Process Browser options implemented

2025-11-04 13:02:01 +01:00
parent 47978f4259
commit 30c2d6390f
11 changed files with 616 additions and 60 deletions
@@ -30,6 +30,7 @@
 - [File Uploads Support](#file-uploads-support)
 - [Keylogging Support](#%EF%B8%8F-keylogging-support)
 - [Token Support](#-token-support)
+- [Context Tracking](#-context-tracking)
 - [Development](#development)
 - [Troubleshooting](#troubleshooting)
 - [Credits](#credits)
@@ -216,7 +217,13 @@ For more information, see the [Mythic documentation on customizing public agents
 | `make_token` | Create a new token using credentials and impersonate it | `make_token domain username password [logon_type]` |
 | `rev2self` | Revert token impersonation back to original token | `rev2self` |

-**Note**: The `ps` command integrates with Mythic's Process Browser, allowing unified process management across multiple callbacks. Process lists are automatically synchronized and viewable from the Process Browser UI.
+### Process Management
+
+| Command | Description | Example |
+|---------|-------------|---------|
+| `kill` | Terminate a process by PID (Process Browser supported) | `kill <pid>` |
+
+**Note**: The `ps` command integrates with Mythic's Process Browser, allowing unified process management across multiple callbacks. Process lists are automatically synchronized and viewable from the Process Browser UI. The `kill` command also supports Process Browser integration, allowing you to terminate processes directly from the Process Browser UI.

 ### Network Operations

@@ -473,6 +480,7 @@ Cazalla uses a custom binary protocol for efficient communication with Mythic.
 | `0x81` | Agent → Mythic | POST_RESPONSE (send task output) |
 | `0xF5` | Bidirectional | SOCKS data block |
 | `0xF2` | Bidirectional | RPFWD data block |
+| `0xF0` | Agent → Mythic | Callback context data (cwd, impersonation_context, etc.) |

 ### Task Structure

@@ -588,7 +596,7 @@ This enables:

 ## 📊 Process Browser Integration

-Cazalla's `ps` command fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host.
+Cazalla fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host. Both `ps` and `kill` commands support Process Browser integration.

 ### Features

@@ -596,6 +604,8 @@ Cazalla's `ps` command fully integrates with Mythic's Process Browser feature, p
 - **Process Hierarchy**: View process parent-child relationships when parent process IDs are available
 - **Rich Process Data**: Includes process name, PID, PPID, architecture, user account, and session ID
 - **Automatic Synchronization**: Process lists are automatically synchronized with Mythic's Process Browser UI
+- **Process Actions**: Kill processes directly from the Process Browser UI
+- **Cache Management**: Process lists automatically clear stale entries using `update_deleted=True` flag

 ### Process Browser UI

@@ -604,13 +614,19 @@ Access the Process Browser in Mythic:
 1. Navigate to a callback in the Mythic UI
 2. Click the **PROCESSES** tab (next to the **CALLBACK** tab)
 3. View all processes from all callbacks on that host
-4. Use the UI buttons for additional actions (inject, kill, etc.) if implemented
+4. Use the UI buttons for process actions:
+   - **Kill**: Terminate a process directly from the Process Browser (uses `kill` command)
+   - **Steal Token**: Steal token from a process (uses `steal_token` command)
+   - **List Tokens**: List tokens from a process (uses `list_tokens` command)

 ### Implementation Details

+#### `ps` Command
+
 The `ps` command implements the `process_browser:list` supported UI feature:
 - Process data is automatically converted to Mythic's Process Browser JSON format
 - The translator detects process list responses and formats them accordingly
+- All processes are marked with `update_deleted=True` to clear stale entries from cache
 - Process information includes:
  - `process_id`: Process identifier (required)
  - `name`: Process name (required)
@@ -619,6 +635,22 @@ The `ps` command implements the `process_browser:list` supported UI feature:
  - `user`: User account running the process
  - `session_id`: Windows session ID

+#### `kill` Command
+
+The `kill` command implements the `process_browser:kill` supported UI feature:
+- Accepts `pid` or `process_id` parameter (from Process Browser)
+- Automatically verifies process existence before termination
+- Protects critical system processes (PIDs 0, 4, 8)
+- Reports "Process Termination" artifact with PID
+- Provides detailed error messages for different failure scenarios
+
+#### Process Browser Parameters
+
+When using Process Browser UI actions, the following parameters are automatically passed:
+- `host`: Host name (from Process Browser)
+- `process_id`: Process ID (from Process Browser, takes precedence over `pid`)
+- `architecture`: Process architecture (from Process Browser)
+
 For more information, see the [Mythic Process Browser documentation](https://docs.mythic-c2.net/customizing/hooking-features/process_list).

 ---
@@ -694,6 +726,8 @@ Currently supported:
  - `rm` (delete) - reports deleted file/directory path
 - **File Read**: Automatically reported for:
  - `download` - reports file path when downloading files
+- **Process Termination**: Automatically reported for:
+  - `kill` - reports terminated process PID (e.g., "Process Termination: PID 1234")
 - **API Call**: Reported for:
  - `screenshot` - GDI Screen Capture (GetDC, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, GetDIBits)
  - `keylog_start` - Keyboard Hook (GetAsyncKeyState, GetForegroundWindow, GetWindowTextA, GetUserNameA)
@@ -1497,6 +1531,178 @@ For more information, see the [Mythic Tokens documentation](https://docs.mythic-

 ---

+## 📊 Context Tracking
+
+Cazalla supports **Context Tracking** to display dynamic callback context information (like current working directory and impersonation context) as tabs in the Mythic UI. This feature enhances the operator experience by providing immediate visibility into the agent's current state.
+
+### Overview
+
+Context Tracking allows Mythic to display callback-specific information as dynamic tabs above the tasking area. These tabs update automatically as the agent's context changes, providing real-time visibility into:
+
+- **Current Working Directory (`cwd`)**: The agent's current directory
+- **Impersonation Context (`impersonation_context`)**: The currently impersonated user (if any)
+
+### How It Works
+
+1. **Initial Check-in**: The agent automatically includes `cwd` and `impersonation_context` in the initial check-in message
+2. **Dynamic Updates**: Commands that change the context (like `cd`, `steal_token`, `rev2self`) automatically update and report the new context
+3. **UI Display**: Mythic displays these fields as dynamic tabs above the tasking area
+
+### Supported Context Fields
+
+#### Current Working Directory (`cwd`)
+
+- **Updated by**: `cd` command
+- **Initial value**: Automatically set during check-in with the process's current directory
+- **Display**: Shows the current directory path (e.g., `C:\Users\localuser\Downloads`)
+
+#### Impersonation Context (`impersonation_context`)
+
+- **Updated by**: `steal_token`, `make_token`, `rev2self`
+- **Initial value**: Automatically set during check-in with the process's current user (format: `DOMAIN\username`)
+- **Display**: Shows the currently impersonated user (e.g., `NT AUTHORITY\SYSTEM`)
+
+### Commands That Update Context
+
+#### `cd` Command
+
+```bash
+# Change directory - automatically updates cwd context
+cd {"path":"C:\\Windows"}
+```
+
+After executing `cd`, the `cwd` tab in Mythic UI will update to show the new directory.
+
+#### `steal_token` Command
+
+```bash
+# Steal token from a process - automatically updates impersonation_context
+steal_token 1060
+```
+
+After stealing a token, the `impersonation_context` tab will show the impersonated user (e.g., `NT AUTHORITY\SYSTEM`).
+
+#### `make_token` Command
+
+```bash
+# Create token with credentials - automatically updates impersonation_context
+make_token DOMAIN username password
+```
+
+After creating a token, the `impersonation_context` tab will show the new user context.
+
+#### `rev2self` Command
+
+```bash
+# Revert to original token - clears impersonation_context
+rev2self
+```
+
+After reverting, the `impersonation_context` tab will be cleared (or show the original user).
+
+### Technical Implementation
+
+#### Binary Protocol
+
+Context updates are sent using a special marker in task responses:
+
+```
+[0xF0 marker][field_name_len:4][field_name][field_value_len:4][field_value]...
+```
+
+- **Marker**: `0xF0` indicates callback context data
+- **Field Name**: Name of the context field (e.g., `cwd`, `impersonation_context`)
+- **Field Value**: The actual value to update
+
+Multiple fields can be sent in a single response by repeating the pattern.
+
+#### Check-in Format
+
+During initial check-in, context fields are included directly in the check-in message and added to the root JSON:
+
+```json
+{
+  "action": "checkin",
+  "uuid": "...",
+  "host": "...",
+  "cwd": "C:\\Users\\localuser",
+  "impersonation_context": "CETP-WIN11-01\\localuser",
+  ...
+}
+```
+
+#### Task Response Format
+
+In task responses, context updates are included in the `callback` key:
+
+```json
+{
+  "action": "post_response",
+  "responses": [{
+    "task_id": "...",
+    "completed": true,
+    "callback": {
+      "cwd": "C:\\Windows",
+      "impersonation_context": "NT AUTHORITY\\SYSTEM"
+    },
+    "user_output": "..."
+  }]
+}
+```
+
+### UI Configuration
+
+Context tabs are automatically displayed in the Mythic UI when context data is available. You can configure their appearance in Mythic settings:
+
+1. Navigate to **Settings** → **Tasking Context Tabs**
+2. Select which fields to display (`cwd`, `impersonation_context`)
+3. Configure colors and styling if desired
+
+### Example Usage
+
+```bash
+# 1. Agent checks in - tabs appear showing initial context
+# Tab: "Dir: C:\Users\localuser\Downloads"
+# Tab: "User: CETP-WIN11-01\localuser"
+
+# 2. Change directory
+cd {"path":"C:\\Windows"}
+# Tab updates: "Dir: C:\Windows"
+
+# 3. Steal SYSTEM token
+steal_token 1060
+# Tab updates: "User: NT AUTHORITY\SYSTEM"
+
+# 4. Revert token
+rev2self
+# Tab updates: "User: CETP-WIN11-01\localuser"
+```
+
+### Debugging
+
+To verify context tracking is working:
+
+1. **Check agent logs** for messages like:
+   ```
+   Checkin: Añadido cwd inicial: C:\Users\localuser
+   Checkin: Añadido impersonation_context inicial: CETP-WIN11-01\localuser
+   [steal_token] Contexto de impersonación actualizado: NT AUTHORITY\SYSTEM
+   ```
+
+2. **Check translator logs** for messages like:
+   ```
+   [CHECKIN] Callback context: cwd = 'C:\Users\localuser'
+   [CHECKIN] Callback context: impersonation_context = 'CETP-WIN11-01\localuser'
+   [CALLBACK_CONTEXT] cwd = 'C:\Windows'
+   [CALLBACK_CONTEXT] impersonation_context = 'NT AUTHORITY\SYSTEM'
+   ```
+
+3. **Verify in Mythic UI**: Context tabs should appear above the tasking area and update automatically.
+
+For more information, see the [Mythic Context Tracking documentation](https://docs.mythic-c2.net/customizing/hooking-features/context-tracking).
+
+---
+
 ## 🔧 Development

 ### Project Structure