gerardo.ruiz
302 lines
8.0 KiB
Markdown
302 lines
8.0 KiB
Markdown
# Cazalla - Basic Mythic Implant in C
|
||
|
||
Cazalla is a basic Windows implant written in C, designed to interface with the Mythic C2 framework.
|
||
|
||
This project was developed based on the article [How to build your own Mythic agent in C](https://red-team-sncf.github.io/how-to-create-your-own-mythic-agent-in-c.html) and serves as an initial version of an implant with room for future improvements.
|
||
|
||
Cazalla is developed by the OFSTeam at Kaseya.
|
||
|
||
## Supported Commands
|
||
|
||
Commands are organized by category for better clarity and extensibility.
|
||
|
||
### 📁 File System Commands
|
||
| Command | Description | Status |
|
||
|---------|--------------------------|---------|
|
||
| `cd` | Change working directory | ✅ |
|
||
| `ls` | List directory contents | ✅ |
|
||
| `pwd` | Print working directory | ✅ |
|
||
| `cp` | Copy an existing file | ✅ |
|
||
| `mkdir` | Create a new directory | ✅ |
|
||
| `rm` | Delete file/directory | ✅ |
|
||
|
||
### 🖥️ Console Commands
|
||
| Command | Description | Status |
|
||
|---------|-------------------------------------|--------|
|
||
| `shell`| Execute arbitrary shell command | ✅ |
|
||
|
||
### 🔄 Execution Control
|
||
| Command | Description | Status |
|
||
|---------|-------------------|--------|
|
||
| `exit` | Exit the implant | ✅ |
|
||
| `sleep`| Modify sleep time | ✅ |
|
||
|
||
### 🧠 System Inspection
|
||
| Command | Description | Status |
|
||
|---------|-----------------------|--------|
|
||
| `ps` | List running processes| ✅ |
|
||
|
||
> 🔧 To add a new command, see the [Creating New Commands](#creating-new-commands) section below.
|
||
|
||
---
|
||
|
||
## Install Cazalla
|
||
|
||
Once Mythic is installed and running, use the following command to install Cazalla:
|
||
|
||
```sh
|
||
./mythic-cli install github <repository-url>
|
||
```
|
||
|
||
## Communication Protocol
|
||
|
||
### HEADER - Implant to C2
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------|-------------------|------------|
|
||
| UUID | 36 | Str (char*)|
|
||
| Action | 1 | UInt32 |
|
||
|
||
### HEADER - C2 to Implant
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------|-------------------|------------|
|
||
| Action | 1 | Int32 |
|
||
|
||
UUID | BODY
|
||
|
||
#### Checkin - Implant to C2
|
||
|
||
Expected:
|
||
|
||
```json
|
||
{
|
||
"action": "checkin",
|
||
"uuid": "a21bab2e-462e-49ab-9800-fbedaf53ad15",
|
||
"ip": "127.0.0.1",
|
||
"os": "win",
|
||
"arch": "x64",
|
||
"hostname": "PC",
|
||
"user": "bob",
|
||
"domain": "domain.com",
|
||
"pid": 123,
|
||
"processname": "malware.exe"
|
||
}
|
||
```
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------------|-------------------|-------------|
|
||
| UUID | 36 | Str (char*) |
|
||
| Size IP | 4 | Uint32 |
|
||
| IP | Size IP | Str (char*) |
|
||
| Size OS | 4 | Uint32 |
|
||
| OS | Size OS | Str (char*) |
|
||
| Architecture | 1 | Int |
|
||
| Size Hostname | 4 | Uint32 |
|
||
| HostName | Size Hostname | Str (char*) |
|
||
| Size Username | 4 | Uint32 |
|
||
| Username | Size Username | Str (char*) |
|
||
| Size Domain | 4 | Uint32 |
|
||
| Domain | Size Domain | Str (char*) |
|
||
| PID | 4 | Uint32 |
|
||
| Size Process | 4 | Uint32 |
|
||
| Process Name | Size Process Name | Str (char*) |
|
||
| Size ExternIP | 4 | Uint32 |
|
||
| Extern IP | Size Extern IP | Str (char*) |
|
||
|
||
### Checkin - C2 to Implant
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|----------|-------------------|-------------|
|
||
| New UUID | 36 | Str (char*) |
|
||
| Status | 1 | Byte |
|
||
|
||
### GetTasking - Implant to C2
|
||
|
||
Expected:
|
||
|
||
```json
|
||
{
|
||
"action": "get_tasking",
|
||
"tasking_size": 1
|
||
}
|
||
```
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------------|-------------------|-------------|
|
||
| Number tasks | 4 | Uint32 |
|
||
|
||
### GetTasking - C2 to Implant
|
||
|
||
Expected:
|
||
|
||
```json
|
||
{
|
||
"action": "get_tasking",
|
||
"tasks": [
|
||
{
|
||
"command": "command name",
|
||
"parameters": "command param string",
|
||
"timestamp": 1578706611.324671,
|
||
"id": "task uuid"
|
||
}
|
||
]
|
||
}
|
||
```
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------------|-------------------|-------------|
|
||
| NumberOfTasks | 4 | Uint32 |
|
||
| Size Of Task1 | 4 | Uint32 |
|
||
| Task1 CMD | 1 | Int |
|
||
| Task1 UUID | 36 | Str (char*) |
|
||
| Task1 LenPara1| 4 | Uint32 |
|
||
| Task1 Param1 | LenParam1 Task1 | Str(char*) |
|
||
|
||
### Post Response Header - Implant to C2
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------------|-------------------|-------------|
|
||
| Number Resp | 4 | Uint32 |
|
||
|
||
### Post Response Header - C2 to Implant
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------------|-------------------|-------------|
|
||
| Number Resp | 4 | Uint32 |
|
||
|
||
### Post Response Classic Output Return - Implant to C2
|
||
|
||
Expected:
|
||
|
||
```json
|
||
{
|
||
"action": "post_response",
|
||
"responses": [
|
||
{
|
||
"task_id": "uuid of task",
|
||
... response message
|
||
}
|
||
]
|
||
}
|
||
```
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------------|-------------------|-------------|
|
||
| UUID Resp 1 | 36 | Str (char*) |
|
||
| Size Output R1| 4 | Uint32 |
|
||
| Output R1 | Size Output | Bytes |
|
||
| Status R1 | 1 | Int |
|
||
|
||
### Post Response Classic Output Return - C2 to Implant
|
||
|
||
Expected:
|
||
|
||
```json
|
||
{
|
||
"action": "post_response",
|
||
"responses": [
|
||
{
|
||
"task_id": UUID,
|
||
"status": "success" or "error",
|
||
"error": "error message if it exists"
|
||
}
|
||
]
|
||
}
|
||
```
|
||
|
||
| Key | Key Len (bytes) | Type |
|
||
|---------------|-------------------|-------------|
|
||
| Status Resp1 | 1 | Int |
|
||
|
||
## Creating New Commands
|
||
|
||
### 📦 Mythic Side (Python)
|
||
|
||
To add a new command in Mythic, create a `.py` file inside the agent's command folder (e.g., `shell.py`). A basic structure includes:
|
||
|
||
- TaskArguments class
|
||
- CommandBase class
|
||
|
||
Example: `shell.py`
|
||
|
||
```python
|
||
class ShellArguments(TaskArguments):
|
||
def __init__(self, command_line, **kwargs):
|
||
...
|
||
self.args = [
|
||
CommandParameter(name="command", type=ParameterType.String, ...)
|
||
]
|
||
|
||
class ShellCommand(CommandBase):
|
||
cmd = "shell"
|
||
...
|
||
async def create_tasking(self, task: MythicTask):
|
||
...
|
||
|
||
async def process_response(self, task, response):
|
||
...
|
||
|
||
```
|
||
### 🧠 C2 Side (Python - `commands_from_c2.py`)
|
||
|
||
Update the commands dictionary with a unique hex code and input type:
|
||
|
||
```python
|
||
commands = {
|
||
...
|
||
"newcmd": {"hex_code": 0xAB, "input_type": "string"}
|
||
}
|
||
```
|
||
Update `responseTasking` to handle serialization of the new command’s parameters.
|
||
|
||
### 💻 Implant Side (C)
|
||
|
||
Update the following files:
|
||
|
||
`comandos.h`
|
||
```c
|
||
#define NEWCMD_CMD 0xAB
|
||
BOOL ejecutarNuevoCmd(PAnalizador argumentos);
|
||
```
|
||
`comandos.c`
|
||
Add your command logic in `handleGetTasking()`:
|
||
```c
|
||
else if (tarea == NEWCMD_CMD) {
|
||
ejecutarNuevoCmd(analizadorTarea);
|
||
}
|
||
```
|
||
`nuevo_cmd.c` and `nuevo_cmd.h`
|
||
Create your new command implementation.
|
||
```c
|
||
BOOL ejecutarNuevoCmd(PAnalizador argumentos) {
|
||
// handle parsing and execution here
|
||
}
|
||
```
|
||
Don’t forget to add the source file to the build and include its header where needed.
|
||
|
||
## Future Development
|
||
|
||
### Planned improvements:
|
||
|
||
#### Improvements to perform ASAP:
|
||
|
||
- Proxy
|
||
|
||
https://github.com/jeeschr/basic-proxy-server/blob/master/proxy.c
|
||
|
||
- BOFexecute
|
||
- rportfwd
|
||
|
||
https://github.com/fidian/tcp-port-forward/blob/master/portforward.c
|
||
https://www.reddit.com/r/C_Programming/s/bWOTxm6phn
|
||
|
||
|
||
#### Improvements tier 2:
|
||
|
||
- Persistence and evasion mechanisms
|
||
- Full implementation of pwd
|
||
- Additional file system and process control commands
|
||
- File upload/download
|
||
|
||
Made with ☕ and monster by the Kaseya OFSTeam |