The Watchlist is an interface to view logs, notifications and configurations. It displays multiple metadata of the server, badger, users and events to the user. The Watchlist is divided into multiple different categories.
Event Viewer displays notifications for new badgers, users, listener creation/deletion and any other modifications done to the server or the badger.
Last Web Activity shows the last interaction of any non-badger requests on the listener. This area will not show all the logs. It will show only the latest web activity seen on the server to notify the user about any latest scans/connects on the listener. For a detailed view of the server/listener logs, the operator can check Server->View Logs.
Scratchpad is a simple text editor which can be used to take some quick notes, or view logs, downloaded text files, C4 profiles and any other type of text files. It stores everything temporarily in memory. The first button View Server Configuration can be used to view the server’s current configuration or profile. It prints everything in JSON and can be copied to a local file to be used later as a profile in the Ratel mode.
The third button View PsExec Configuration displays the current configuration of the PsExec command. This configuration can be changed from C4 Profiler->PsExec Config.
Badgers are asynchronous in nature. Once a badger completes its sleep cycle, it will connect to the server to request all the tasks in queue, download the tasks, run the requested command and return a response next time it checks in. When a badger is in stasis, the commands are held in queue by the server. The Command Queue lists all the commands that are not yet retrieved by the badger. Once the commands are fetched by the badger, it is auto-removed from the server since they have served their purpose.
The operators tab shows the active and inactive operators. If you add a new operator from Operator->Add Operator menu, it won’t show up here till the operator actually logs in for the first time. Similarly, the operator won’t show up in the ‘Inactive Operators’ tab if the user is disconnected. It only shows up when the operator’s password is reset.
The chatbox can be used to communicate with other operators who have started the Chatbox Channel. The operators won’t get notifications if they are not connected inside the chatbox.
Statistics show a quick count of the badgers, pivots, privileged badgers, workstations, unique users compromised and the count of external IPs that the badger is connected from. The left part of the statistics show the last badger which checked in and when it checked in.