kitos/Angerona
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename project from Cazalla to Angerona

Browse Source 
Complete rebrand: renamed all files, folders, code references, documentation, Docker paths, env vars, Makefile targets, Python classes, C structs/functions, and git remote URL. Replaced agent icons with new Angerona branding (light + dark mode SVGs). Fixed builder.py to reference SVG instead of PNG for Mythic icon path.
This commit is contained in:
Kitos
2026-03-25 15:32:50 +01:00
parent 120de6778d
commit 6e82a8253c
166 changed files with 434 additions and 902 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+66 -66
View File
@@ -1,4 +1,4 @@
# Cazalla - Mythic C2 Agent
# Angerona - Mythic C2 Agent
<div align="center">
@@ -41,7 +41,7 @@
## 🎯 Overview
**Cazalla** is a lightweight Windows implant written in C, designed to work seamlessly with the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic). It provides essential post-exploitation capabilities including file system manipulation, process enumeration, command execution, and SOCKS proxy functionality.
**Angerona** is a lightweight Windows implant written in C, designed to work seamlessly with the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic). It provides essential post-exploitation capabilities including file system manipulation, process enumeration, command execution, and SOCKS proxy functionality.
This project was inspired by the article [How to build your own Mythic agent in C](https://red-team-sncf.github.io/how-to-create-your-own-mythic-agent-in-c.html) and has been extended with additional features and improvements.
@@ -70,20 +70,20 @@ This project was inspired by the article [How to build your own Mythic agent in
2. Build the [Docker Image ollvm](https://git.redteam/jesus.rodenas/ollvm-clang) in the Mythic server.
### Install Cazalla on Mythic
### Install Angerona on Mythic
```bash
cd ~/Mythic
./mythic-cli install github https://github.com/<your-org>/Cazalla
./mythic-cli install github https://github.com/<your-org>/Angerona
```
Or install from local directory:
```bash
./mythic-cli install folder /path/to/Cazalla
./mythic-cli install folder /path/to/Angerona
```
Then, modify the Mythic `docker-compose.yaml`, adding the following volumnes in the "cazalla" service:
Then, modify the Mythic `docker-compose.yaml`, adding the following volumnes in the "angerona" service:
```
- /var/run/docker.sock:/var/run/docker.sock
@@ -92,10 +92,10 @@ Then, modify the Mythic `docker-compose.yaml`, adding the following volumnes in
### Build the Agent
Cazalla can be built directly from the Mythic UI:
Angerona can be built directly from the Mythic UI:
1. Navigate to **Payloads** → **Create Payload**
2. Select **Cazalla** as the payload type
2. Select **Angerona** as the payload type
3. Configure build parameters (C2 profile, sleep interval, etc.)
4. Click **Build**
@@ -103,9 +103,9 @@ The agent will be cross-compiled for Windows using MinGW in a Docker container.
---
## 🔨 Customizing Cazalla
## 🔨 Customizing Angerona
If you've forked Cazalla or made local changes and want to use your customized version, you need to configure Mythic to use local builds instead of remote images.
If you've forked Angerona or made local changes and want to use your customized version, you need to configure Mythic to use local builds instead of remote images.
### Making Changes Work
@@ -113,34 +113,34 @@ By default, Mythic may use pre-built remote images for faster deployment. Howeve
#### Configure Build Variables
After installing Cazalla, Mythic will add these variables to your `~/Mythic/.env` file:
After installing Angerona, Mythic will add these variables to your `~/Mythic/.env` file:
```bash
# Use local build context instead of remote image
CAZALLA_USE_BUILD_CONTEXT="true"
ANGERONA_USE_BUILD_CONTEXT="true"
# Use direct mount instead of Docker volume (recommended for development)
CAZALLA_USE_VOLUME="false"
ANGERONA_USE_VOLUME="false"
# Optional: Remote image URL (only used if USE_BUILD_CONTEXT is false)
CAZALLA_REMOTE_IMAGE="ghcr.io/your-org/cazalla:v1.0.0"
ANGERONA_REMOTE_IMAGE="ghcr.io/your-org/angerona:v1.0.0"
```
#### Variables Explanation
- **`CAZALLA_USE_BUILD_CONTEXT`**:
- **`ANGERONA_USE_BUILD_CONTEXT`**:
- Set to `"true"` to build from your local `Dockerfile` and include your local changes
- Set to `"false"` (default) to use the pre-built remote image
- **Important**: You must set this to `"true"` if you've modified any files!
- **`CAZALLA_USE_VOLUME`**:
- **`ANGERONA_USE_VOLUME`**:
- Set to `"false"` (default) to mount the local folder directly into the container
- Set to `"true"` to use a Docker volume instead
- Direct mount is better for development as changes are immediately visible
- **`CAZALLA_REMOTE_IMAGE`** (optional):
- **`ANGERONA_REMOTE_IMAGE`** (optional):
- Specifies a pre-built remote image URL
- Only used when `CAZALLA_USE_BUILD_CONTEXT="false"`
- Only used when `ANGERONA_USE_BUILD_CONTEXT="false"`
#### Apply Changes
@@ -148,33 +148,33 @@ After modifying these variables, rebuild the container:
```bash
cd ~/Mythic
sudo ./mythic-cli build cazalla
sudo ./mythic-cli build angerona
```
#### Verifying Your Changes
1. Make your code changes
2. Set `CAZALLA_USE_BUILD_CONTEXT="true"` in `~/Mythic/.env`
3. Run `sudo ./mythic-cli build cazalla`
4. Check logs: `sudo docker logs cazalla_translator`
2. Set `ANGERONA_USE_BUILD_CONTEXT="true"` in `~/Mythic/.env`
3. Run `sudo ./mythic-cli build angerona`
4. Check logs: `sudo docker logs angerona_translator`
If changes still don't appear:
- Verify the `Dockerfile` copies your modified files (see line 39: `COPY ./ /Mythic/cazalla/`)
- Verify the `Dockerfile` copies your modified files (see line 39: `COPY ./ /Mythic/angerona/`)
- Check that file paths in the Dockerfile match your directory structure
- Ensure you're editing files in the correct location (inside `Payload_Type/cazalla/`)
- Ensure you're editing files in the correct location (inside `Payload_Type/angerona/`)
#### Example: Customizing Agent Code
```bash
# 1. Edit agent C code
vim Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c
vim Payload_Type/angerona/angerona/agent_code/angerona/comandos.c
# 2. Ensure build context is enabled
echo 'CAZALLA_USE_BUILD_CONTEXT="true"' >> ~/Mythic/.env
echo 'ANGERONA_USE_BUILD_CONTEXT="true"' >> ~/Mythic/.env
# 3. Rebuild the container
cd ~/Mythic
sudo ./mythic-cli build cazalla
sudo ./mythic-cli build angerona
# 4. Rebuild a payload from the UI
# Your changes will now be included in the compiled agent
@@ -251,7 +251,7 @@ For more information, see the [Mythic documentation on customizing public agents
## 🌐 SOCKS Proxy Support
Cazalla includes full SOCKS5 proxy support, allowing you to route traffic through the implant to reach internal network resources.
Angerona includes full SOCKS5 proxy support, allowing you to route traffic through the implant to reach internal network resources.
### How It Works
@@ -363,7 +363,7 @@ Agent and translator communicate SOCKS data using a custom binary block:
## 🔄 Reverse Port Forwarding (RPFWD) Support
Cazalla includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic.
Angerona includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic.
### How It Works
@@ -464,7 +464,7 @@ Agent and translator communicate RPFWD data using a custom binary block:
## 📡 Communication Protocol
Cazalla uses a custom binary protocol for efficient communication with Mythic.
Angerona uses a custom binary protocol for efficient communication with Mythic.
### Message Structure
@@ -557,7 +557,7 @@ Edit `Config.h` before building:
### Channel Encryption
Cazalla supports optional AES-256-CBC encryption with HMAC-SHA256 for secure agent-to-Mythic communication. This provides an additional layer of security beyond HTTPS.
Angerona supports optional AES-256-CBC encryption with HMAC-SHA256 for secure agent-to-Mythic communication. This provides an additional layer of security beyond HTTPS.
#### How It Works
@@ -572,7 +572,7 @@ Cazalla supports optional AES-256-CBC encryption with HMAC-SHA256 for secure age
Encryption is enabled automatically when building with the `AESPSK` parameter in Mythic's UI:
1. Navigate to **Payloads** → **Create Payload**
2. Select **Cazalla** as the payload type
2. Select **Angerona** as the payload type
3. In the build parameters, configure **AESPSK**:
- Set `crypto_type` to `aes256_hmac`
- Mythic will automatically generate an `enc_key`
@@ -611,7 +611,7 @@ This enables:
## 📊 Process Browser Integration
Cazalla fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host. Both `ps` and `kill` commands support Process Browser integration.
Angerona fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host. Both `ps` and `kill` commands support Process Browser integration.
### Features
@@ -672,7 +672,7 @@ For more information, see the [Mythic Process Browser documentation](https://doc
## 🎨 Artifacts Support
Cazalla automatically reports artifacts created during command execution, allowing Mythic to track artifacts like process creation, file writes, and other system modifications.
Angerona automatically reports artifacts created during command execution, allowing Mythic to track artifacts like process creation, file writes, and other system modifications.
### Features
@@ -855,7 +855,7 @@ For more information, see the [Mythic Artifacts documentation](https://docs.myth
## 🔑 Credentials Support
Cazalla supports reporting discovered credentials to Mythic's credential store, allowing you to track and manage credentials discovered during operations.
Angerona supports reporting discovered credentials to Mythic's credential store, allowing you to track and manage credentials discovered during operations.
### Features
@@ -977,7 +977,7 @@ For more information, see the [Mythic Credentials documentation](https://docs.my
## 📥 File Downloads Support
Cazalla supports downloading files from the target to the Mythic server using chunked transfers, following [Mythic's File Downloads specification](https://docs.mythic-c2.net/customizing/hooking-features/download).
Angerona supports downloading files from the target to the Mythic server using chunked transfers, following [Mythic's File Downloads specification](https://docs.mythic-c2.net/customizing/hooking-features/download).
### Features
@@ -1068,7 +1068,7 @@ For more information, see the [Mythic File Downloads documentation](https://docs
## 📤 File Uploads Support
Cazalla supports uploading files from the Mythic server to the target using chunked transfers, following [Mythic's File Upload specification](https://docs.mythic-c2.net/customizing/hooking-features/action-upload).
Angerona supports uploading files from the Mythic server to the target using chunked transfers, following [Mythic's File Upload specification](https://docs.mythic-c2.net/customizing/hooking-features/action-upload).
### Features
@@ -1225,7 +1225,7 @@ For more information, see the [Mythic File Upload documentation](https://docs.my
## ⌨️ Keylogging Support
Cazalla supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature, following [Mythic's Keylog specification](https://docs.mythic-c2.net/customizing/hooking-features/keylog).
Angerona supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature, following [Mythic's Keylog specification](https://docs.mythic-c2.net/customizing/hooking-features/keylog).
### Features
@@ -1354,7 +1354,7 @@ For more information, see the [Mythic Keylog documentation](https://docs.mythic-
## 🔐 Token Support
Cazalla supports Windows token manipulation and impersonation, following [Mythic's Token specification](https://docs.mythic-c2.net/customizing/hooking-features/tokens).
Angerona supports Windows token manipulation and impersonation, following [Mythic's Token specification](https://docs.mythic-c2.net/customizing/hooking-features/tokens).
### Features
@@ -1369,7 +1369,7 @@ Cazalla supports Windows token manipulation and impersonation, following [Mythic
### How It Works
Cazalla implements token functionality following Mythic's token specification:
Angerona implements token functionality following Mythic's token specification:
1. **Token Listing** (`list_tokens`):
- Enumerates all running processes
@@ -1548,7 +1548,7 @@ For more information, see the [Mythic Tokens documentation](https://docs.mythic-
## 📊 Context Tracking
Cazalla supports **Context Tracking** to display dynamic callback context information (like current working directory and impersonation context) as tabs in the Mythic UI. This feature enhances the operator experience by providing immediate visibility into the agent's current state.
Angerona supports **Context Tracking** to display dynamic callback context information (like current working directory and impersonation context) as tabs in the Mythic UI. This feature enhances the operator experience by providing immediate visibility into the agent's current state.
### Overview
@@ -1720,7 +1720,7 @@ For more information, see the [Mythic Context Tracking documentation](https://do
## 🛡️ OPSEC Checking
Cazalla includes comprehensive **OPSEC Checking** functionality that provides operational security warnings and blocking for commands based on their detection risks. This feature helps operators make informed decisions and prevents accidental OPSEC violations.
Angerona includes comprehensive **OPSEC Checking** functionality that provides operational security warnings and blocking for commands based on their detection risks. This feature helps operators make informed decisions and prevents accidental OPSEC violations.
### Overview
@@ -1772,7 +1772,7 @@ The `opsec_post` function runs after task creation but before agent execution:
| Command | Blocking Conditions | Bypass Role |
|---------|---------------------|-------------|
| `shell` | Commands with safer Cazalla alternatives (`whoami`, `tasklist`, `powershell`, etc.) | `other_operator` |
| `shell` | Commands with safer Angerona alternatives (`whoami`, `tasklist`, `powershell`, etc.) | `other_operator` |
| `steal_token` | Critical system processes (PID 4) | `other_operator` |
| `kill` | Critical system processes (PID 0, 4, 8) | `other_operator` |
| `keylog_start` | Always blocked (extremely detectable) | `lead` |
@@ -1801,14 +1801,14 @@ The `opsec_post` function runs after task creation but before agent execution:
```
🚨 OPSEC BLOCKED - Command Has Safer Alternative
This command contains operations that have safer built-in alternatives in Cazalla:
This command contains operations that have safer built-in alternatives in Angerona:
🚨 whoami: Use Cazalla's 'whoami' command instead (no cmd.exe spawn)
🚨 whoami: Use Angerona's 'whoami' command instead (no cmd.exe spawn)
⚠️ cmd.exe spawn: This command would spawn cmd.exe (highly detectable)
💡 SAFER ALTERNATIVES:
→ Use: 'whoami' (Cazalla built-in, no cmd.exe)
→ Use: 'whoami' (Angerona built-in, no cmd.exe)
⚠️ TO PROCEED: You need approval from another operator.
This command is blocked to prevent accidental OPSEC violations.
@@ -1854,8 +1854,8 @@ OPSEC checking is **intelligent and conditional**:
```python
# Blocks if command contains:
- "whoami" → Use Cazalla's 'whoami' instead
- "tasklist" → Use Cazalla's 'ps' instead
- "whoami" → Use Angerona's 'whoami' instead
- "tasklist" → Use Angerona's 'ps' instead
- "powershell" → Highly monitored, use alternatives
# Warns if command contains:
@@ -1931,7 +1931,7 @@ For more information, see the [Mythic OPSEC Checking documentation](https://docs
## 📊 Logging & Syslog
Cazalla includes a complete logging system that records all Mythic events and sends them to a central syslog server.
Angerona includes a complete logging system that records all Mythic events and sends them to a central syslog server.
### Features
@@ -1946,7 +1946,7 @@ Cazalla includes a complete logging system that records all Mythic events and se
1. **Edit the configuration file:**
```bash
nano Payload_Type/cazalla/logger/syslog.conf
nano Payload_Type/angerona/logger/syslog.conf
```
2. **Configure the syslog server IP:**
@@ -1959,30 +1959,30 @@ Cazalla includes a complete logging system that records all Mythic events and se
3. **Rebuild and restart:**
```bash
cd /opt/mythic
sudo ./mythic-cli build cazalla
sudo ./mythic-cli restart cazalla
sudo ./mythic-cli build angerona
sudo ./mythic-cli restart angerona
```
### Verification
```bash
# Verify logger is active
sudo docker logs cazalla | grep -i "syslog\|Logger initialized"
sudo docker logs angerona | grep -i "syslog\|Logger initialized"
# View logs in real-time
sudo tail -f /var/log/cazalla.log
sudo tail -f /var/log/angerona.log
```
### Log Locations
- **Syslog (host)**: `/var/log/cazalla.log`
- **Local logs (container)**: `/tmp/cazalla_mythic_YYYY-MM-DD.log`
- **Syslog (host)**: `/var/log/angerona.log`
- **Local logs (container)**: `/tmp/angerona_mythic_YYYY-MM-DD.log`
### Complete Documentation
For more details on configuration, troubleshooting, and advanced usage, see:
- [Logger Documentation](Payload_Type/cazalla/logger/README.md) - Complete technical documentation
- [Agent Wiki - Logging](documentation-payload/Cazalla/logging.md) - User guide
- [Logger Documentation](Payload_Type/angerona/logger/README.md) - Complete technical documentation
- [Agent Wiki - Logging](documentation-payload/Angerona/logging.md) - User guide
---
@@ -1991,10 +1991,10 @@ For more details on configuration, troubleshooting, and advanced usage, see:
### Project Structure
```
Cazalla/
├── agent_code/cazalla/ # C source code
Angerona/
├── agent_code/angerona/ # C source code
│ ├── main.c # Entry point
│ ├── cazalla.c/h # Main loop
│ ├── angerona.c/h # Main loop
│ ├── comandos.c/h # Command handlers
│ ├── paquete.c/h # Packet creation
│ ├── transporte.c/h # HTTP transport (WinHTTP)
@@ -2144,7 +2144,7 @@ grep DYNAMIC_PORTS_BIND_LOCALHOST_ONLY ~/Mythic/.env
**Proxy times out:**
- Verify agent is active and not sleeping
- Check translator logs: `sudo docker logs cazalla_translator`
- Check translator logs: `sudo docker logs angerona_translator`
- Ensure `server_id` validation in `socks_manager.c` allows Mythic's IDs
**Data not flowing:**
@@ -2175,10 +2175,10 @@ apt-get update && apt-get install -y mingw-w64
**Processes not appearing in Process Browser:**
- Verify `ps` command executed successfully (check callback output)
- Check translator logs: `sudo docker logs cazalla_translator | grep PROCESS_BROWSER`
- Check translator logs: `sudo docker logs angerona_translator | grep PROCESS_BROWSER`
- Ensure `supported_ui_features = ["process_browser:list"]` is set in `ps.py`
- Verify processes are being parsed correctly (translator should show "Parseados X procesos")
- Rebuild translator if changes were made: `sudo ./mythic-cli build cazalla`
- Rebuild translator if changes were made: `sudo ./mythic-cli build angerona`
**Processes showing as "UNKNOWN - MISSING DATA":**
- This usually indicates processes that couldn't be accessed (protected/system processes)
@@ -2190,7 +2190,7 @@ apt-get update && apt-get install -y mingw-w64
**Encryption not working:**
- Verify `AESPSK` parameter is configured in build parameters
- Check build output for: `✓ Encryption ENABLED`
- Review translator logs for encryption/decryption errors: `sudo docker logs cazalla_translator | grep CRYPTO`
- Review translator logs for encryption/decryption errors: `sudo docker logs angerona_translator | grep CRYPTO`
- Ensure encryption key is present in both agent and translator (auto-configured by Mythic)
**"HMAC verification failed" errors:**
@@ -2213,7 +2213,7 @@ apt-get update && apt-get install -y mingw-w64
## 📄 License
Cazalla is licensed under the **BSD 3-Clause License**. See [LICENSE.md](LICENSE.md) for details.
Angerona is licensed under the **BSD 3-Clause License**. See [LICENSE.md](LICENSE.md) for details.
---