wiki created

2025-11-06 12:23:49 +01:00
parent 6cd3511962
commit 2fe9fa8254
60 changed files with 5012 additions and 142 deletions
@@ -0,0 +1,356 @@
+++ 
+title = "Getting started" 
+chapter = false 
+weight = 10 
+pre = "1. " 
+++
+
+# Getting Started with Cazalla
+
+This guide will help you install, configure, and deploy your first Cazalla agent.
+
+## 📋 Prerequisites
+
+- **Mythic Server** (v3.x or later) installed and running
+- Docker installed and running (for building the agent)
+- Access to a Windows target for testing
+- Basic understanding of Mythic C2 Framework
+
+## 🚀 Installation
+
+### Step 1: Install Cazalla on Mythic
+
+#### Option A: Install from GitHub (if available)
+
+```bash
+cd ~/Mythic
+./mythic-cli install github https://github.com/<your-org>/Cazalla
+```
+
+#### Option B: Install from Local Directory
+
+```bash
+cd ~/Mythic
+./mythic-cli install folder /path/to/Cazalla
+```
+
+After installation, Mythic will build the Cazalla container automatically.
+
+### Step 2: Verify Installation
+
+Check that Cazalla is installed:
+
+```bash
+cd ~/Mythic
+./mythic-cli list
+```
+
+You should see `cazalla` in the list of installed payload types.
+
+### Step 3: Build Your First Payload
+
+1. **Navigate to Mythic UI**
+   - Open your browser and go to your Mythic server URL (typically `https://localhost:17443`)
+
+2. **Create a New Payload**
+   - Click on **Payloads** in the left sidebar
+   - Click **Create Payload** button
+   - Select **Cazalla** as the payload type
+
+3. **Configure Build Parameters**
+   - **C2 Profile**: Select your configured C2 profile (HTTP, HTTPS, etc.)
+   - **Callback Host**: Your Mythic server's IP address or domain
+   - **Callback Port**: Port for agent communication (default: 443)
+   - **Sleep**: Initial beacon interval in seconds (default: 10)
+   - **Jitter**: Random delay percentage (0-100, recommended: 10-30)
+   - **User Agent**: HTTP User-Agent string for HTTP(S) profiles
+
+4. **Optional: Enable Encryption**
+   - In the **AESPSK** parameter section:
+     - Set `crypto_type` to `aes256_hmac`
+     - Mythic will automatically generate an encryption key
+   - This provides end-to-end encryption beyond HTTPS
+
+5. **Build the Payload**
+   - Click the **Build** button
+   - Wait for the build to complete (this may take a few minutes)
+   - Once complete, download the generated `.exe` file
+
+## 🎯 Deploying the Agent
+
+### Step 1: Transfer to Target
+
+Transfer the compiled `.exe` file to your Windows target using any method:
+- USB drive
+- Network share
+- Email attachment
+- Web download
+- Etc.
+
+### Step 2: Execute on Target
+
+On the Windows target, execute the agent:
+
+```cmd
+C:\path\to\cazalla.exe
+```
+
+The agent will start beaconing to your Mythic server immediately.
+
+### Step 3: Verify Connection
+
+1. **Check Mythic UI**
+   - Navigate to **Callbacks** in the left sidebar
+   - You should see a new callback appear with:
+     - **Hostname**: The target machine's hostname
+     - **User**: The username running the agent
+     - **PID**: Process ID of the agent
+     - **Status**: Active (green indicator)
+
+2. **Check Agent Output** (if running interactively)
+   - The agent will output connection status
+   - Look for successful connection messages
+
+## ✅ First Commands
+
+Once your agent is connected, try these basic commands:
+
+### 1. Check Current Directory
+
+```
+pwd
+```
+
+This will show the current working directory of the agent.
+
+### 2. List Files
+
+```
+ls
+```
+
+Or list a specific directory:
+
+```
+ls C:\Users
+```
+
+### 3. Get System Information
+
+```
+ps
+```
+
+This lists all running processes and updates the Process Browser.
+
+```
+whoami
+```
+
+This shows the current security context (username and domain).
+
+### 4. Explore the File System
+
+```
+cd C:\Users
+ls
+cat desktop.ini
+```
+
+## 🔧 Configuration Options
+
+### Build Parameters
+
+When building a payload, you can configure:
+
+| Parameter | Description | Default | Notes |
+|-----------|-------------|---------|-------|
+| **Callback Host** | Mythic server address | Required | IP or domain |
+| **Callback Port** | C2 port | 443 | Must match C2 profile |
+| **Sleep** | Beacon interval (seconds) | 10 | Lower = more responsive, higher = more stealthy |
+| **Jitter** | Random delay (%) | 0 | 0-100, recommended 10-30 |
+| **User Agent** | HTTP User-Agent | Varies | For HTTP(S) profiles |
+| **AESPSK** | Encryption settings | Disabled | Optional end-to-end encryption |
+
+### Dynamic Configuration
+
+After deployment, you can change certain settings:
+
+#### Adjust Sleep Interval
+
+```
+sleep {"seconds":30,"jitter":10}
+```
+
+This changes the beacon interval to 30 seconds with 10% jitter.
+
+#### View Current Settings
+
+The agent tracks and reports:
+- Current working directory (via `pwd` or in UI context tabs)
+- Active token impersonation (via `whoami` or in UI context tabs)
+- Sleep interval (shown in callback details)
+
+## 🎨 Using the Mythic UI
+
+### Process Browser
+
+1. **Access Process Browser**
+   - Click **Process Browser** in the left sidebar
+   - Or use the process icon in the callback view
+
+2. **View Processes**
+   - All processes from all callbacks are displayed
+   - Use `ps` command to refresh the process list
+   - Click on processes to view details
+
+3. **Interact with Processes**
+   - **Kill**: Right-click → Kill Process
+   - **Steal Token**: Right-click → Steal Token
+   - **List Tokens**: Right-click → List Tokens
+
+### File Browser
+
+1. **Access File Browser**
+   - Click **File Browser** in the left sidebar
+   - Or use the file icon in the callback view
+
+2. **Navigate Files**
+   - Browse directories visually
+   - Click on files to download
+   - Right-click to upload files
+
+3. **File Operations**
+   - **Download**: Click file → Download
+   - **Upload**: Right-click directory → Upload
+   - **Delete**: Right-click file → Delete (uses `rm` command)
+
+### Context Tracking
+
+The Mythic UI automatically displays:
+- **Current Directory**: Shows in callback context tabs
+- **Impersonation Context**: Shows active token impersonation
+- **Process Context**: Shows active process information
+
+## 🔒 Security Considerations
+
+### OPSEC Checking
+
+Cazalla includes built-in OPSEC checking for high-risk operations:
+
+- **Pre-execution blocking**: Commands like `steal_token`, `shell`, `keylog_start` require approval
+- **Post-execution warnings**: Artifacts are automatically tracked
+- **Bypass roles**: Configured operators can bypass warnings
+
+When executing a risky command:
+1. You'll see an OPSEC warning popup
+2. Review the warning message
+3. Approve or cancel the operation
+4. Another operator may need to approve (if configured)
+
+See [OPSEC Guide](opsec.md) for detailed information.
+
+### Best Practices
+
+1. **Start with High Sleep Values**
+   - Use 30-60 seconds initially
+   - Reduce only when needed for interactive operations
+
+2. **Use Jitter**
+   - Add 10-30% jitter to avoid predictable patterns
+   - Helps evade timing-based detection
+
+3. **Monitor Artifacts**
+   - Check the **Artifacts** tab regularly
+   - Review what the agent is creating/accessing
+
+4. **Use Built-in Commands**
+   - Prefer Cazalla commands (`ps`, `ls`, `cat`) over `shell` when possible
+   - Built-in commands have better OPSEC
+
+5. **Review OPSEC Warnings**
+   - Always read OPSEC popup messages
+   - Understand risks before approving
+
+## 🐛 Troubleshooting
+
+### Agent Not Connecting
+
+1. **Check Network Connectivity**
+   - Verify target can reach Mythic server
+   - Test: `ping <mythic_server_ip>`
+   - Test: `curl https://<mythic_server>:443`
+
+2. **Check C2 Profile**
+   - Verify C2 profile is active
+   - Check that port matches callback configuration
+   - Review C2 profile logs
+
+3. **Check Agent Execution**
+   - Verify agent is running: `tasklist | findstr cazalla`
+   - Check for error messages in console
+   - Review Windows Event Logs
+
+4. **Check Mythic Logs**
+   ```bash
+   sudo docker logs mythic_server
+   sudo docker logs cazalla_translator
+   ```
+
+### Commands Not Working
+
+1. **Verify Agent is Active**
+   - Check callback status (should be green)
+   - Verify last check-in time
+
+2. **Check Command Syntax**
+   - Review command documentation in [Commands Reference](commands.md)
+   - Verify parameter format (JSON vs string)
+
+3. **Review Task Output**
+   - Check task output for error messages
+   - Look for specific error codes
+
+4. **Check Permissions**
+   - Some commands require specific permissions
+   - Use `whoami` to verify current context
+
+### Build Issues
+
+1. **Check Docker**
+   ```bash
+   sudo docker ps
+   sudo docker logs cazalla_translator
+   ```
+
+2. **Rebuild Container**
+   ```bash
+   cd ~/Mythic
+   sudo ./mythic-cli build cazalla
+   ```
+
+3. **Check Build Parameters**
+   - Verify all required parameters are set
+   - Check parameter format (JSON vs string)
+
+For more troubleshooting help, see [Troubleshooting Guide](troubleshooting.md).
+
+## 📚 Next Steps
+
+Now that you have a working agent:
+
+1. **Explore Commands**: See [Commands Reference](commands.md) for all available commands
+2. **Learn Features**: Read [Features Overview](features.md) for advanced capabilities
+3. **Understand OPSEC**: Review [OPSEC Guide](opsec.md) for security best practices
+4. **Try Examples**: Check [Usage Examples](examples.md) for practical scenarios
+
+## 🔗 Additional Resources
+
+- [Mythic Documentation](https://docs.mythic-c2.net/)
+- [Mythic Process Browser](https://docs.mythic-c2.net/customizing/hooking-features/process_list)
+- [Cazalla Main README](../README.md)
+
+---
+
+**Ready to use Cazalla?** Start with the [Commands Reference](commands.md) to learn all available commands!
+