kitos/Angerona
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Credentials created

Browse Source
This commit is contained in:
marcos.luna
2025-10-29 14:56:02 +01:00
parent df8e824f5f
commit 43bac24419
10 changed files with 879 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+172 -3
View File
@@ -24,6 +24,7 @@
- [Configuration](#configuration)
- [Process Browser Integration](#process-browser-integration)
- [Artifacts Support](#artifacts-support)
- [Credentials Support](#credentials-support)
- [Development](#development)
- [Troubleshooting](#troubleshooting)
- [Credits](#credits)
@@ -179,6 +180,7 @@ For more information, see the [Mythic documentation on customizing public agents
| `cp` | Copy files | `cp source.txt dest.txt` |
| `mkdir` | Create directory | `mkdir C:\temp\new_folder` |
| `rm` | Delete file or directory | `rm C:\temp\file.txt` |
| `cat` | Read file contents (with automatic credential detection) | `cat C:\path\to\file.txt` |
### Execution & Control
@@ -607,7 +609,9 @@ Example implementations:
### Best Practices for New Commands
**When developing new commands, always consider artifact reporting:**
**When developing new commands, always consider artifact and credential reporting:**
#### Artifacts
✅ **Commands that SHOULD report artifacts:**
- Any command that creates, modifies, or deletes files (`cp`, `mkdir`, `rm`, `upload`, `download`)
@@ -617,16 +621,170 @@ Example implementations:
- Any command that modifies system configuration
❌ **Commands that DON'T need artifacts:**
- Read-only operations (`ls`, `cd`, `pwd`, `cat`, `read`)
- Read-only operations (`ls`, `cd`, `pwd`, `cat`, `read`) - these don't modify system state
- Information gathering commands (`ps`, `whoami`, `hostname`) - unless they create processes
- Commands that only change local state (`sleep`, `exit`)
**Rule of thumb**: If the command modifies system state or creates forensic evidence, it should report an artifact.
#### Credentials
✅ **Commands that SHOULD report credentials:**
- Commands that extract credentials from system memory (LSASS dumps, SAM, etc.)
- Commands that read configuration files containing credentials (`cat`, file readers)
- Commands that extract authentication data (certificates, keys, tickets, cookies)
- Commands that parse credential databases (browsers, password managers, etc.)
- Commands that intercept authentication traffic
- Any command that discovers passwords, hashes, or other authentication material
**Note on `cat`/file reading commands**: While read-only operations don't need artifacts, they SHOULD analyze content and report discovered credentials using `addCredential()`. The `cat` command is a perfect example - it automatically detects and reports:
- Format `username:password` (e.g., `marcos:password123`)
- Format `dominio\usuario:password` (e.g., `test\marcos:password`, extracts realm="test", account="marcos")
- Format `usuario@dominio:password` (e.g., `marcos@tes.com:password`, extracts realm="tes.com", account="marcos")
- Passwords in format `password=value` or `password:value`
- HTTP URLs with embedded credentials: `http://user:pass@host`
- NTLM hashes (format `aad3b435b51404ee:hash` or `:32hexchars`)
**How to add credentials in your command:**
```c
// After discovering credentials, add them to the response
addCredential(respuestaTarea, "plaintext", "DOMAIN", "password123", "username");
addCredential(respuestaTarea, "hash", "", "aad3b435b51404ee...", "Administrator");
// For domain accounts with formato dominio\usuario:
// Extract domain as realm, username as account
addCredential(respuestaTarea, "plaintext", "DOMAIN", "password", "username");
// For format usuario@dominio, extract domain as realm:
addCredential(respuestaTarea, "plaintext", "tes.com", "password", "marcos");
```
For more information, see the [Mythic Artifacts documentation](https://docs.mythic-c2.net/customizing/hooking-features/artifacts).
---
## 🔑 Credentials Support
Cazalla supports reporting discovered credentials to Mythic's credential store, allowing you to track and manage credentials discovered during operations.
### Features
- **Automatic Credential Detection**: Commands can report discovered credentials using the `addCredential()` helper
- **Multiple Credential Types**: Supports `plaintext`, `hash`, `certificate`, `key`, `ticket`, and `cookie`
- **Credential Management**: Credentials appear in Mythic's Credentials page (click the key icon)
- **Associated with Tasks**: Credentials are linked to the task and callback that discovered them
### How It Works
1. **Agent Execution**: When a command discovers credentials (e.g., dumping LSASS, extracting hashes), it:
- Calls `addCredential()` with the credential details
- Includes credential data in the response payload
2. **Translator Detection**: The translator detects credentials in the response:
- Looks for the credential marker (`0xFE`) in the response
- Extracts credential type, realm, credential value, and account
- Creates credential entries in the JSON response
3. **Mythic Integration**: Credentials are automatically:
- Added to the response JSON
- Tracked in Mythic's Credentials page
- Associated with the task and callback
### Example Credential Response
When you execute a command that discovers credentials, the response includes:
```json
{
"task_id": "...",
"user_output": "Credentials extracted successfully",
"credentials": [
{
"credential_type": "plaintext",
"realm": "spooky.local",
"credential": "SuperS3Cr37",
"account": "itsafeature"
},
{
"credential_type": "hash",
"realm": "",
"credential": "aad3b435b51404eeaad3b435b51404ee:...",
"account": "Administrator"
}
]
}
```
### Supported Credential Types
According to [Mythic Credentials documentation](https://docs.mythic-c2.net/customizing/hooking-features/credentials), the following types are supported:
- **plaintext**: Plain text passwords
- **hash**: Password hashes (NTLM, SHA1, etc.)
- **certificate**: Certificates
- **key**: Cryptographic keys
- **ticket**: Kerberos tickets
- **cookie**: Web cookies/session tokens
### Viewing Credentials
1. Navigate to your callback in the Mythic UI
2. Click the **CREDENTIALS** icon (key) in the top navigation
3. View all credentials discovered by all commands across all callbacks
4. Filter by credential type, realm, account, etc.
### Implementation Details
The credential system uses:
- **Agent Side Helper** (`paquete.c`): `addCredential()` function to easily add credentials to any command response
- **Agent Side** (command handlers): Call `addCredential(paquete, "credential_type", "realm", "credential", "account")` after adding response output
- **Translator Side** (`commands_from_implant.py`): Automatically detects, parses, and creates credential JSON
- **Format**: `[0xFE marker][type_len:4][type][realm_len:4][realm][credential_len:4][credential][account_len:4][account]`
### Using Credentials in Commands
To add credential reporting to a command:
```c
// After extracting credentials, add them to the response
addCredential(respuestaTarea, "plaintext", "DOMAIN", "password123", "username");
addCredential(respuestaTarea, "hash", "", "aad3b435b51404ee...", "Administrator");
// For local accounts, realm can be empty string
addCredential(respuestaTarea, "hash", "", "ntlm_hash_here", "LOCALUSER");
```
**Example use cases:**
- LSASS dumping tools → `hash` credentials
- Credential extraction commands → `plaintext` or `hash` credentials
- Certificate extraction → `certificate` credentials
- Kerberos ticket extraction → `ticket` credentials
- Browser credential extraction → `plaintext` or `cookie` credentials
- **`cat` command** → Automatically detects and reports credentials found in file contents:
- Passwords in format `password=value` or `password:value`
- HTTP URLs with embedded credentials: `http://user:pass@host`
- NTLM hashes (format `aad3b435b51404ee:hash` or `:32hexchars`)
- Extracts usernames when found in the same line
**Note**: Commands that only READ files (like `cat`) should NOT add artifacts since they don't modify system state. However, they CAN analyze content and report discovered credentials using `addCredential()`.
**Example for `cat` command:**
```c
// Read file contents
// ... read file code ...
// If credentials are discovered in the file content, report them:
if (found_password) {
addCredential(respuestaTarea, "plaintext", "", "password123", "username");
}
// Do NOT add artifacts for read-only operations:
// addArtifact(respuestaTarea, "File Write", file_path); // ❌ WRONG - file wasn't written
```
For more information, see the [Mythic Credentials documentation](https://docs.mythic-c2.net/customizing/hooking-features/credentials).
---
## 🔧 Development
### Project Structure
@@ -661,7 +819,9 @@ Cazalla/
### Adding New Commands
**Important**: When developing new commands, always consider whether the command should report artifacts. Commands that modify system state (create processes, write files, modify registry, create network connections, etc.) should include artifact reporting using the `addArtifact()` helper function. See [Artifacts Support](#artifacts-support) for details.
**Important**: When developing new commands, always consider:
1. **Artifact reporting**: Commands that modify system state (create processes, write files, modify registry, create network connections, etc.) should include artifact reporting using the `addArtifact()` helper function. See [Artifacts Support](#artifacts-support) for details.
2. **Credential reporting**: Commands that discover or extract credentials (passwords, hashes, certificates, keys, tickets, cookies) should report them using the `addCredential()` helper function. Commands that read files should analyze content for credentials and report any found. See [Credentials Support](#credentials-support) for details and examples.
1. **Define command in Python** (`agent_functions/my_command.py`):
@@ -731,6 +891,15 @@ BOOL myCommandHandler(PAnalizador argumentos) {
// - If modifying registry: addArtifact(respuesta, "Registry Write", reg_key);
// - If creating network connections: addArtifact(respuesta, "Network Connection", connection_info);
// IMPORTANT: Add credentials if this command discovers or extracts credentials
// Examples:
// - Plaintext password: addCredential(respuesta, "plaintext", "DOMAIN", "password123", "username");
// - Hash: addCredential(respuesta, "hash", "", "aad3b435b51404ee...", "Administrator");
// - Domain account (dominio\usuario): addCredential(respuesta, "plaintext", "DOMAIN", "password", "username");
// - Format usuario@dominio: addCredential(respuesta, "plaintext", "domain.com", "password", "username");
// - Certificate: addCredential(respuesta, "certificate", "", "cert_data", "account_name");
// - For file reading commands, analyze content and report found credentials (see cat command example)
Analizador* resp = mandarPaquete(respuesta);
liberarPaquete(respuesta);
if (resp) liberarAnalizador(resp);