NaxDarks

NaxDarks is a Red Team agent for Linux, built for the Adaptix Framework, that brings the flexibility of Beacon Object Files (BOFs) to the Linux ecosystem.

Forget depending on Python or Bash on the target machine. NaxDarks executes compiled C object files (.o) directly in memory using an in-memory ELF loader (mmap + relocate + execute), with a Beacon-style API and native support for asynchronous BOF execution. It includes malleable HTTPS transport, TCP pivoting, dead-drop transports via Azure Blob Storage and GitLab, and a suite of ready-to-use post-exploitation BOFs.

Features

• HTTPS transport - malleable C2 profile v2 with URI and host rotation, configurable sleep and jitter; HTTP/2 via libcurl
• TCP transport - connect-out (TLS 1.2+) and bind/pivot modes
• Azure Blob Storage - dead-drop transport via Azure Blob Storage; the agent only connects to *.blob.core.windows.net:443, never directly to the C2
• GitLab - dead-drop transport via the GitLab Repository Files API; the agent only connects to gitlab.com:443 (or a self-hosted instance), never directly to the C2
• Multi-hop pivoting - chain multiple Linux TCP bind agents through any parent transport (HTTPS, TCP Connect, Azure, GitLab)
• Multi-architecture - x86_64 and ARM64
• AES-128-CBC encryption - all frames encrypted end-to-end
• SOCKS4/5 proxy and reverse port forwarding via Adaptix tunnel system
• BOF execution - In-memory execution of C object files (.o) with full Beacon-compatible API
• Asynchronous BOFs - background execution via threading, cooperative cancellation, and job management
• OPSEC - anti-debug, anti-VM, and self-destruct capabilities (compile-time optional)
• Sleep Obfuscation - Sensitive data only (Transport HTTPS)
• Proxy-aware - auto-detects system HTTP proxy and tunnels through HTTP CONNECT with Basic auth support
• Stub packer - ELF agent wrapped in encrypted loader, fileless execution via O_TMPFILE + execveat, kernel keyring, or memfd_create fallback
• .rodata encryption - XOR-encrypted string table for .so builds, decrypted at load time
• Configurable pre-profile - GET/POST URIs, headers and User-Agent set per listener

Quick Start

Prerequisites

Install all build dependencies (x64 + ARM64 cross-compilation) by running:

bash install-dep.sh

Deploy

From the root of the Adaptix repository

./dist/axtool adaptix.spec ext install /path/to/NaxDarks [-f] [-d]

Commands

Command	Description
whoami	Show current user, UID, GID
pwd	Print current working directory
env	Print environment variables
cd	Change working directory
ls	List directory contents
cat	Read file contents
mkdir	Create directory
rmdir	Remove empty directory
rm	Delete file
download	Download file from target (Async)
download_cancel	Cancel an active download by task ID
upload	Upload file to agent machine
shell	Execute via /bin/sh -c
ps	List running processes
kill	Kill process by PID
ifconfig	Show network interfaces
zip	Compress file or directory into ZIP
sleep	Set beacon sleep interval in seconds (HTTPS and TCP connect-out)
bof	Execute an ELF BOF (.o file) in-memory
exit	Terminate the agent
socks	Manage SOCKS proxy tunnel
rportfwd	Manage reverse port forwarding
link	Link to a child Linux pivot agent via TCP
unlink	Disconnect a linked pivot agent
bof_async	Execute an ELF BOF in background thread
jobs	List running async BOF jobs
jobkill	Stop a running async BOF job
profile_update	Update HTTPS malleable profile at runtime

BOFs

You can find a collection of more than 20 BOFs at linux-bof.

1. Clone the repository
2. compile the BOFs
3. load the bof.axs script into Adaptix.

Transports

HTTPS

Full malleable C2 profile v2 support — configurable encoding, URI and host rotation, sleep and jitter. The profile is received dynamically from the server on the first connection.

TCP Connect-out

Direct connection to the Adaptix Linux TCP listener. TLS 1.2+ encrypted via OpenSSL. Configurable sleep and jitter — set to 0 for interactive use (SOCKS tunnels).

TCP Bind (Pivot)

The agent listens on a local port, allowing a parent agent to connect inbound. Supports pivot chains of arbitrary depth. All child traffic is relayed by the parent during its normal beacon cycle.

Azure Blob Storage

Dead-drop transport. The agent uploads check-ins (c_*.dat) and results (r_*.dat) to an Azure Blob Storage container and polls for responses from the same container. The C2 listener polls the container independently. The agent never establishes a connection to the C2 — all traffic goes to *.blob.core.windows.net:443.

A container-scoped SAS token (90-day validity, rwdl permissions) is auto-generated at listener creation and compiled into the agent. The storage account name, container name, and SAS token are embedded using per-byte volatile write macros so they do not appear as strings in the binary.

GitLab

Dead-drop transport using the GitLab Repository Files API. The agent commits check-in and result files to a branch in a GitLab repository; the C2 listener polls the same repository via the API. The agent never connects to the C2 — all traffic goes to gitlab.com:443 (or a configured self-hosted instance).

Because GitLab serializes commits per branch, the agent enforces a per-cycle limit on the number of files uploaded to avoid commit conflicts. Conflicts are retried automatically with backoff. The access token, project ID, and URL are embedded using per-byte volatile write macros.

---

Warning:

Not all implemented techniques represent the best choice for robust OPSEC; feel free to keep your version private or submit a PR to help improve the agent's OPSEC level.

---

Disclaimer

For authorized security research, penetration testing, red team operations, and security tooling development only. Use only on systems where you have explicit authorization.

---

Acknowledgments

• Adaptix Framework -- C2 framework
• Agent NoNameAx -- Windows Agent (Adaptix framework)
• Agent Darks -- Linux Agent (Mythic framework)