C2 and REST API

Web C2 dashboard

C2 Phase Guide

Command and Control — manage beacons, task implants and coordinate multi-operator campaigns via the C2 server.

All commands below abstract their arguments through payload.json. Set rhost, lhost, domain, wordlist and credentials once; the framework substitutes them automatically. Never pass raw IP addresses or credentials as positional arguments.

Commands

Command	Description	Source

| do_apt_playbook | List, validate, and run APT playbooks based on public threat reports. | lazyown.py | | do_atomic_agent | Generates and synchronizes atomic agent scripts. | lazyown.py | | do_atomic_gen | Generates test and cleanup scripts for a given Atomic Red Team technique ID. | lazyown.py | | do_atomic_tests | Executes Atomic Red Team tests based on user-selected platform and test. | lazyown.py | | do_attack_plan | Executes a multi-step APT simulation plan based on Atomic Red Team test IDs. | lazyown.py | | do_automsf | Try to check if Vulnerable using the module passed by argument of lazyown example automsf exploit/windows/iis/iis_webdav_upload_asp to use in metasploit | lazyown.py | | do_c2 | Handle C2 server setup and agent compilation. | lazyown.py | | do_caldera | Installs and starts the Caldera server. | lazyown.py | | do_caldera_export | Export a LazyOwn playbook to CALDERA ability YAML. | lazyown.py | | do_caldera_import | Import CALDERA abilities into LazyOwn playbooks. | lazyown.py | | do_collab_join | Print the multi-operator collaboration join URL and SSE endpoint. | lazyown.py | | do_duckyspark | duckyspark Compiles and uploads an .ino sketch to a Digispark device using Arduino CLI and Micronucleus. | lazyown.py | | do_emp3r0r | Command emp3r0r Downloads and sets up the Emperor server for local exploitation. | lazyown.py | | do_empire | Generates payloads using PowerShell Empire with various options. | lazyown.py | | do_engage | Drive a single target through the full kill-chain in one command. | lazyown.py | | do_generate_playbook | Generates a playbook that integrates Atomic Red Team tests and MITRE ATT&CK techniques. | lazyown.py | | do_iis_webdav_upload_asp | (CVE-2017-7269). Vulnerable using the module iis_webdav_upload_asp of metasploit | lazyown.py | | do_listener | Manage C2 listeners: list, add, start, stop, remove. | lazyown.py | | do_mitre_test | Interacts with the MITRE ATT&CK framework using the STIX 2.0 format. | lazyown.py | | do_msf | Automates various Metasploit tasks including scanning for vulnerabilities, setting up reverse shells, and creating payloads. | lazyown.py | | do_msfrpc | Connects to the msfrpcd daemon and allows remote control of Metasploit. | lazyown.py | | do_my_playbook | Generates a playbook from your custom technique database. | lazyown.py | | do_pipeline | Declarative composition layer: run a YAML pipeline of LazyOwn commands. | lazyown.py | | do_sandbox | Toggle or query Docker sandbox mode. | lazyown.py | | do_sliver_server | Starts the Sliver server and generates a client configuration file for connecting clients. | lazyown.py |

Next Phase

After completing the C2 phase, proceed to: Reconnaissance (docs/recon.md) or Exploitation (docs/exploit.md)

---

Generated from cli/command_index.json. Keep this guide in sync by running python3 scripts/build_command_index.py after adding new commands.

REST API

Versioned endpoints live under /api/v1 (see openapi.yaml):

Method	Endpoint	Purpose
GET	/api/v1/health	Service and subsystem status
GET	/api/v1/targets	Hosts in scope (from the campaign database)
GET	/api/v1/results	Beacon task results
GET	/api/v1/campaigns	Autonomous campaign status
POST	/api/v1/webhooks	Register result webhooks

Mutating endpoints require a tenant API key (see core/api_authz.py).