its-a-feature
42e98b1d7c
added JSON output for reports and updated RPC calls to allow updating of callback process_name
Mythic
A cross-platform, post-exploit, red teaming framework built with GoLang, docker, docker-compose, and a web browser UI. It's designed to provide a collaborative and user friendly interface for operators, managers, and reporting throughout red teaming.
Starting Mythic
Mythic is controlled via the mythic-cli binary. To generate the binary, run sudo make from the main Mythic directory.
From there, you can run sudo ./mythic-cli start to bring up all default Mythic containers.
Details
-
Check out a series of YouTube videos showing how Mythic looks/works and highlighting a few key features
-
Check out the blog post on the rebranding.
-
BSides Seattle 2019 Slides: Ready Player 2: Multiplayer Red Teaming against macOS
-
BSides Seattle 2019 Demo Videos: Available on my Youtube
-
Objective By the Sea 2019 talk on JXA: https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf
-
Objective By the sea 2019 Video: https://www.youtube.com/watch?v=E-QEsGsq3uI&list=PLliknDIoYszvTDaWyTh6SYiTccmwOsws8&index=17
-
Current Version is found in the VERSION file
Installing Agents and C2 Profiles
The Mythic repository itself does not host any Payload Types or any C2 Profiles. Instead, Mythic provides a command, ./mythic-cli install github <url> [branch name] [-f], that can be used to install agents into a current Mythic instance.
Payload Types are hosted on the MythicAgents organization and C2 Profiles are hosted on the MythiC2Profiles organization.
To install an agent, simply run the script and provide an argument of the path to the agent on GitHub:
sudo ./mythic-cli install github https://github.com/MythicAgents/apfell
The same is true for installing C2 Profiles:
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http
This is a slight departure from previous Mythic versions which included a few default Payload Types and C2 Profiles within this repository. This change allows the agents and c2 profiles to be updated at a much more regular pace and finally separates out the Mythic Core components from the rest of Mythic.
Mythic Container Configurations & PyPi Packages
Mythic uses Docker and Docker-compose for all of its components, which allows Mythic to provide a wide range of components and features without having requirements exist on the host. However, it can be helpful to have insight into how the containers are configured. All of Mythic's docker containers are hosted on DockerHub under itsafeaturemythic.
Additionally, Mythic uses a custom PyPi package (mythic_container) and a custom Golang package (https://github.com/MythicMeta/MythicContainer) to help control and sync information between all of the containers as well as providing an easy way to script access to the server.
All of this can be found on the MythicMeta:
- PyPi source code for all packages uploaded to PyPi
- Scripting source code
Current Container PyPi Package requirements
The current PyPi package for Mythic v3.0.0 is mythic_container==0.2.0-rc1.
Current Container Golang Package requirements
The current Golang package for Mythic v3.0.0 is at github.com/MythicMeta/MythicContainer
Documentation
All documentation for the Mythic project is being maintained on the docs.mythic-c2.net website.
Contributions
A bunch of people have suffered through bug reports, changes, and fixes to help make this project better. Thank you!
The following people have contributed a lot to the project. As you see their handles throughout the project on Payload Types and C2 Profiles, be sure to reach out to them for help and contributions:
Sponsors
Mythic is very fortunate that the following people/corporations have sponsored the continued development efforts of Mythic at the $20+/month rate:
- Matthew Conway (@mattreduce): April 2022 - Present
Liability
This is an open source project meant to be used with authorization to assess the security posture and for research purposes.