Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BOF Refactor, Windows Service and fixes #78

Closed

Conversation

martindube
Copy link

@martindube martindube commented Nov 17, 2024

Hello maintainers!

Here's a PR with fixes but also features. I'm not used to contribute so feel free to comment. I did my best to make commits in a cherry-pickable format.

Challenge with BOFs

I would like to start by sharing that I have only 1 week of experience with Athena and a few months with Mythic. I could have felt in a rabbit hole.

That being said, using the main branch of Athena and the associated container, no BOF were working. For reasons I do not fully understand, the "parent" task is never marked as completed. In addition, the subtask output is never sent to the parent task either. I don't know if this is a bug in Mythic but I found a "simple" way to fix it: Use completion callbacks. This is the commit refactor d36ac3d137d3c7e6de6c0546f0d7cc3775eb0096.

I read this documentation carefuly and I couldn't find a better way to fix this. In addition, the Mythic.execute approach was getting deprecated so I took time to modernize it.

Summary

Fixes:

  • Fix execute-assembly (missing double quote in a string) and other typos
  • fix(config): Print the right variable when setting config.debug
  • fix(nidhogg): Fix description (It was copied from env)
  • Ignore COFF binaries: .o and .bin
  • fix(inject-assembly): Add completion function. Standardize indent.

Features:

  • Add output type: Windows Service
  • Toggle debug mode and add LogManager.Debug()
  • Refactor BOFs
    • Replace MythicRPC().execute -> MythicRPC*
    • Move functions to bof_utilities
    • Use a new class: CoffCommandBase
    • Standardize the definition of process_response()
    • Use a default completion function

Refactor example

Before:

        resp = await MythicRPC().execute("create_subtask_group", tasks=[
            {"command": "coff", "params": {"coffFile":file_resp.response["agent_file_id"], "functionName":"go","arguments": encoded_args, "timeout":"60"}},
            ], 
            subtask_group_name = "coff", parent_task_id=taskData.Task.ID)

After:

        subtask = await SendMythicRPCTaskCreateSubtask(MythicRPCTaskCreateSubtaskMessage(
            taskData.Task.ID, 
            CommandName="coff",
            SubtaskCallbackFunction="coff_completion_callback",
            Params=json.dumps({
                "coffFile": file_resp.AgentFileId,
                "functionName": "go",
                "arguments": encoded_args,
                "timeout": "60",
            }),
            Token=taskData.Task.TokenID,
        ))

@martindube
Copy link
Author

Closing. We'll use #79 instead.

@martindube martindube closed this Nov 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants