Remote Agent (RTA / Jumpbox)¶
Some attack tooling (Responder, impacket, coercer, and other raw-network tools) has to run from inside the target network, not from the machine hosting your Raven server. The remote agent handles that: a small Go binary you deploy to a jumpbox (an RTA, or Remote Testing Agent) that runs jobs there and streams results back to your dashboard.
No AI required
The remote agent is part of the free framework and needs no AI credits. It orchestrates tools you run yourself, on hardware you control.
When you need it¶
Use a jumpbox when the tools must originate from a host with line-of-sight to the target segment: internal AD engagements, coercion/relay chains, or anything that needs a foothold on the client network. If your Raven host already reaches the targets directly, you don't need one.
Deploy from the dashboard¶
Open Agents & Tools in the web dashboard and deploy to a jumpbox:
- Agent deployment: Raven cross-compiles the agent for the jumpbox's architecture and uploads it over SSH automatically. You provide the jumpbox connection details once.
- Tool detection: on connect, the agent discovers which tools are present (responder, impacket, etc.) so the dashboard only offers what's actually installed.
- Real-time streaming: job output streams back over WebSocket as it runs.
- Credential capture: hashes parsed out of tool output are pulled into your Credentials Library automatically.
- Job management: start, stop, and monitor remote jobs from the same Jobs view as local ones.
Run the agent by hand¶
Deploying from the dashboard is the normal path. If you are placing the binary yourself (an air-gapped jumpbox, or a host you already have a shell on), the agent needs two things Raven does not guess for you:
The defaults now match. Both the agent and raven-server start use port
8080, and the agent dials 127.0.0.1 rather than localhost, so the
command above works as-is against a default server. If you started the server
on another port, pass it:
Use 127.0.0.1, not localhost, if you write the URL by hand. On a host
with IPv6 enabled, localhost resolves to ::1 while the server binds IPv4
127.0.0.1, so the agent gets connection refused even on the correct port.
The token is required. It is per-server, stored at ~/.raven/agent_token,
and printable with raven-server auth agent-token --raw. Read it as the user
running the server; if you sudo the agent, the token still has to come from
that user's home, as in the command above.
Jumpbox prerequisites¶
The jumpbox is a Linux host you can reach over SSH (configure host, username, and either an SSH key or password in Settings). Attack tools run on the jumpbox itself, so install them there. A setup script (agent/setup-rta-tools.sh) provisions the common set (impacket ≥ 0.12.0 for ntlmrelayx RPC relay support, Responder, coercer, and friends).
If the SSH key is passphrase-protected, load it into an ssh-agent the Raven server can reach before deploying; otherwise supply a password. See Troubleshooting if a deploy or connection fails.