RTFMv2.DropBox: A Persistent Foothold for Field Engagements

Physical and field engagements often need a quiet, persistent foothold on the target network long after the assessor has left the building. RTFMv2.DropBox is that foothold: a lightweight runtime designed to be dropped on-site and managed remotely rather than re-visited by hand.

The companion DropBox Editor drives provisioning through a concrete, code-defined tool catalog: ToolEntry.CreateDefaults() ships a default loadout of fourteen tools -- nmap, NetExec, bloodhound.py, Certipy, Impacket, Responder, Chisel, ligolo-ng, proxychains, Bettercap, mitmproxy, tshark, tcpdump, and the rtfm-console itself -- each tagged with a category and a "noisy" flag so operators can reason about a node's detection footprint before it ever gets deployed. That is a deliberately curated field loadout, not a grab-bag of everything the framework can install.

RTFMv2 Build Studio, the product's build-orchestration tool, treats DropBox as its own build target with a dedicated pipeline, and its remote deployment layer is built on SSH.NET for pushing artifacts and running install commands on remote hosts -- the same library-backed approach used for RTFMv2's other remote-deploy workflows. Once live, a DropBox node is meant to behave as a natural extension of the rest of the RTFMv2 ecosystem: reachable, auditable, and ready to receive tasking the same way any other session would be.