Mythic

https://docs.mythic-c2.net/
Admin
Mythic is a cross-platform, multiplayer command and control framework for red teaming operations...
Tokens:11,709
Snippets:152
Trust Score:5.5
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install basic_logger via Mythic CLI

Source: https://docs.mythic-c2.net/installation

Use this command to install the basic_logger profile from its GitHub repository.

```bash
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/basic_logger
```

--------------------------------

### Install Agents via CLI

Source: https://docs.mythic-c2.net/installation

Command syntax for installing agents from remote repositories.

```bash
./mythic-cli install github <url> [branch] [-f]
```

--------------------------------

### Install Mythic Agents or C2 Profiles

Source: https://docs.mythic-c2.net/installation

Installs a Payload Type or C2 Profile from a GitHub repository URL.

```bash
sudo ./mythic-cli install github <url>
```

--------------------------------

### Mythic service status output

Source: https://docs.mythic-c2.net/installation

Example output showing the status, ports, and health of Mythic services and containers.

```text
MYTHIC SERVICE		WEB ADDRESS		BOUND LOCALLY
Nginx (Mythic Web UI)	https://127.0.0.1:7443	 false
Mythic Backend Server	http://127.0.0.1:17443	 false
Hasura GraphQL Console	http://127.0.0.1:8080	 true
Jupyter Console		http://127.0.0.1:8888	 true
Internal Documentation	http://127.0.0.1:8090	 true

ADDITIONAL SERVICES	IP			PORT	BOUND LOCALLY
Postgres Database	127.0.0.1		5432	 false
React Server		192.168.53.152		3000	 true
RabbitMQ		127.0.0.1		5672	 false


Mythic Main Services
CONTAINER NAME		STATE		STATUS					PORTS
mythic_documentation	running		Up 38 seconds (healthy)			8090/tcp -> 127.0.0.1:8090
mythic_graphql		running		Up 36 seconds (healthy)			8080/tcp -> 127.0.0.1:8080
mythic_jupyter		running		Up 41 seconds (healthy)			8888/tcp -> 127.0.0.1:8888
mythic_nginx		running		Up 35 seconds (healthy)			7443/tcp -> :::7443, 7443
mythic_postgres		running		Up 39 seconds (healthy)			5432/tcp -> :::5432, 5432
mythic_rabbitmq		running		Up 40 seconds (health: starting)	5672/tcp -> :::5672, 5672
mythic_server		running		Up 37 seconds (health: starting)	7000/tcp -> :::7000, 7001/tcp -> :::7001, 7002/tcp -> :::7002, 7003/tcp -> :::7003, 7004/tcp -> :::7004, 7005/tcp -> :::7005, 7006/tcp -> :::7006, 7007/tcp -> :::7007, 7008/tcp -> :::7008, 7009/tcp -> :::7009, 7010/tcp -> :::7010, 17443/tcp -> :::17443, 17444/tcp -> :::17444, 7000, 7001, 7002, 7003, 7004, 7005, 7006, 7007, 7008, 7009, 7010, 17443, 17444

Installed Services
CONTAINER NAME		STATE		STATUS		PORTS
no_translator		running		Up 43 seconds
service_wrapper		running		Up 42 seconds
```

--------------------------------

### Configure Nginx IPv4/IPv6 settings

Source: https://docs.mythic-c2.net/installation

Modify these environment variables in the .env file if Nginx fails to start due to protocol support issues.

```text
NGINX_USE_IPV4="true"
NGINX_USE_IPV6="false"
```

--------------------------------

### Build the mythic-cli binary

Source: https://docs.mythic-c2.net/installation

Compile the CLI tool from the main Mythic directory. Use the specific command for Linux or macOS.

```bash
sudo make
```

```bash
sudo make macos
```

--------------------------------

### View Mythic CLI Help

Source: https://docs.mythic-c2.net/installation

Displays the available commands and usage information for the mythic-cli binary.

```text
Mythic CLI is a command line interface for managing the Mythic application and associated containers and services.
Commands are grouped by their use and all support '-h' for help.
For a list of available services to install, check out: https://mythicmeta.github.io/overview/

Usage:
  mythic-cli [command]

Available Commands:
  add              Add local service folder to docker compose
  backup           Backup various volumes/data to a custom location on disk
  build            Build/rebuild a specific container
  build_ui         Build/rebuild the React UI
  completion       Generate the autocompletion script for the specified shell
  config           Display or adjust the configuration
  database         Interact with the database
  health           Check health status of containers
  help             Help about any command
  install          Install services via git or local folders
  load             Load tar versions of Mythic images from ./saved_images/mythic_save.tar
  logs             Get docker logs from a running service
  mythic_sync      Install/Uninstall mythic_sync
  rabbitmq         Interact with the rabbitmq service
  remove           Remove local service folder from docker compose
  remove_container Remove running or exited containers
  restart          Start all of Mythic
  restore          Restore various volumes/data from a custom location on disk
  save             Save tar versions of the specified container's images
  services         List out installed services
  start            Start Mythic containers
  status           Get current Mythic container status
  stop             Stop all of Mythic
  test             Test mythic service connections
  uninstall        uninstall services locally and remove them from disk
  update           Check for Mythic updates
  version          Print information about the mythic-cli and Mythic versions
  volume           Interact with the mythic volumes

Flags:
  -h, --help   help for mythic-cli

Use "mythic-cli [command] --help" for more information about a command.
```

--------------------------------

### Mythic Configuration Environment Variables

Source: https://docs.mythic-c2.net/installation

The configuration file defines settings for various services including database, messaging, and web interfaces. Ensure sensitive fields like passwords and secrets are updated before initial deployment.

```bash
ALLOWED_IP_BLOCKS="0.0.0.0/0,::/0"
COMPOSE_PROJECT_NAME="mythic"
DEBUG_LEVEL="debug"
DEFAULT_OPERATION_NAME="Operation Chimera"
DEFAULT_OPERATION_WEBHOOK_CHANNEL=
DEFAULT_OPERATION_WEBHOOK_URL=
DOCUMENTATION_BIND_LOCALHOST_ONLY="true"
DOCUMENTATION_HOST="mythic_documentation"
DOCUMENTATION_PORT="8090"
DOCUMENTATION_USE_BUILD_CONTEXT="false"
DOCUMENTATION_USE_VOLUME="true"
GLOBAL_DOCKER_LATEST="v0.0.3"
GLOBAL_MANAGER="docker"
GLOBAL_SERVER_NAME="mythic"
HASURA_BIND_LOCALHOST_ONLY="true"
HASURA_CPUS="2"
HASURA_EXPERIMENTAL_FEATURES="streaming_subscriptions"
HASURA_HOST="mythic_graphql"
HASURA_MEM_LIMIT="2gb"
HASURA_PORT="8080"
HASURA_SECRET="random password"
HASURA_USE_BUILD_CONTEXT="false"
HASURA_USE_VOLUME="true"
INSTALLED_SERVICE_CPUS="1"
INSTALLED_SERVICE_MEM_LIMIT=
JUPYTER_BIND_LOCALHOST_ONLY="true"
JUPYTER_CPUS="2"
JUPYTER_HOST="mythic_jupyter"
JUPYTER_MEM_LIMIT=
JUPYTER_PORT="8888"
JUPYTER_TOKEN="mythic"
JUPYTER_USE_BUILD_CONTEXT="false"
JUPYTER_USE_VOLUME="true"
JWT_SECRET="random password"
MYTHIC_ADMIN_PASSWORD="random password"
MYTHIC_ADMIN_USER="mythic_admin"
MYTHIC_API_KEY=
MYTHIC_DEBUG_AGENT_MESSAGE="false"
MYTHIC_REACT_BIND_LOCALHOST_ONLY="true"
MYTHIC_REACT_DEBUG="false"
MYTHIC_REACT_HOST="mythic_react"
MYTHIC_REACT_PORT="3000"
MYTHIC_REACT_USE_BUILD_CONTEXT="false"
MYTHIC_REACT_USE_VOLUME="true"
MYTHIC_SERVER_BIND_LOCALHOST_ONLY="true"
MYTHIC_SERVER_COMMAND=
MYTHIC_SERVER_CPUS="2"
MYTHIC_SERVER_DYNAMIC_PORTS="7000-7010,1080"
MYTHIC_SERVER_DYNAMIC_PORTS_BIND_LOCALHOST_ONLY="false"
MYTHIC_SERVER_GRPC_PORT="17444"
MYTHIC_SERVER_HOST="mythic_server"
MYTHIC_SERVER_MEM_LIMIT=
MYTHIC_SERVER_PORT="17443"
MYTHIC_SERVER_USE_BUILD_CONTEXT="false"
MYTHIC_SERVER_USE_VOLUME="true"
MYTHIC_SYNC_CPUS="2"
MYTHIC_SYNC_MEM_LIMIT=
NGINX_BIND_LOCALHOST_ONLY="false"
NGINX_HOST="mythic_nginx"
NGINX_PORT="7443"
NGINX_USE_BUILD_CONTEXT="false"
NGINX_USE_IPV4="true"
NGINX_USE_IPV6="false"
NGINX_USE_SSL="true"
NGINX_USE_VOLUME="true"
POSTGRES_BIND_LOCALHOST_ONLY="false"
POSTGRES_CPUS="2"
POSTGRES_DB="mythic_db"
POSTGRES_DEBUG="false"
POSTGRES_HOST="mythic_postgres"
POSTGRES_MEM_LIMIT=
POSTGRES_PASSWORD="random password"
POSTGRES_PORT="5432"
POSTGRES_USE_BUILD_CONTEXT="false"
POSTGRES_USE_VOLUME="true"
POSTGRES_USER="mythic_user"
RABBITMQ_BIND_LOCALHOST_ONLY="true"
RABBITMQ_CPUS="2"
RABBITMQ_HOST="mythic_rabbitmq"
RABBITMQ_MEM_LIMIT=
RABBITMQ_PASSWORD="random password"
RABBITMQ_PORT="5672"
RABBITMQ_USE_BUILD_CONTEXT="false"
RABBITMQ_USE_VOLUME="true"
RABBITMQ_USER="mythic_user"
RABBITMQ_VHOST="mythic_vhost"
REBUILD_ON_START="true"
WEBHOOK_DEFAULT_ALERT_CHANNEL=
WEBHOOK_DEFAULT_CALLBACK_CHANNEL=
WEBHOOK_DEFAULT_CUSTOM_CHANNEL=
WEBHOOK_DEFAULT_FEEDBACK_CHANNEL=
WEBHOOK_DEFAULT_STARTUP_CHANNEL=
WEBHOOK_DEFAULT_URL=
```

--------------------------------

### Clone the Mythic repository

Source: https://docs.mythic-c2.net/installation

Download the Mythic source code from GitHub using git.

```bash
$ git clone https://github.com/its-a-feature/Mythic --depth 1 --single-branch
```

--------------------------------

### Manage Mythic Service Lifecycle

Source: https://docs.mythic-c2.net/installation

Commands to control the Mythic service state.

```bash
sudo ./mythic-cli stop
```

```bash
sudo ./mythic-cli start
```

```bash
sudo ./mythic-cli restart
```

--------------------------------

### Configure GitHub Actions for Agent Container Builds

Source: https://docs.mythic-c2.net/installation

A YAML workflow configuration for building and pushing agent container images to the GitHub Container Registry upon push or tag events.

```yaml
# Pulled from Thanatos (https://github.com/MythicAgents/thanatos/blob/rewrite/.github/workflows/image.yml) - MEhrn00

# Name for the Github actions workflow
name: Build and push container images

on:
  # Only run workflow when there is a new release published in Github
  #release:
  #  types: [published]
  push:
    branches:
      - 'master'
    tags:
      - "v*.*.*"

# Variables holding configuration settings
env:
  # Container registry the built container image will be pushed to
  REGISTRY: ghcr.io

  # Set the container image name to the Github repository name. (MythicAgents/apollo)
  AGENT_IMAGE_NAME: ${{ github.repository }}

  # Description label for the package in Github
  IMAGE_DESCRIPTION: ${{ github.repository }} container for use with Mythic

  # Source URL for the package in Github. This links the Github repository packages list
  # to this container image
  IMAGE_SOURCE: ${{ github.server_url }}/${{ github.repository }}

  # License for the container image
  IMAGE_LICENSE: BSD-3-Clause

  # Set the container image version to the Github release tag
  VERSION: ${{ github.ref_name }}
  #VERSION: ${{ github.event.head_commit.message }}

  RELEASE_BRANCH: master

jobs:
  # Builds the base container image and pushes it to the container registry
  agent_build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v4 # ref: https://github.com/marketplace/actions/checkout
      - name: Log in to the container registry
        uses: docker/login-action@v3 # ref: https://github.com/marketplace/actions/docker-login
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
        with:
          platforms: 'arm64,arm'
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v2
      # the following are unique to this job
      - name: Lowercase the server container image name
        run: echo "AGENT_IMAGE_NAME=${AGENT_IMAGE_NAME,,}" >> ${GITHUB_ENV}
      - name: Build and push the server container image
        uses: docker/build-push-action@v5 # ref: https://github.com/marketplace/actions/build-and-push-docker-images
        with:
          context: Payload_Type/apollo
          file: Payload_Type/apollo/Dockerfile
          tags: |
            ${{ env.REGISTRY }}/${{ env.AGENT_IMAGE_NAME }}:${{ env.VERSION }}
            ${{ env.REGISTRY }}/${{ env.AGENT_IMAGE_NAME }}:latest
          push: ${{ github.ref_type == 'tag' }}
          # These container metadata labels allow configuring the package in Github
          # packages. The source will link the package to this Github repository
          labels: |
            org.opencontainers.image.source=${{ env.IMAGE_SOURCE }}
            org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
            org.opencontainers.image.licenses=${{ env.IMAGE_LICENSE }}
          platforms: linux/amd64,linux/arm64

  update_files:
    runs-on: ubuntu-latest
    needs:
      - agent_build
    permissions:
      contents: write
      packages: write

    steps:
      # Pull in the repository code
      - name: Checkout the repository
        uses: actions/checkout@v4 # ref: https://github.com/marketplace/actions/checkout

      # update names to lowercase
      - name: Lowercase the container image name
        run: echo "AGENT_IMAGE_NAME=${AGENT_IMAGE_NAME,,}" >> ${GITHUB_ENV}

      - name: Update package.json version
        uses: jossef/action-set-json-field@v2.1
        with:
          file: config.json
          field: remote_images.apollo
          value: ${{env.REGISTRY}}/${{env.AGENT_IMAGE_NAME}}:${{env.VERSION}}
```

--------------------------------

### View container logs

Source: https://docs.mythic-c2.net/installation

Use this command to inspect logs for a specific container to troubleshoot errors.

```bash
sudo ./mythic-cli logs [container_name]
```

```bash
sudo ./mythic-cli logs mythic_server
```

```bash
sudo ./mythic-cli logs mythic_nginx
```

--------------------------------

### Rebuild Nginx container

Source: https://docs.mythic-c2.net/installation

Apply configuration changes by rebuilding the Nginx container.

```bash
sudo ./mythic-cli build mythic_nginx
```

--------------------------------

### Automate Dockerfile image reference updates with GitHub Actions

Source: https://docs.mythic-c2.net/installation

Use this workflow step to commit and push Dockerfile changes to a release branch during a tag event. Ensure the RELEASE_BRANCH and remote_images configuration are adjusted for your specific environment.

```yaml
- name: Push the updated base Dockerfile image reference changes
  if: ${{ github.ref_type == 'tag' }}
  uses: EndBug/add-and-commit@v9 # ref: https://github.com/marketplace/actions/add-commit
  with:
    # Only add the Dockerfile changes. Nothing else should have been modified
    add: "['config.json']"
    # Use the Github actions bot for the commit author
    default_author: github_actions
    committer_email: github-actions[bot]@users.noreply.github.com

    # Set the commit message
    message: "Bump Dockerfile tag to match release '${{ env.VERSION }}'"

    # Overwrite the current git tag with the new changes
    tag: '${{ env.VERSION }} --force'

    # Push the new changes with the tag overwriting the current one
    tag_push: '--force'

    # Push the commits to the branch marked as the release branch
    push: origin HEAD:${{ env.RELEASE_BRANCH }} --set-upstream

    # Have the workflow fail in case there are pathspec issues
    pathspec_error_handling: exitImmediately
```

--------------------------------

### Check Mythic container status

Source: https://docs.mythic-c2.net/installation

Execute this command to verify that all Mythic docker containers are running and healthy.

```bash
sudo ./mythic-cli status
```

--------------------------------

### Automate Dockerfile updates with GitHub Actions

Source: https://docs.mythic-c2.net/version-4.0/installation

Use this workflow step to commit and push Dockerfile changes and force-update git tags during a release.

```yaml
      # Push the changes to the Dockerfile
      - name: Push the updated base Dockerfile image reference changes
        if: ${{ github.ref_type == 'tag' }}
        uses: EndBug/add-and-commit@v9 # ref: https://github.com/marketplace/actions/add-commit
        with:
          # Only add the Dockerfile changes. Nothing else should have been modified
          add: "['config.json']"
          # Use the Github actions bot for the commit author
          default_author: github_actions
          committer_email: github-actions[bot]@users.noreply.github.com

          # Set the commit message
          message: "Bump Dockerfile tag to match release '${{ env.VERSION }}'"

          # Overwrite the current git tag with the new changes
          tag: '${{ env.VERSION }} --force'

          # Push the new changes with the tag overwriting the current one
          tag_push: '--force'

          # Push the commits to the branch marked as the release branch
          push: origin HEAD:${{ env.RELEASE_BRANCH }} --set-upstream

          # Have the workflow fail in case there are pathspec issues
          pathspec_error_handling: exitImmediately
```

--------------------------------

### Scripting and GraphQL

Source: https://docs.mythic-c2.net/llms.txt

Mythic 4.0 provides a GraphQL interface for automation and scripting. Users can authenticate and perform queries, mutations, and subscriptions to interact with the framework.

```APIDOC
## GraphQL API

### Description
The Mythic 4.0 GraphQL API allows for full automation of the C2 framework. Users can authenticate and execute queries, mutations, and subscriptions to manage agents, tasking, and reporting.

### Access
- **Endpoint**: /graphql
- **Authentication**: Required (Token-based)

### Tools
- **Hasura Console**: Available for exploring and testing GraphQL queries, mutations, and subscriptions.
- **Python Package**: A supported Python package is available for automating Mythic 4.0 interactions.
```

--------------------------------

### Authenticate with API Token

Source: https://docs.mythic-c2.net/scripting

Use the apitoken header to authenticate requests. The token value is validated against the Mythic database rather than checking expiration.

```http
apitoken: {tokenvalue}
```

--------------------------------

### Rebuild basic_logger profile

Source: https://docs.mythic-c2.net/installation

Execute this command after modifying the logger source code to apply changes.

```bash
sudo ./mythic-cli build basic_logger
```

--------------------------------

### List of Mythic Log Event Types

Source: https://docs.mythic-c2.net/installation

These event types are emitted to the RabbitMQ queue for logging purposes.

```text
file_upload (file staged on mythic as part of tasking with the intent to get sent to the agent)
file_manual_upload (file staged on mythic as part of a user manually hosting it)
file_screenshot (file is a screenshot from the agent)
file_download (file is downloaded from agent to mythic)
artifact_new (new artifact created - think IOC)
eventlog_new (new eventlog message)
eventlog_modified (eventlog was modified, like resolving an issue or changing their message)
payload_new (new payload created)
task_mitre_attack (a task was associated with a new mitre attack technique)
task_new (a new task was created)
task_completed (a task completed)
task_comment (somebody added/removed/edited a comment on a task)
credential_new (a new credential was added to the store)
credential_modified (a credential was modified)
response_new (a new response for the user to see)
keylog_new (a new keylog entry)
callback_new (new callback registered)
```

--------------------------------

### GraphQL API Authentication

Source: https://docs.mythic-c2.net/scripting

Authentication for the GraphQL API is handled via an 'apitoken' header. The token is validated against the Mythic database rather than checking expiration times.

```APIDOC
### Authentication

Authentication is performed by including an `apitoken` header in your request.

- **Header**: `apitoken`
- **Value**: `{tokenvalue}`

Note: API tokens do not expire based on the JWT expiration field; they remain valid until deactivated or deleted in the Mythic database.
```
Tokens:
Raw