Rename project from Cazalla to Angerona
Complete rebrand: renamed all files, folders, code references, documentation, Docker paths, env vars, Makefile targets, Python classes, C structs/functions, and git remote URL. Replaced agent icons with new Angerona branding (light + dark mode SVGs). Fixed builder.py to reference SVG instead of PNG for Mythic icon path.
This commit is contained in:
@@ -1,6 +1,6 @@
|
||||
# Documentación de Cazalla
|
||||
# Documentación de Angerona
|
||||
|
||||
Esta carpeta contiene la documentación del agente Cazalla que se sirve automáticamente desde el contenedor de documentación de Mythic.
|
||||
Esta carpeta contiene la documentación del agente Angerona que se sirve automáticamente desde el contenedor de documentación de Mythic.
|
||||
|
||||
## Estructura
|
||||
|
||||
@@ -10,20 +10,20 @@ Esta carpeta contiene la documentación del agente Cazalla que se sirve automát
|
||||
|
||||
## Instalación
|
||||
|
||||
Esta documentación se instala automáticamente cuando instalas el agente Cazalla en Mythic:
|
||||
Esta documentación se instala automáticamente cuando instalas el agente Angerona en Mythic:
|
||||
|
||||
```bash
|
||||
cd ~/Mythic
|
||||
./mythic-cli install github https://github.com/tu-org/Cazalla
|
||||
./mythic-cli install github https://github.com/tu-org/Angerona
|
||||
# o
|
||||
./mythic-cli install folder /path/to/Cazalla
|
||||
./mythic-cli install folder /path/to/Angerona
|
||||
```
|
||||
|
||||
## Acceso
|
||||
|
||||
Una vez instalado, la documentación estará disponible en:
|
||||
- `http://tu-servidor:7443/docs/agents/Cazalla`
|
||||
- `http://tu-servidor:7443/docs/agents/Cazalla/commands/<comando>`
|
||||
- `http://tu-servidor:7443/docs/agents/Angerona`
|
||||
- `http://tu-servidor:7443/docs/agents/Angerona/commands/<comando>`
|
||||
|
||||
---
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
+++
|
||||
title = "Cazalla"
|
||||
title = "Angerona"
|
||||
chapter = true
|
||||
weight = 100
|
||||
+++
|
||||
|
||||
**Cazalla** is a lightweight Windows implant written in C, designed for the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic).
|
||||
**Angerona** is a lightweight Windows implant written in C, designed for the [Mythic C2 Framework](https://github.com/its-a-feature/Mythic).
|
||||
|
||||
|
||||
|
||||
## Overview
|
||||
|
||||
Cazalla provides essential post-exploitation capabilities including:
|
||||
Angerona provides essential post-exploitation capabilities including:
|
||||
|
||||
- **File System Operations** - Navigate, read, write, and manage files
|
||||
- **Process Management** - Enumerate, terminate, and interact with processes
|
||||
@@ -64,7 +64,7 @@ Cazalla provides essential post-exploitation capabilities including:
|
||||
## Key Features
|
||||
|
||||
### Process Browser Integration
|
||||
Cazalla automatically updates Mythic's Process Browser, allowing you to interact with processes directly from the UI.
|
||||
Angerona automatically updates Mythic's Process Browser, allowing you to interact with processes directly from the UI.
|
||||
|
||||
### File Browser Integration
|
||||
Seamlessly browse the target's file system through Mythic's File Browser.
|
||||
+4
-4
@@ -5,9 +5,9 @@ weight = 10
|
||||
pre = "4. "
|
||||
+++
|
||||
|
||||
# Cazalla Command Reference
|
||||
# Angerona Command Reference
|
||||
|
||||
Complete documentation for all Cazalla agent commands.
|
||||
Complete documentation for all Angerona agent commands.
|
||||
|
||||
## 📋 Table of Contents
|
||||
|
||||
@@ -768,7 +768,7 @@ shell ipconfig /all
|
||||
- The command is executed in a non-interactive shell and the output is captured and returned
|
||||
- HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions
|
||||
- Command execution and command-line arguments are logged by security tools
|
||||
- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
|
||||
- Consider using built-in Angerona commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
|
||||
- Always requires approval from another operator before execution
|
||||
|
||||
**Output:**
|
||||
@@ -784,7 +784,7 @@ desktop-abc\administrator
|
||||
- **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored
|
||||
- Command execution and arguments are logged by EDR/XDR solutions
|
||||
- Always requires operator approval (OPSEC pre-check blocks execution)
|
||||
- Consider using built-in Cazalla commands instead when possible
|
||||
- Consider using built-in Angerona commands instead when possible
|
||||
|
||||
**Related:** [OPSEC Checking](opsec.md)
|
||||
|
||||
+3
-3
@@ -1,6 +1,6 @@
|
||||
# Cazalla Commands
|
||||
# Angerona Commands
|
||||
|
||||
Complete documentation for all Cazalla agent commands, organized by category.
|
||||
Complete documentation for all Angerona agent commands, organized by category.
|
||||
|
||||
## File System Commands
|
||||
|
||||
@@ -57,5 +57,5 @@ Complete documentation for all Cazalla agent commands, organized by category.
|
||||
|
||||
---
|
||||
|
||||
[Back to Cazalla Documentation](../../../README.md)
|
||||
[Back to Angerona Documentation](../../../README.md)
|
||||
|
||||
+2
-2
@@ -29,7 +29,7 @@ shell ipconfig /all
|
||||
- The command is executed in a non-interactive shell and the output is captured and returned
|
||||
- HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions
|
||||
- Command execution and command-line arguments are logged by security tools
|
||||
- Consider using built-in Cazalla commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
|
||||
- Consider using built-in Angerona commands (`ps`, `ls`, `cat`, etc.) instead when possible, as they provide better OPSEC
|
||||
- Always requires approval from another operator before execution
|
||||
|
||||
## Output
|
||||
@@ -47,7 +47,7 @@ desktop-abc\administrator
|
||||
- **HIGH OPSEC RISK**: Spawns cmd.exe which is heavily monitored
|
||||
- Command execution and arguments are logged by EDR/XDR solutions
|
||||
- Always requires operator approval (OPSEC pre-check blocks execution)
|
||||
- Consider using built-in Cazalla commands instead when possible
|
||||
- Consider using built-in Angerona commands instead when possible
|
||||
|
||||
## Related
|
||||
|
||||
+14
-14
@@ -5,13 +5,13 @@ weight = 20
|
||||
pre = "3. "
|
||||
+++
|
||||
|
||||
# Developing New Commands for Cazalla
|
||||
# Developing New Commands for Angerona
|
||||
|
||||
This guide provides a step-by-step walkthrough for adding new commands to the Cazalla agent. Understanding this process is essential for extending Cazalla's capabilities.
|
||||
This guide provides a step-by-step walkthrough for adding new commands to the Angerona agent. Understanding this process is essential for extending Angerona's capabilities.
|
||||
|
||||
## 📋 Overview
|
||||
|
||||
Adding a new command to Cazalla requires coordination across multiple components:
|
||||
Adding a new command to Angerona requires coordination across multiple components:
|
||||
|
||||
1. **Python Command Definition** - Defines the command interface in Mythic
|
||||
2. **Translator Mapping** - Maps command names to hex codes for agent communication
|
||||
@@ -45,7 +45,7 @@ graph LR
|
||||
|
||||
### Step 1: Create Python Command File
|
||||
|
||||
Create a new Python file in `Payload_Type/cazalla/cazalla/agent_functions/` named after your command (e.g., `mycommand.py`).
|
||||
Create a new Python file in `Payload_Type/angerona/angerona/agent_functions/` named after your command (e.g., `mycommand.py`).
|
||||
|
||||
#### 1.1 Command Arguments Class
|
||||
|
||||
@@ -156,7 +156,7 @@ class MyCommandCommand(CommandBase):
|
||||
|
||||
### Step 2: Add Command to Translator
|
||||
|
||||
Edit `Payload_Type/cazalla/translator/commands_from_c2.py` and add your command to the `commands` dictionary:
|
||||
Edit `Payload_Type/angerona/translator/commands_from_c2.py` and add your command to the `commands` dictionary:
|
||||
|
||||
```python
|
||||
commands = {
|
||||
@@ -184,7 +184,7 @@ commands = {
|
||||
|
||||
#### 3.1 Define Command Constant
|
||||
|
||||
Edit `Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.h` and add:
|
||||
Edit `Payload_Type/angerona/angerona/agent_code/angerona/comandos.h` and add:
|
||||
|
||||
```c
|
||||
#define MYCOMMAND_CMD 0x99 // Must match hex_code from translator
|
||||
@@ -195,7 +195,7 @@ Edit `Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.h` and add:
|
||||
Create or edit the appropriate C file (e.g., `SistemadeFicheros.c` for file operations, or create a new file):
|
||||
|
||||
```c
|
||||
#include "cazalla.h"
|
||||
#include "angerona.h"
|
||||
#include "comandos.h"
|
||||
#include "paquete.h"
|
||||
|
||||
@@ -263,7 +263,7 @@ void MyCommandHandler(PAnalizador analizadorTarea) {
|
||||
|
||||
### Step 4: Register Handler in Command Dispatcher
|
||||
|
||||
Edit `Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c` and add your command to the dispatch chain in `handleGetTasking()`:
|
||||
Edit `Payload_Type/angerona/angerona/agent_code/angerona/comandos.c` and add your command to the dispatch chain in `handleGetTasking()`:
|
||||
|
||||
```c
|
||||
#ifdef ENABLE_MYCOMMAND_CMD
|
||||
@@ -284,7 +284,7 @@ Edit `Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c` and add your c
|
||||
|
||||
### Step 5: Add to Builder Mapping
|
||||
|
||||
Edit `Payload_Type/cazalla/cazalla/agent_functions/builder.py` and add your command to the `command_to_define` dictionary (around line 209):
|
||||
Edit `Payload_Type/angerona/angerona/agent_functions/builder.py` and add your command to the `command_to_define` dictionary (around line 209):
|
||||
|
||||
```python
|
||||
command_to_define = {
|
||||
@@ -405,7 +405,7 @@ In `comandos.h`:
|
||||
Create `ping.c`:
|
||||
|
||||
```c
|
||||
#include "cazalla.h"
|
||||
#include "angerona.h"
|
||||
#include "comandos.h"
|
||||
#include "paquete.h"
|
||||
|
||||
@@ -542,18 +542,18 @@ The translator will automatically convert file listings to File Browser format.
|
||||
|
||||
### 1. Restart Mythic Agent Container
|
||||
|
||||
After adding your command, restart the Cazalla container:
|
||||
After adding your command, restart the Angerona container:
|
||||
|
||||
```bash
|
||||
cd ~/Mythic
|
||||
./mythic-cli restart cazalla
|
||||
./mythic-cli restart angerona
|
||||
```
|
||||
|
||||
### 2. Verify Command Appears
|
||||
|
||||
1. Open Mythic UI
|
||||
2. Navigate to Payloads → Create Payload
|
||||
3. Select Cazalla
|
||||
3. Select Angerona
|
||||
4. Check that your command appears in the command selection list
|
||||
|
||||
### 3. Build Test Payload
|
||||
@@ -606,7 +606,7 @@ cd ~/Mythic
|
||||
|
||||
## 📚 Reference: Command Hex Codes
|
||||
|
||||
Current hex code allocations in Cazalla:
|
||||
Current hex code allocations in Angerona:
|
||||
|
||||
- `0x00`: GET_TASKING
|
||||
- `0x01`: POST_RESPONSE
|
||||
+2
-2
@@ -5,9 +5,9 @@ weight = 10
|
||||
pre = "5. "
|
||||
+++
|
||||
|
||||
# Cazalla Usage Examples
|
||||
# Angerona Usage Examples
|
||||
|
||||
This document provides practical examples and use cases for using Cazalla agent in real-world scenarios.
|
||||
This document provides practical examples and use cases for using Angerona agent in real-world scenarios.
|
||||
|
||||
## 📋 Table of Contents
|
||||
|
||||
+15
-15
@@ -5,9 +5,9 @@ weight = 10
|
||||
pre = "2. "
|
||||
+++
|
||||
|
||||
# Cazalla Features Overview
|
||||
# Angerona Features Overview
|
||||
|
||||
This document provides detailed explanations of Cazalla's key features and capabilities.
|
||||
This document provides detailed explanations of Angerona's key features and capabilities.
|
||||
|
||||
## 📋 Table of Contents
|
||||
|
||||
@@ -29,7 +29,7 @@ This document provides detailed explanations of Cazalla's key features and capab
|
||||
|
||||
## Process Browser Integration
|
||||
|
||||
Cazalla fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host.
|
||||
Angerona fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -68,7 +68,7 @@ Cazalla fully integrates with Mythic's Process Browser feature, providing unifie
|
||||
|
||||
## File Browser Integration
|
||||
|
||||
Cazalla seamlessly integrates with Mythic's File Browser, allowing visual file system navigation and operations.
|
||||
Angerona seamlessly integrates with Mythic's File Browser, allowing visual file system navigation and operations.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -105,7 +105,7 @@ Cazalla seamlessly integrates with Mythic's File Browser, allowing visual file s
|
||||
|
||||
## Context Tracking
|
||||
|
||||
Cazalla automatically tracks and displays dynamic callback context information in the Mythic UI.
|
||||
Angerona automatically tracks and displays dynamic callback context information in the Mythic UI.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -139,7 +139,7 @@ Cazalla automatically tracks and displays dynamic callback context information i
|
||||
|
||||
## Artifacts Support
|
||||
|
||||
Cazalla automatically reports artifacts created during command execution, allowing Mythic to track forensic evidence.
|
||||
Angerona automatically reports artifacts created during command execution, allowing Mythic to track forensic evidence.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -176,7 +176,7 @@ Cazalla automatically reports artifacts created during command execution, allowi
|
||||
|
||||
## Credentials Support
|
||||
|
||||
Cazalla supports reporting discovered credentials to Mythic's credential store.
|
||||
Angerona supports reporting discovered credentials to Mythic's credential store.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -207,7 +207,7 @@ The `cat` command automatically detects and reports credentials from file conten
|
||||
|
||||
## SOCKS Proxy Support
|
||||
|
||||
Cazalla includes full SOCKS5 proxy support, allowing you to route traffic through the agent to access internal network resources.
|
||||
Angerona includes full SOCKS5 proxy support, allowing you to route traffic through the agent to access internal network resources.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -250,7 +250,7 @@ proxychains nmap -sT 192.168.1.0/24
|
||||
|
||||
## Reverse Port Forwarding (RPFWD) Support
|
||||
|
||||
Cazalla includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic.
|
||||
Angerona includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -287,7 +287,7 @@ curl http://<agent_ip>:8080
|
||||
|
||||
## Token Support
|
||||
|
||||
Cazalla supports Windows token manipulation and impersonation, following Mythic's Token specification.
|
||||
Angerona supports Windows token manipulation and impersonation, following Mythic's Token specification.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -319,7 +319,7 @@ Cazalla supports Windows token manipulation and impersonation, following Mythic'
|
||||
|
||||
## Keylogging Support
|
||||
|
||||
Cazalla supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature.
|
||||
Angerona supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -355,7 +355,7 @@ The keylogger works with **any Windows application** because it:
|
||||
|
||||
## File Downloads Support
|
||||
|
||||
Cazalla supports downloading files from the target to the Mythic server using chunked transfers.
|
||||
Angerona supports downloading files from the target to the Mythic server using chunked transfers.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -383,7 +383,7 @@ Cazalla supports downloading files from the target to the Mythic server using ch
|
||||
|
||||
## File Uploads Support
|
||||
|
||||
Cazalla supports uploading files from the Mythic server to the target using chunked transfers.
|
||||
Angerona supports uploading files from the Mythic server to the target using chunked transfers.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -413,7 +413,7 @@ Cazalla supports uploading files from the Mythic server to the target using chun
|
||||
|
||||
## System Information Gathering
|
||||
|
||||
Cazalla includes commands for gathering system information with low detection risk.
|
||||
Angerona includes commands for gathering system information with low detection risk.
|
||||
|
||||
### Features
|
||||
|
||||
@@ -553,7 +553,7 @@ For detailed information, see [samdump command documentation](commands/samdump.m
|
||||
|
||||
## OPSEC Checking
|
||||
|
||||
Cazalla includes comprehensive OPSEC Checking functionality that provides operational security warnings and blocking for commands based on their detection risks.
|
||||
Angerona includes comprehensive OPSEC Checking functionality that provides operational security warnings and blocking for commands based on their detection risks.
|
||||
|
||||
### Features
|
||||
|
||||
+18
-18
@@ -5,9 +5,9 @@ weight = 10
|
||||
pre = "1. "
|
||||
+++
|
||||
|
||||
# Getting Started with Cazalla
|
||||
# Getting Started with Angerona
|
||||
|
||||
This guide will help you install, configure, and deploy your first Cazalla agent.
|
||||
This guide will help you install, configure, and deploy your first Angerona agent.
|
||||
|
||||
## 📋 Prerequisites
|
||||
|
||||
@@ -18,34 +18,34 @@ This guide will help you install, configure, and deploy your first Cazalla agent
|
||||
|
||||
## 🚀 Installation
|
||||
|
||||
### Step 1: Install Cazalla on Mythic
|
||||
### Step 1: Install Angerona on Mythic
|
||||
|
||||
#### Option A: Install from GitHub (if available)
|
||||
|
||||
```bash
|
||||
cd ~/Mythic
|
||||
./mythic-cli install github https://github.com/<your-org>/Cazalla
|
||||
./mythic-cli install github https://github.com/<your-org>/Angerona
|
||||
```
|
||||
|
||||
#### Option B: Install from Local Directory
|
||||
|
||||
```bash
|
||||
cd ~/Mythic
|
||||
./mythic-cli install folder /path/to/Cazalla
|
||||
./mythic-cli install folder /path/to/Angerona
|
||||
```
|
||||
|
||||
After installation, Mythic will build the Cazalla container automatically.
|
||||
After installation, Mythic will build the Angerona container automatically.
|
||||
|
||||
### Step 2: Verify Installation
|
||||
|
||||
Check that Cazalla is installed:
|
||||
Check that Angerona is installed:
|
||||
|
||||
```bash
|
||||
cd ~/Mythic
|
||||
./mythic-cli list
|
||||
```
|
||||
|
||||
You should see `cazalla` in the list of installed payload types.
|
||||
You should see `angerona` in the list of installed payload types.
|
||||
|
||||
### Step 3: Build Your First Payload
|
||||
|
||||
@@ -55,7 +55,7 @@ You should see `cazalla` in the list of installed payload types.
|
||||
2. **Create a New Payload**
|
||||
- Click on **Payloads** in the left sidebar
|
||||
- Click **Create Payload** button
|
||||
- Select **Cazalla** as the payload type
|
||||
- Select **Angerona** as the payload type
|
||||
|
||||
3. **Configure Build Parameters**
|
||||
- **C2 Profile**: Select your configured C2 profile (HTTP, HTTPS, etc.)
|
||||
@@ -92,7 +92,7 @@ Transfer the compiled `.exe` file to your Windows target using any method:
|
||||
On the Windows target, execute the agent:
|
||||
|
||||
```cmd
|
||||
C:\path\to\cazalla.exe
|
||||
C:\path\to\angerona.exe
|
||||
```
|
||||
|
||||
The agent will start beaconing to your Mythic server immediately.
|
||||
@@ -248,7 +248,7 @@ The Mythic UI automatically displays:
|
||||
|
||||
### OPSEC Checking
|
||||
|
||||
Cazalla includes built-in OPSEC checking for high-risk operations:
|
||||
Angerona includes built-in OPSEC checking for high-risk operations:
|
||||
|
||||
- **Pre-execution blocking**: Commands like `steal_token`, `shell`, `keylog_start` require approval
|
||||
- **Post-execution warnings**: Artifacts are automatically tracked
|
||||
@@ -277,7 +277,7 @@ See [OPSEC Guide](opsec.md) for detailed information.
|
||||
- Review what the agent is creating/accessing
|
||||
|
||||
4. **Use Built-in Commands**
|
||||
- Prefer Cazalla commands (`ps`, `ls`, `cat`) over `shell` when possible
|
||||
- Prefer Angerona commands (`ps`, `ls`, `cat`) over `shell` when possible
|
||||
- Built-in commands have better OPSEC
|
||||
|
||||
5. **Review OPSEC Warnings**
|
||||
@@ -299,14 +299,14 @@ See [OPSEC Guide](opsec.md) for detailed information.
|
||||
- Review C2 profile logs
|
||||
|
||||
3. **Check Agent Execution**
|
||||
- Verify agent is running: `tasklist | findstr cazalla`
|
||||
- Verify agent is running: `tasklist | findstr angerona`
|
||||
- Check for error messages in console
|
||||
- Review Windows Event Logs
|
||||
|
||||
4. **Check Mythic Logs**
|
||||
```bash
|
||||
sudo docker logs mythic_server
|
||||
sudo docker logs cazalla_translator
|
||||
sudo docker logs angerona_translator
|
||||
```
|
||||
|
||||
### Commands Not Working
|
||||
@@ -332,13 +332,13 @@ See [OPSEC Guide](opsec.md) for detailed information.
|
||||
1. **Check Docker**
|
||||
```bash
|
||||
sudo docker ps
|
||||
sudo docker logs cazalla_translator
|
||||
sudo docker logs angerona_translator
|
||||
```
|
||||
|
||||
2. **Rebuild Container**
|
||||
```bash
|
||||
cd ~/Mythic
|
||||
sudo ./mythic-cli build cazalla
|
||||
sudo ./mythic-cli build angerona
|
||||
```
|
||||
|
||||
3. **Check Build Parameters**
|
||||
@@ -360,9 +360,9 @@ Now that you have a working agent:
|
||||
|
||||
- [Mythic Documentation](https://docs.mythic-c2.net/)
|
||||
- [Mythic Process Browser](https://docs.mythic-c2.net/customizing/hooking-features/process_list)
|
||||
- [Cazalla Main README](../README.md)
|
||||
- [Angerona Main README](../README.md)
|
||||
|
||||
---
|
||||
|
||||
**Ready to use Cazalla?** Start with the [Commands Reference](commands.md) to learn all available commands!
|
||||
**Ready to use Angerona?** Start with the [Commands Reference](commands.md) to learn all available commands!
|
||||
|
||||
+30
-30
@@ -7,11 +7,11 @@ pre = "7. "
|
||||
|
||||
# 📊 Logging & Syslog
|
||||
|
||||
Cazalla includes a complete logging system that records all Mythic events and sends them to a central syslog server for analysis and auditing.
|
||||
Angerona includes a complete logging system that records all Mythic events and sends them to a central syslog server for analysis and auditing.
|
||||
|
||||
## 🎯 Description
|
||||
|
||||
Cazalla's logging system:
|
||||
Angerona's logging system:
|
||||
|
||||
- ✅ **Logs ALL events** from Mythic automatically
|
||||
- ✅ **Does not modify the agent** (avoids detections)
|
||||
@@ -43,7 +43,7 @@ The logger is configured via a configuration file. **You don't need to modify do
|
||||
|
||||
1. **Edit the configuration file:**
|
||||
```bash
|
||||
nano Payload_Type/cazalla/logger/syslog.conf
|
||||
nano Payload_Type/angerona/logger/syslog.conf
|
||||
```
|
||||
|
||||
2. **Configure the syslog server IP:**
|
||||
@@ -64,8 +64,8 @@ The logger is configured via a configuration file. **You don't need to modify do
|
||||
3. **Rebuild and restart the container:**
|
||||
```bash
|
||||
cd /opt/mythic
|
||||
sudo ./mythic-cli build cazalla
|
||||
sudo ./mythic-cli restart cazalla
|
||||
sudo ./mythic-cli build angerona
|
||||
sudo ./mythic-cli restart angerona
|
||||
```
|
||||
|
||||
### Step 2: Configure rsyslog on the Host (Optional)
|
||||
@@ -83,12 +83,12 @@ If you want to receive logs on the same server where Mythic runs:
|
||||
sudo sed -i 's/#input(type="imudp" port="514")/input(type="imudp" port="514")/' /etc/rsyslog.conf
|
||||
```
|
||||
|
||||
3. **Create rule for Cazalla** in `/etc/rsyslog.d/50-cazalla.conf`:
|
||||
3. **Create rule for Angerona** in `/etc/rsyslog.d/50-angerona.conf`:
|
||||
```bash
|
||||
sudo bash -c 'cat > /etc/rsyslog.d/50-cazalla.conf << EOF
|
||||
# Logs from Cazalla Mythic agent
|
||||
sudo bash -c 'cat > /etc/rsyslog.d/50-angerona.conf << EOF
|
||||
# Logs from Angerona Mythic agent
|
||||
# Filter by facility LOCAL0 (16)
|
||||
if \$syslogfacility-text == "local0" then /var/log/cazalla.log
|
||||
if \$syslogfacility-text == "local0" then /var/log/angerona.log
|
||||
& stop
|
||||
EOF
|
||||
'
|
||||
@@ -112,34 +112,34 @@ If you want to receive logs on the same server where Mythic runs:
|
||||
|
||||
```bash
|
||||
# View container logs
|
||||
sudo docker logs cazalla | grep -i "syslog\|Logger initialized"
|
||||
sudo docker logs angerona | grep -i "syslog\|Logger initialized"
|
||||
|
||||
# You should see:
|
||||
# INFO:cazalla_logger:Syslog client initialized: 10.8.20.50:514 (facility=16)
|
||||
# INFO:cazalla_logger:Logger initialized: cazalla_logger
|
||||
# INFO:angerona_logger:Syslog client initialized: 10.8.20.50:514 (facility=16)
|
||||
# INFO:angerona_logger:Logger initialized: angerona_logger
|
||||
```
|
||||
|
||||
### View Logs in Real-Time
|
||||
|
||||
```bash
|
||||
# View logs in syslog (host)
|
||||
sudo tail -f /var/log/cazalla.log
|
||||
sudo tail -f /var/log/angerona.log
|
||||
|
||||
# View local logs (inside container)
|
||||
sudo docker exec cazalla tail -f /tmp/cazalla_mythic_$(date +%Y-%m-%d).log
|
||||
sudo docker exec angerona tail -f /tmp/angerona_mythic_$(date +%Y-%m-%d).log
|
||||
```
|
||||
|
||||
### View Specific Events
|
||||
|
||||
```bash
|
||||
# View only tasks
|
||||
sudo tail -100 /var/log/cazalla.log | grep '"event_type": "TASK"'
|
||||
sudo tail -100 /var/log/angerona.log | grep '"event_type": "TASK"'
|
||||
|
||||
# View only responses
|
||||
sudo tail -100 /var/log/cazalla.log | grep '"event_type": "RESPONSE"'
|
||||
sudo tail -100 /var/log/angerona.log | grep '"event_type": "RESPONSE"'
|
||||
|
||||
# Count events by type
|
||||
sudo tail -1000 /var/log/cazalla.log | grep -o '"event_type": "[^"]*"' | sort | uniq -c
|
||||
sudo tail -1000 /var/log/angerona.log | grep -o '"event_type": "[^"]*"' | sort | uniq -c
|
||||
```
|
||||
|
||||
## 📝 Log Format
|
||||
@@ -169,11 +169,11 @@ Logs are saved in structured JSON format for easy parsing:
|
||||
|
||||
### Log Locations
|
||||
|
||||
- **Syslog (host)**: `/var/log/cazalla.log`
|
||||
- **Local logs (container)**: `/tmp/cazalla_mythic_YYYY-MM-DD.log`
|
||||
- **Syslog (host)**: `/var/log/angerona.log`
|
||||
- **Local logs (container)**: `/tmp/angerona_mythic_YYYY-MM-DD.log`
|
||||
- One file per day
|
||||
- No rotation (all files are kept)
|
||||
- Format: `cazalla_mythic_2025-11-17.log`
|
||||
- Format: `angerona_mythic_2025-11-17.log`
|
||||
|
||||
## 🔍 Usage Examples
|
||||
|
||||
@@ -181,28 +181,28 @@ Logs are saved in structured JSON format for easy parsing:
|
||||
|
||||
```bash
|
||||
# Search for all 'whoami' executions
|
||||
sudo grep -i "whoami" /var/log/cazalla.log | grep '"event_type": "TASK"'
|
||||
sudo grep -i "whoami" /var/log/angerona.log | grep '"event_type": "TASK"'
|
||||
```
|
||||
|
||||
### View Operator Activity
|
||||
|
||||
```bash
|
||||
# View all events from a user
|
||||
sudo grep '"username": "mythic_admin"' /var/log/cazalla.log
|
||||
sudo grep '"username": "mythic_admin"' /var/log/angerona.log
|
||||
```
|
||||
|
||||
### View Captured Credentials
|
||||
|
||||
```bash
|
||||
# View credential events
|
||||
sudo grep '"event_type": "CREDENTIAL"' /var/log/cazalla.log
|
||||
sudo grep '"event_type": "CREDENTIAL"' /var/log/angerona.log
|
||||
```
|
||||
|
||||
### Analyze Generated Artifacts
|
||||
|
||||
```bash
|
||||
# View all artifacts (detected IOCs)
|
||||
sudo grep '"event_type": "ARTIFACT"' /var/log/cazalla.log
|
||||
sudo grep '"event_type": "ARTIFACT"' /var/log/angerona.log
|
||||
```
|
||||
|
||||
## 🛠️ Troubleshooting
|
||||
@@ -211,15 +211,15 @@ sudo grep '"event_type": "ARTIFACT"' /var/log/cazalla.log
|
||||
|
||||
**Solution:**
|
||||
1. Verify the logger is imported in `main.py`
|
||||
2. Rebuild the container: `sudo ./mythic-cli build cazalla`
|
||||
3. Restart: `sudo ./mythic-cli restart cazalla`
|
||||
2. Rebuild the container: `sudo ./mythic-cli build angerona`
|
||||
3. Restart: `sudo ./mythic-cli restart angerona`
|
||||
|
||||
### Don't See "Syslog client initialized"
|
||||
|
||||
**Solution:**
|
||||
1. Verify `SYSLOG_SERVER` has a value in `syslog.conf`:
|
||||
```bash
|
||||
sudo docker exec cazalla cat /Mythic/logger/syslog.conf | grep SYSLOG_SERVER
|
||||
sudo docker exec angerona cat /Mythic/logger/syslog.conf | grep SYSLOG_SERVER
|
||||
```
|
||||
2. Rebuild the container if you just edited the file
|
||||
|
||||
@@ -228,7 +228,7 @@ sudo grep '"event_type": "ARTIFACT"' /var/log/cazalla.log
|
||||
**Solution:**
|
||||
1. Verify rsyslog is listening: `sudo netstat -ulnp | grep 514`
|
||||
2. Verify connectivity from container to host
|
||||
3. Verify rsyslog configuration: `sudo cat /etc/rsyslog.d/50-cazalla.conf`
|
||||
3. Verify rsyslog configuration: `sudo cat /etc/rsyslog.d/50-angerona.conf`
|
||||
4. Verify firewall: `sudo iptables -L -n | grep 514`
|
||||
|
||||
### Logs Are Empty
|
||||
@@ -268,11 +268,11 @@ The JSON formatted logs can be easily integrated with SIEMs such as:
|
||||
- Graylog
|
||||
- QRadar
|
||||
|
||||
Simply configure the SIEM to read from `/var/log/cazalla.log` or from the central syslog server.
|
||||
Simply configure the SIEM to read from `/var/log/angerona.log` or from the central syslog server.
|
||||
|
||||
## 🔗 References
|
||||
|
||||
- [Logger Technical Documentation](../Payload_Type/cazalla/logger/README.md)
|
||||
- [Logger Technical Documentation](../Payload_Type/angerona/logger/README.md)
|
||||
- [Mythic Logging Documentation](https://docs.mythic-c2.net/customizing/3.-consuming-containers/logging)
|
||||
- [RFC 3164 - The BSD syslog Protocol](https://tools.ietf.org/html/rfc3164)
|
||||
|
||||
@@ -5,9 +5,9 @@ weight = 10
|
||||
pre = "3. "
|
||||
+++
|
||||
|
||||
# OPSEC Guide for Cazalla
|
||||
# OPSEC Guide for Angerona
|
||||
|
||||
This guide covers operational security considerations when using Cazalla agent, including detection risks, best practices, and the built-in OPSEC checking system.
|
||||
This guide covers operational security considerations when using Angerona agent, including detection risks, best practices, and the built-in OPSEC checking system.
|
||||
|
||||
## 📋 Table of Contents
|
||||
|
||||
@@ -22,12 +22,12 @@ This guide covers operational security considerations when using Cazalla agent,
|
||||
|
||||
## Overview
|
||||
|
||||
Operational Security (OPSEC) is critical when conducting red team operations. Cazalla includes built-in OPSEC checking to help operators make informed decisions and avoid accidental security violations.
|
||||
Operational Security (OPSEC) is critical when conducting red team operations. Angerona includes built-in OPSEC checking to help operators make informed decisions and avoid accidental security violations.
|
||||
|
||||
### Key Principles
|
||||
|
||||
1. **Minimize Detection**: Avoid commands and behaviors that trigger security alerts
|
||||
2. **Use Built-in Commands**: Prefer Cazalla's native commands over `shell` when possible
|
||||
2. **Use Built-in Commands**: Prefer Angerona's native commands over `shell` when possible
|
||||
3. **Monitor Artifacts**: Review artifacts created by commands
|
||||
4. **Review OPSEC Warnings**: Always read and understand OPSEC popup messages
|
||||
5. **Operational Timing**: Adjust sleep intervals and jitter based on operational needs
|
||||
@@ -36,7 +36,7 @@ Operational Security (OPSEC) is critical when conducting red team operations. Ca
|
||||
|
||||
## OPSEC Checking System
|
||||
|
||||
Cazalla implements a two-stage OPSEC checking system:
|
||||
Angerona implements a two-stage OPSEC checking system:
|
||||
|
||||
### OPSEC Pre-Check (`opsec_pre`)
|
||||
|
||||
@@ -77,7 +77,7 @@ These commands are **highly detectable** and require careful consideration:
|
||||
|
||||
| Command | Risk Level | Detection Likelihood | Alternatives |
|
||||
|---------|-----------|---------------------|--------------|
|
||||
| `shell` | HIGH | High (cmd.exe spawn) | Use built-in Cazalla commands when possible |
|
||||
| `shell` | HIGH | High (cmd.exe spawn) | Use built-in Angerona commands when possible |
|
||||
| `steal_token` | HIGH | High (EDR/XDR monitoring) | `make_token` when credentials available |
|
||||
| `rm` (system files) | HIGH | Blocked for safety | Never delete system files |
|
||||
| `screenshot` | HIGH | Screen capture detection | Use sparingly, consider timing |
|
||||
@@ -129,7 +129,7 @@ These commands have **low detection risk**:
|
||||
- **File Operations**: File writes to sensitive locations trigger alerts
|
||||
|
||||
**Mitigation Strategies:**
|
||||
- Use built-in Cazalla commands instead of `shell` when possible
|
||||
- Use built-in Angerona commands instead of `shell` when possible
|
||||
- Use `inline_execute_assembly` for .NET assembly execution (in-process, no process injection)
|
||||
- Use `inline_execute` for BOFs when possible (no process creation)
|
||||
- Prefer `make_token` over `steal_token` when credentials are available
|
||||
@@ -201,7 +201,7 @@ ps
|
||||
ls
|
||||
```
|
||||
|
||||
Built-in Cazalla commands:
|
||||
Built-in Angerona commands:
|
||||
- Don't spawn `cmd.exe` (highly monitored)
|
||||
- Have better OPSEC characteristics
|
||||
- Provide structured output
|
||||
@@ -433,14 +433,14 @@ The `samdump` command supports three methods with different OPSEC profiles:
|
||||
```
|
||||
🚨 OPSEC BLOCKED - Command Has Safer Alternative
|
||||
|
||||
This command contains operations that have safer built-in alternatives in Cazalla:
|
||||
This command contains operations that have safer built-in alternatives in Angerona:
|
||||
|
||||
🚨 whoami: Use Cazalla's 'whoami' command instead (no cmd.exe spawn)
|
||||
🚨 whoami: Use Angerona's 'whoami' command instead (no cmd.exe spawn)
|
||||
|
||||
⚠️ cmd.exe spawn: This command would spawn cmd.exe (highly detectable)
|
||||
|
||||
💡 SAFER ALTERNATIVES:
|
||||
→ Use: 'whoami' (Cazalla built-in, no cmd.exe)
|
||||
→ Use: 'whoami' (Angerona built-in, no cmd.exe)
|
||||
|
||||
⚠️ TO PROCEED: You need approval from another operator.
|
||||
```
|
||||
+17
-17
@@ -5,9 +5,9 @@ weight = 10
|
||||
pre = "6. "
|
||||
+++
|
||||
|
||||
# Cazalla Troubleshooting Guide
|
||||
# Angerona Troubleshooting Guide
|
||||
|
||||
This guide helps you diagnose and resolve common issues when using Cazalla agent.
|
||||
This guide helps you diagnose and resolve common issues when using Angerona agent.
|
||||
|
||||
## 📋 Table of Contents
|
||||
|
||||
@@ -49,15 +49,15 @@ This guide helps you diagnose and resolve common issues when using Cazalla agent
|
||||
3. **Check Agent Execution**
|
||||
```cmd
|
||||
# On Windows target
|
||||
tasklist | findstr cazalla
|
||||
# Should show cazalla.exe process
|
||||
tasklist | findstr angerona
|
||||
# Should show angerona.exe process
|
||||
```
|
||||
|
||||
4. **Check Mythic Logs**
|
||||
```bash
|
||||
# On Mythic server
|
||||
sudo docker logs mythic_server
|
||||
sudo docker logs cazalla_translator
|
||||
sudo docker logs angerona_translator
|
||||
```
|
||||
|
||||
**Solutions:**
|
||||
@@ -186,8 +186,8 @@ cat file.txt
|
||||
|
||||
3. **Check Logs**
|
||||
```bash
|
||||
sudo docker logs cazalla_translator | grep -i download
|
||||
sudo docker logs cazalla_translator | grep -i upload
|
||||
sudo docker logs angerona_translator | grep -i download
|
||||
sudo docker logs angerona_translator | grep -i upload
|
||||
```
|
||||
|
||||
**Solutions:**
|
||||
@@ -204,7 +204,7 @@ cat file.txt
|
||||
|
||||
**Solution:**
|
||||
|
||||
Cazalla automatically normalizes paths, but if issues persist:
|
||||
Angerona automatically normalizes paths, but if issues persist:
|
||||
- Use single backslashes: `C:\Users\file.txt`
|
||||
- Use forward slashes: `C:/Users/file.txt`
|
||||
- Avoid double backslashes: `C:\\Users\\file.txt` (will be normalized automatically)
|
||||
@@ -228,7 +228,7 @@ Cazalla automatically normalizes paths, but if issues persist:
|
||||
|
||||
2. **Check Translator Logs**
|
||||
```bash
|
||||
sudo docker logs cazalla_translator | grep -i process
|
||||
sudo docker logs angerona_translator | grep -i process
|
||||
```
|
||||
|
||||
3. **Verify Process Browser Integration**
|
||||
@@ -237,7 +237,7 @@ Cazalla automatically normalizes paths, but if issues persist:
|
||||
|
||||
**Solutions:**
|
||||
|
||||
- **Rebuild Translator**: `sudo ./mythic-cli build cazalla`
|
||||
- **Rebuild Translator**: `sudo ./mythic-cli build angerona`
|
||||
- **Check Process Parsing**: Verify translator is parsing process list correctly
|
||||
- **Check Permissions**: Some processes may require elevated privileges
|
||||
|
||||
@@ -360,7 +360,7 @@ Cazalla automatically normalizes paths, but if issues persist:
|
||||
|
||||
4. **Check Translator Logs**
|
||||
```bash
|
||||
sudo docker logs cazalla_translator | grep -i socks
|
||||
sudo docker logs angerona_translator | grep -i socks
|
||||
```
|
||||
|
||||
**Solutions:**
|
||||
@@ -414,7 +414,7 @@ Cazalla automatically normalizes paths, but if issues persist:
|
||||
1. **Check Docker**
|
||||
```bash
|
||||
sudo docker ps
|
||||
sudo docker logs cazalla_translator
|
||||
sudo docker logs angerona_translator
|
||||
```
|
||||
|
||||
2. **Check Build Parameters**
|
||||
@@ -450,7 +450,7 @@ Cazalla automatically normalizes paths, but if issues persist:
|
||||
|
||||
3. **Check Translator Logs**
|
||||
```bash
|
||||
sudo docker logs cazalla_translator | grep -i crypto
|
||||
sudo docker logs angerona_translator | grep -i crypto
|
||||
```
|
||||
|
||||
**Solutions:**
|
||||
@@ -484,7 +484,7 @@ Cazalla automatically normalizes paths, but if issues persist:
|
||||
|
||||
3. **Rebuild Translator**
|
||||
```bash
|
||||
sudo ./mythic-cli build cazalla
|
||||
sudo ./mythic-cli build angerona
|
||||
```
|
||||
|
||||
### File Browser Not Working
|
||||
@@ -530,7 +530,7 @@ Cazalla automatically normalizes paths, but if issues persist:
|
||||
|
||||
2. **Check Translator Logs**
|
||||
```bash
|
||||
sudo docker logs cazalla_translator | grep -i context
|
||||
sudo docker logs angerona_translator | grep -i context
|
||||
```
|
||||
|
||||
3. **Verify Context Format**
|
||||
@@ -548,7 +548,7 @@ Cazalla automatically normalizes paths, but if issues persist:
|
||||
- Rebuild agent with debug flags
|
||||
|
||||
**Translator Side:**
|
||||
- Check translator logs: `sudo docker logs cazalla_translator`
|
||||
- Check translator logs: `sudo docker logs angerona_translator`
|
||||
- Look for error messages and warnings
|
||||
|
||||
### Check Agent Status
|
||||
@@ -575,7 +575,7 @@ sudo docker logs mythic_server
|
||||
|
||||
**Translator Logs:**
|
||||
```bash
|
||||
sudo docker logs cazalla_translator
|
||||
sudo docker logs angerona_translator
|
||||
```
|
||||
|
||||
**Agent Logs:**
|
||||
Reference in New Issue
Block a user