Credential Management

Credential Types

#

Adding Credentials

#

CLI (Recommended for Interactive Use)

#

1
2
3
4
5
6

tantoc2[eng]> creds add \
    --type plaintext \
    --username alice \
    --secret P@ssw0rd! \
    --domain CORP \
    --notes "Found in /etc/shadow on webserver-01"

Required fields: --type, --username, --secret

Optional fields: --domain, --notes

Tip: For SSH keys, pass the private key file contents as --secret. In bash:

1
2
3
4
5

# Read key from file and pass as argument
tantoc2[eng]> creds add \
    --type ssh_key \
    --username root \
    --secret "$(cat ~/.ssh/id_rsa)"

Web UI

#

Credentials page > “Add Credential” > fill in the form > click “Create”.

The type dropdown is populated from the server, so it always reflects the supported types.

Listing Credentials

#

1

tantoc2[eng]> creds list

Output columns: ID (truncated), Type, Username, Domain, Source.

The source column shows which module extracted the credential (for auto-extracted credentials) or the operator username (for manually added ones).

Web UI: Credentials page — table with all credentials. Secrets are hidden by default. Click the eye icon to reveal (triggers a server request — the secret is decrypted and returned over TLS, never stored in the browser).

Searching and Filtering

#

CLI

#

1
2
3
4

tantoc2[eng]> creds search --type plaintext
tantoc2[eng]> creds search --username alice
tantoc2[eng]> creds search --domain CORP
tantoc2[eng]> creds search --type hash --domain CORP

Multiple filters are applied with AND semantics.

Web UI

#

The Credentials page has two filter controls:

• Text search: Searches across username, domain, source module, and notes
• Type dropdown: Filter by credential type

Both filters are applied simultaneously. A count indicator shows how many credentials match.

Exporting Credentials

#

CLI

#

1
2
3

tantoc2[eng]> creds export --format json
tantoc2[eng]> creds export --format csv
tantoc2[eng]> creds export --format hashcat

Output is printed to stdout. Redirect to a file:

1
2
3
4

# In the interactive shell this does not work directly — use JSON mode
tantoc2-cli --url https://teamserver:8443 --json-mode <<'EOF'
creds export --format hashcat
EOF

Or from outside the shell:

1
2

curl -X GET "https://teamserver:8443/api/v1/credentials/export?format=hashcat" \
  -H "Authorization: Bearer $TOKEN" > hashes.txt

Web UI

#

Credentials page > export dropdown in the header. Select a format. The browser downloads the file directly.

Export Formats

#

Auto-Extracted Credentials

#

When a module returns credential data (e.g., a hash-dump module), the teamserver automatically parses the result and adds the credentials to the store with full provenance:

• Source agent — which agent the credential came from
• Source module — which module extracted it
• Timestamp — when it was extracted

These appear in creds list with the source set to the module name (e.g., hashdump) rather than an operator username.

Using Credentials with Tools

#

Credentials stored in the store can be used directly by tools modules — no need to pass secrets on the command line.

Find the credential:

1

tantoc2[eng]> creds search --username alice

Note the credential ID (first column in the output).

Set it in the tools shell:

1

ssh_command> set cred <credential-id>

The teamserver decrypts the credential and passes it to the tool plugin automatically. The plaintext secret is never logged or exposed to the operator.

Web UI: In the Tools page, select a credential from the credential picker dropdown when configuring a tool operation.

Security Model

#

All credential secrets are encrypted at rest using the engagement’s master key:

1. The engagement passphrase (provided at creation) is processed through PBKDF2 to derive the master key
2. Each credential’s secret is encrypted with AES-256-GCM using the master key
3. The master key is never stored in the database — it is derived on demand from the passphrase

This means:

• Credential data at rest is unreadable without the engagement passphrase
• The passphrase is never stored — if you lose it, secrets cannot be recovered
• Even with full database access, an attacker cannot read credential secrets without the passphrase

When archiving: The archive file is encrypted with the same passphrase. Store archives and passphrases separately.

Credential Management by Role

#

Spectators and collectors can view the credential list and reveal secrets. They cannot add, delete, or export credentials.

Quick Reference

#

Common Mistakes

#

Wrong type for SSH keys — Use --type ssh_key, not --type plaintext. The tools module uses the type to determine the authentication method.

Hashcat export is empty — Only hash-type credentials appear in hashcat format. Check your credentials have type hash and not plaintext.

Forgot the credential ID — Run creds search --username <name> to find it. IDs are UUIDs — tab completion in the tools shell will also suggest them after set cred .

Lost the engagement passphrase — Credential secrets cannot be recovered without it. Write it down somewhere secure at engagement creation.

Related Pages

#

• Tools (Agentless Operations) — using credentials with SSH and other tools
• Engagement Workflow — where credential collection fits
• Security Model — cryptographic details