Mythic v3.0 releases: collaborative, multi-platform, red teaming framework

Mythic

Mythic is a multiplayer, command, and control platform for red teaming operations. It is designed to facilitate a plug-n-play architecture where new agents, communication channels, and modifications can happen on the fly. One of the Mythic project’s main goals is to provide quality of life improvements to operators, improve the maintainability of agents, enable customizations, and provide more robust data analytic capabilities to operations.

Fundamentally, Mythic uses a web-based front end and Docker containers for the back-end. A Python3 server handles the bulk of the web requests via RESTful APIs and WebSockets. This server then handles connections to the PostgreSQL database and communicates to the other Docker containers via RabbitMQ. This enables the individual components to be on separate physical computers or in different virtual machines if desired.

Data modeling, tracking, and analysis are core aspects of Mythic’s ability to provide quality of life improvements to operators. From the very beginning of creating a payload, Mythic tracks the specific command and control profile parameters used, the commands loaded into the payload and their versions, who created it, when, and why. All of this is used to provide a more coherent operational view when a new callback checks in. Simple questions such as “which payload triggered this callback”, “which callback created this new callback”, and even “why is there a new callback” now all have contextual data to give answers. From here, operators can start automatically tracking their footprints in the network for operational security (OpSec) concerns and to help with deconflictions. All agents and commands can track process creates, file writes, API calls, network connections, and more. These artifacts can be automatically recorded when the task is issued or even reported back by agents as they happen.

Mythic also incorporates MITRE ATT&CK mappings into the standard workflow. All commands can be tagged with ATT&CK techniques, which will propagate to the corresponding tasks issued as well. In a MITRE ATT&CK Matrix view (and ATT&CK Navigator view), operators can view coverage of possible commands as well as coverage of commands issued in an operation. Operators can also provide comments on each task as they operate to help make notes about why a task was important. Additionally, to make deconfliction and reporting easier, all commands, output, and comments can be globally searched through the main web interface.

Changelog v3.0

Changed

• Modified MythicRPCProxyStart to support rportfwd
• Updated Dockerfile build to user smaller base images and use multi-stage builds to reduce final size
• Docker images updated:
  • itsafeaturemythic/mythic_base_go <– go1.20 with garble and gRPC
  • itsafeaturemythic/mythic_base_python <– python 3.11 with the latest mythic_container PyPi package installed
  • itsafeaturemythic/mythic_go_dotnet <– mythic_go_base + .NET Core 7.0 SDK, nuget, and the Mono compiler
  • itsafeaturemythic/mythic_python_dotnet <– mythic_python_base + .NET Core 7.0 SDK, nuget, and the Mono compiler
  • itsafeaturemythic/mythic_go_macos <– mythic_go_base + macOS 12.1 SDK
  • itsafeaturemythic/mythic_python_macos <– mythic_python_base + macOS 12.1 SDK
  • All docker images now have a rolling :latest tag that can be used
  • All docker images (and mythic-cli builds) now work for ARM as well as x86_64
• Fixed an issue with additional attributes not getting captured for commands

Install & Use

Copyright (c) 2018, Cody Thomas
All rights reserved.