File Browser completed

This commit is contained in:
marcos.luna
2025-10-31 12:00:15 +01:00
parent 519d2a8946
commit eca961ac50
8 changed files with 739 additions and 41 deletions
+62 -11
View File
@@ -27,7 +27,7 @@
- [Credentials Support](#credentials-support)
- [File Downloads Support](#file-downloads-support)
- [File Uploads Support](#file-uploads-support)
- [⌨️ Keylogging Support](#%EF%B8%8F-keylogging-support)
- [Keylogging Support](#%EF%B8%8F-keylogging-support)
- [Development](#development)
- [Troubleshooting](#troubleshooting)
- [Credits](#credits)
@@ -905,9 +905,11 @@ Cazalla supports uploading files from the Mythic server to the target using chun
- **Chunked File Transfers**: Large files are automatically split into chunks (512KB default) for efficient transfer
- **Automatic Path Normalization**: Automatically handles path formatting (normalizes double backslashes)
- **Smart Path Handling**: Automatically appends filename when path is a directory
- **Smart Path Handling**: Automatically appends filename when path is a directory or doesn't have a file extension
- **File Browser Integration**: Fully integrated with Mythic's File Browser UI - upload files directly from the browser
- **Progress Tracking**: Mythic tracks upload progress (chunks sent/total chunks)
- **File Write Artifacts**: Automatically reports File Write artifacts when files are uploaded
- **Parent Directory Creation**: Automatically creates parent directories if they don't exist
### How It Works
@@ -927,14 +929,34 @@ Cazalla supports uploading files from the Mythic server to the target using chun
### Using the Upload Command
#### From Command Line
```bash
# Upload a file to the target
# Select file from Mythic UI file selector, then specify destination path
upload <file> C:\Users\localuser\Downloads\file.txt
upload <file_id> C:\Users\localuser\Downloads\file.txt
# If path is a directory, filename is automatically appended
upload <file_id> C:\Users\localuser\Downloads
# → Automatically becomes: C:\Users\localuser\Downloads\<filename>
# Uploads are chunked automatically - Mythic will show progress
```
#### From File Browser UI
The `upload` command is fully integrated with Mythic's File Browser:
1. Navigate to **Files** icon in the top navigation
2. Browse to the target directory where you want to upload
3. Click the **Upload** button (or right-click on a directory)
4. Select the file from your local system
5. The agent automatically detects if the path is a directory and appends the filename
**Note**: When uploading from the File Browser, you can specify:
- A full file path: `C:\Users\localuser\Downloads\file.txt` → Uploads to exact path
- A directory path: `C:\Users\localuser\Downloads` → Automatically appends filename from source file
### Upload Process
1. **Request**: Agent sends upload request to Mythic for each chunk:
@@ -969,12 +991,22 @@ Mythic: File Write artifact created
### Path Handling
The upload command includes smart path handling:
The upload command includes smart path handling with multiple detection methods:
- **Normalization**: Automatically normalizes double backslashes (`C:\\\\Users` → `C:\Users`)
- **Directory Detection**: If the path is a directory, automatically appends the filename from Mythic
- **Full Path Resolution**: Uses `GetFullPathName` to resolve relative paths to absolute paths
- **Error Handling**: Clear error messages for invalid paths, access denied, or directory issues
- **Invalid Character Cleaning**: Removes null bytes, carriage returns, newlines, and other invalid characters
- **Directory Detection**: Multiple heuristics to detect directories:
- Path ends with `\` or `/` → Treated as directory, filename appended
- Path has no file extension in the last component → Treated as directory, filename appended
- Path is a drive letter (e.g., `C:`) → Treated as directory, filename appended
- Path exists and is a directory → Treated as directory, error reported if no filename
- **Full Path Resolution**: Uses `GetFullPathNameA` to resolve relative paths to absolute paths
- **Parent Directory Creation**: Automatically creates parent directories if they don't exist
- **Error Handling**: Clear error messages for:
- Invalid paths (Error 123: invalid filename syntax)
- Directory without filename specified
- Access denied errors
- Path not found errors
### Implementation Details
@@ -987,10 +1019,13 @@ The upload system uses:
### Error Handling
The upload command handles various error scenarios:
- **Invalid Path**: Returns error if path is invalid or malformed
- **Directory as Path**: Detects and reports error if path is a directory without filename
- **Invalid Path (Error 123)**: Returns error if path contains invalid characters or malformed syntax
- Automatically cleans null bytes, control characters, and invalid path characters
- Handles UNC paths (`\\server\share`) correctly
- **Directory as Path**: Detects and reports clear error if path is a directory without filename
- Error message: "El path es un directorio existente. Especifique un nombre de archivo"
- **Access Denied**: Returns Windows error code if file cannot be created/written
- **Path Not Found**: Returns error if parent directory does not exist
- **Path Not Found**: Automatically creates parent directories, or returns error if creation fails
### Viewing Upload Artifacts
@@ -999,7 +1034,23 @@ The upload command handles various error scenarios:
3. Filter by "File Write" artifact type
4. View all files that were uploaded, including file paths and timestamps
For more information, see the [Mythic File Upload documentation](https://docs.mythic-c2.net/customizing/hooking-features/action-upload).
### File Browser Integration
The `upload` command supports Mythic's File Browser UI feature (`file_browser:upload`):
- **Seamless Integration**: Upload files directly from the File Browser interface
- **Smart Path Resolution**: Automatically handles directory paths from File Browser
- **Progress Tracking**: Real-time progress visible in Mythic UI
- **Artifact Tracking**: All uploads automatically logged as "File Write" artifacts
**How it works**:
1. File Browser sends `path` parameter with directory path (e.g., `C:\Users\localuser\Downloads`)
2. Python `upload.py` detects the path is a directory (no file extension)
3. Retrieves the original filename from the `file_id` via Mythic RPC
4. Automatically appends filename to directory path
5. Sends complete path to agent: `C:\Users\localuser\Downloads\config.json`
For more information, see the [Mythic File Upload documentation](https://docs.mythic-c2.net/customizing/hooking-features/action-upload) and [File Browser documentation](https://docs.mythic-c2.net/customizing/hooking-features/file-browser).
---