Getting Started with Sentrava C2
Authorized security testing only.
Use Sentrava only within a documented authorization boundary. Keep test databases, PKI, and credentials separate from any existing installation.
Sentrava C2 is a command-and-control framework for authorized red team operations. It provides a gRPC-based teamserver with mTLS operator authentication, an operator CLI, a web dashboard, and a configurable agent binary that embeds its credentials at compile time.
Architecture
The framework has four components that operate together:
| Component | Binary | Role |
|---|---|---|
| Teamserver | sentrava-server |
Hosts gRPC operator API, HTTPS dashboard, and agent listeners |
| Operator CLI | sentrava-client |
Interactive REPL for managing operations, agents, and sessions |
| Agent | sentrava-agent |
Implant binary deployed on the target; connects back to the teamserver |
| Dashboard | dashboard/dist/ |
Web frontend served by the teamserver's HTTPS listener |
Transport options
Three transport layers are supported:
- mTLS (default) — mutual TLS; the agent's certificate is embedded at build time and validated against server enrollment records
- TCP — AES-256-GCM encrypted TCP; a shared key is embedded at build time
- HTTP — AES-256-GCM encrypted HTTP polling with C2 profile masquerading
- DNS — AES-256-GCM encrypted DNS TXT-record tunnelling; highest firewall evasion, lowest bandwidth
Supported platforms
- Server and operator CLI: Linux/amd64
- Agent (Linux): Linux/amd64 — fully supported, all capabilities available
- Agent (Windows): Windows/amd64 — all four transports (mTLS, TCP, HTTP, DNS); interactive shell not available; Windows OPSEC stack available via
--win-opsec
How an operation works
- Start the teamserver; it initializes its PKI and SQLite database on first run.
- Connect with the operator CLI and create an operation with a target scope.
- Generate an agent package — the CLI compiles and signs an agent binary with embedded credentials.
- Deploy the agent binary to the target.
- The agent connects back; the server verifies enrollment; a session appears in the CLI.
- Run tasks against the session:
whoami,shell,ps,portfwd, and more.
Next steps
- Installation — build requirements and steps
- Quick start — get a session in five minutes
- mTLS transport — enrollment and certificate binding detail
- Windows OPSEC — ETW, AMSI, NTDLL unhooking, indirect syscalls, Kill Date, Working Hours