File Browser

Beacon’s File Browser is an opportunity to explore the files on a compromised system. Go to [Beacon] -> Explore -> File Browser to open it.

You can also issue the command, file_browser, to open the file browser tab starting in the current directory.

The file browser will request a listing for the current working directory of Beacon. When this result arrives, the file browser will populate.

The left-hand side of the file browser is a tree which organizes the known drives and folders into one view. The right-hand side of the file browser shows the contents of the current folder.

figure 55 - File Browser

Each file browser caches the folder listings it receives. A colored folder indicates the folder’s contents are in this file browser’s cache. You may navigate to cached folders without generating a new file listing request. Press Refresh to ask Beacon to update the contents of the current folder.

A dark-grey folder means the folder’s contents are not in this file browser’s cache. Click on a folder in the tree to have Beacon generate a task to list the contents of this folder (and update its cache). Double-click on a dark-grey folder in the right-hand side current folder view to do the same.

To go up a folder, press the folder button next to the file path above the right-hand side folder details view. If the parent folder is in this file browser’s cache, you will see the results immediately. If the parent folder is not in the file browser’s cache, the browser will generate a task to list the contents of the parent folder.

Right-click a file to download or delete it.

To see which drives are available, press List Drives.

File System Commands

You may prefer to browse and manipulate the file system from the Beacon console.

Use the ls command to list files in the current directory. Use mkdir to make a directory. rm will remove a file or folder. cp copies a file to a destination. mv moves a file.

 

Related Topics