOTP enrollment; server keys — rotate, import, revoke, purge; database management; campaign manager; tunnels overview. What administrators see when operators don’t.

governance
Try it

What you see is what ships.

The guided tour walks the views above — every one clickable, step by step, with nothing real attached. Then write to us and we’ll set up an evaluation on your terms.

Request evaluation