Offensive Security Tool: Mythic

Reading Time: 2 Minutes

Description

A cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI. It’s designed to provide a collaborative and user friendly interface for operators, managers, and reporting throughout red teaming.

Mythic is written by Cody Thomas and its a highly flexible and customizable open-source command-and-control (C2) framework that is designed to be used by red teamers and penetration testers. The framework provides a comprehensive platform for managing and controlling remote agents that can be used to perform various tasks, such as reconnaissance, exploitation, and post-exploitation activities.

Mythic’s server component manages the communication between the C2 server and remote agents, while the client component provides an intuitive user interface for interacting with and managing the agents. With support for a variety of agent types, including Windows, Linux, and macOS, Mythic provides a powerful and versatile tool for managing remote systems.

One of the key features of Mythic is its modularity and extensibility. Security professionals can easily customize and extend the framework to meet their specific needs. The framework also supports integration with a wide range of other tools and technologies commonly used in the security industry, making it an ideal platform for integrating and managing security testing and research activities.

Mythic’s ability to deploy new agents, interact with existing agents in real-time, and execute commands and scripts on remote systems makes it a valuable tool for managing and controlling remote systems for a wide range of security testing and research purposes.

Details

• Check out a series of YouTube videos showing how Mythic looks/works and highlighting a few key features
• Check out the blog post on the rebranding.
• BSides Seattle 2019 Slides: Ready Player 2: Multiplayer Red Teaming against macOS
• BSides Seattle 2019 Demo Videos
• Objective By the Sea 2019 talk on JXA: https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf
• Objective By the sea 2019 Video
• Current Version is found in the VERSION file

Installing Agents and C2 Profiles

The Mythic repository itself does not host any Payload Types or any C2 Profiles. Instead, Mythic provides a command, ./mythic-cli install github <url> [branch name] [-f], that can be used to install agents into a current Mythic instance.

Payload Types are hosted on the MythicAgents organization and C2 Profiles are hosted on the MythicC2Profiles organization.

To install an agent, simply run the script and provide an argument of the path to the agent on GitHub:

sudo ./mythic-cli install github https://github.com/MythicAgents/apfell

The same is true for installing C2 Profiles:

sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http

This is a slight departure from previous Mythic versions which included a few default Payload Types and C2 Profiles within this repository. This change allows the agents and c2 profiles to be updated at a much more regular pace and finally separates out the Mythic Core components from the rest of Mythic.

Mythic Container Configurations & PyPi Packages

Mythic uses Docker and Docker-compose for all of its components, which allows Mythic to provide a wide range of components and features without having requirements exist on the host. However, it can be helpful to have insight into how the containers are configured. All of Mythic’s docker containers are hosted on DockerHub under itsafeaturemythic.

Additionally, Mythic uses a number of custom PyPi packages to help control and sync information between all of the containers as well as providing an easy way to script access to the server.

All of this can be found on the MythicMeta:

• Dockerfile configurations for all Docker images uploaded to DockerHub
• PyPi source code for all packages uploaded to PyPi
• Scripting source code

Current Container PyPi Package requirements

Supported payload types must have the mythic_payloadtype_container PyPi package of 0.0.43.

• The Payload Type container reports this as version 7.

Supported c2 profiles must have the mythic_c2_container PyPi package of 0.0.22.

• The C2 Profile container reports this as version 3.

Supported translation containers must have the mythic_translator_containter PyPi package of 0.0.10.

• The Translator container reports this as version 3.

Documentation

All documentation for the Mythic project is being maintained on the docs.mythic-c2.net website.

Clone the repo from here: GitHub Link