Skip to content

Remote Agent (RTA / Jumpbox)

Some attack tooling — Responder, impacket, coercer, and other raw-network tools — has to run from inside the target network, not from the machine hosting your Raven server. The remote agent handles that: a small Go binary you deploy to a jumpbox (an RTA — Remote Testing Agent) that runs jobs there and streams results back to your dashboard.

Paid feature

The remote agent is a paid-tier capability. The local scanning toolchain runs without it — see Scanning.

When you need it

Use a jumpbox when the tools must originate from a host with line-of-sight to the target segment — internal AD engagements, coercion/relay chains, or anything that needs a foothold on the client network. If your Raven host already reaches the targets directly, you don't need one.

Deploy from the dashboard

Open Agents & Tools in the web dashboard and deploy to a jumpbox:

  • Agent deployment — Raven cross-compiles the agent for the jumpbox's architecture and uploads it over SSH automatically. You provide the jumpbox connection details once.
  • Tool detection — on connect, the agent discovers which tools are present (responder, impacket, etc.) so the dashboard only offers what's actually installed.
  • Real-time streaming — job output streams back over WebSocket as it runs.
  • Credential capture — hashes parsed out of tool output are pulled into your Credentials Library automatically.
  • Job management — start, stop, and monitor remote jobs from the same Jobs view as local ones.

Jumpbox prerequisites

The jumpbox is a Linux host you can reach over SSH (configure host, username, and either an SSH key or password in Settings). Attack tools run on the jumpbox itself, so install them there — a setup script (agent/setup-rta-tools.sh) provisions the common set (impacket ≥ 0.12.0 for ntlmrelayx RPC relay support, Responder, coercer, and friends).

If the SSH key is passphrase-protected, load it into an ssh-agent the Raven server can reach before deploying; otherwise supply a password. See Troubleshooting if a deploy or connection fails.