kitos/Angerona
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
3978a16fab52c65edf1db0aabe59755b01ab9f7a
Angerona/documentation-payload/Cazalla/features.md
T
marcos.luna 3978a16fab Bof Loader implemented
2025-12-11 15:41:44 +01:00

20 KiB
Raw Blame History

+++ title = "Features" chapter = false weight = 10 pre = "2. " +++

Cazalla Features Overview

This document provides detailed explanations of Cazalla's key features and capabilities.

📋 Table of Contents

Process Browser Integration

Cazalla fully integrates with Mythic's Process Browser feature, providing unified process management across multiple callbacks on the same host.

Features

  • Unified Process Lists: All process listings from different callbacks on the same host are aggregated
  • Process Hierarchy: View process parent-child relationships when parent process IDs are available
  • Rich Process Data: Includes process name, PID, PPID, architecture, user account, and session ID
  • Automatic Synchronization: Process lists are automatically synchronized with Mythic's Process Browser UI
  • Process Actions: Kill processes, steal tokens, and list tokens directly from the Process Browser UI
  • Cache Management: Process lists automatically clear stale entries using update_deleted=True flag

How It Works

  1. Execute ps command: The agent enumerates all running processes
  2. Translator Conversion: The translator automatically converts the process list to Mythic's Process Browser JSON format
  3. UI Update: Processes appear in the Process Browser UI with all details
  4. Interactive Actions: You can perform actions directly from the UI:
    • Kill: Terminate a process (uses kill command)
    • Steal Token: Steal token from a process (uses steal_token command)
    • List Tokens: List tokens from a process (uses list_tokens command)

Accessing Process Browser

  1. Navigate to a callback in the Mythic UI
  2. Click the PROCESSES tab (next to the CALLBACK tab)
  3. View all processes from all callbacks on that host
  4. Use UI buttons for process actions

Implementation Details

  • ps Command: Implements process_browser:list supported UI feature
  • kill Command: Implements process_browser:kill supported UI feature
  • Process Data Format: Includes PID, process name, PPID, architecture, user, session ID
  • Automatic Cache Clearing: All processes marked with update_deleted=True to clear stale entries

File Browser Integration

Cazalla seamlessly integrates with Mythic's File Browser, allowing visual file system navigation and operations.

Features

  • Visual Navigation: Browse directories and files visually through the Mythic UI
  • Drag-and-Drop Downloads: Download files with a simple click
  • Upload Integration: Upload files directly from the File Browser interface
  • Automatic Path Resolution: Relative paths are automatically resolved using the current working directory
  • Real-time Updates: File listings update automatically as you navigate

How It Works

  1. Execute ls command: The agent lists directory contents
  2. Translator Conversion: The translator converts the listing to Mythic's File Browser format
  3. UI Display: Files and directories appear in the File Browser UI
  4. Interactive Operations: Perform file operations directly from the UI:
    • Download: Click file → Download
    • Upload: Right-click directory → Upload
    • Delete: Right-click file → Delete (uses rm command)

Accessing File Browser

  1. Navigate to a callback in the Mythic UI
  2. Click the Files icon in the top navigation
  3. Browse directories and files visually
  4. Perform operations directly from the UI

Path Handling

  • Relative Paths: Automatically resolved using the current working directory
  • Absolute Paths: Full paths work as expected
  • Path Normalization: Double backslashes and invalid characters are automatically handled

Context Tracking

Cazalla automatically tracks and displays dynamic callback context information in the Mythic UI.

Features

  • Current Working Directory: Displays the agent's current directory
  • Impersonation Context: Shows the currently impersonated user (if any)
  • Real-time Updates: Context tabs update automatically as the agent's state changes
  • Visual Display: Context information appears as tabs above the tasking area

Supported Context Fields

Current Working Directory (cwd)

  • Updated by: cd command
  • Initial value: Automatically set during check-in
  • Display: Shows the current directory path (e.g., C:\Users\localuser\Downloads)

Impersonation Context (impersonation_context)

  • Updated by: steal_token, make_token, rev2self
  • Initial value: Automatically set during check-in with the process's current user
  • Display: Shows the currently impersonated user (e.g., NT AUTHORITY\SYSTEM)

Commands That Update Context

  • cd: Updates cwd when directory changes
  • steal_token: Updates impersonation_context when token is stolen
  • make_token: Updates impersonation_context when token is created
  • rev2self: Clears impersonation_context when reverting to original token

Artifacts Support

Cazalla automatically reports artifacts created during command execution, allowing Mythic to track forensic evidence.

Features

  • Automatic Detection: Artifacts are automatically reported for relevant commands
  • Multiple Artifact Types: Supports Process Create, File Write, File Delete, File Read, Process Termination, API Call, Network Connection
  • Artifact Management: Artifacts appear in Mythic's Artifacts page
  • Extensible: Easy to add artifact reporting for new commands

Supported Artifact Types

Artifact Type Commands Description
Process Create shell Command execution via cmd.exe
Process Create inline_execute BOF execution in current process
Process Create inline_execute_assembly .NET assembly execution in-process
Process Create execute_assembly .NET assembly execution via process injection
File Write cp, mkdir, upload File creation or modification
File Delete rm File or directory deletion
File Read download File download operations
Process Termination kill Process termination with PID
API Call screenshot, keylog_start API usage for screen capture/keylogging
Network Connection rpfwd start Reverse port forward listener

Viewing Artifacts

  1. Navigate to your callback in the Mythic UI
  2. Click the Artifacts icon (fingerprint) in the top navigation
  3. View all artifacts created by commands
  4. Filter by artifact type, needs cleanup, resolved status

Credentials Support

Cazalla supports reporting discovered credentials to Mythic's credential store.

Features

  • Automatic Detection: Commands can report discovered credentials
  • Multiple Credential Types: Supports plaintext, hash, certificate, key, ticket, cookie
  • Credential Management: Credentials appear in Mythic's Credentials page
  • Associated with Tasks: Credentials are linked to the task and callback that discovered them

Credential Detection in cat Command

The cat command automatically detects and reports credentials from file contents:

  • Format username:password: marcos:password123
  • Format domain\username:password: test\marcos:password
  • Format username@domain:password: marcos@tes.com:password
  • Passwords in config files: password=value or password:value
  • HTTP URLs with credentials: http://user:pass@host
  • NTLM hashes: Format aad3b435b51404ee:hash or :32hexchars

Viewing Credentials

  1. Navigate to your callback in the Mythic UI
  2. Click the CREDENTIALS icon (key) in the top navigation
  3. View all credentials discovered by commands
  4. Filter by credential type, realm, account

SOCKS Proxy Support

Cazalla includes full SOCKS5 proxy support, allowing you to route traffic through the agent to access internal network resources.

Features

  • SOCKS5 Protocol: Full SOCKS5 proxy server support
  • Multiple Connections: Supports multiple simultaneous SOCKS connections
  • Dynamic Sleep: Automatically reduces sleep interval when SOCKS is active
  • Connection Tracking: Each connection has a unique server_id for tracking

How It Works

  1. Mythic opens a SOCKS port on the server (default: 7002)
  2. Client connects to Mythic's SOCKS port (e.g., via proxychains)
  3. Mythic forwards SOCKS traffic to the agent with a unique server_id per connection
  4. Agent establishes the actual connection to the target host
  5. Bidirectional relay between client ↔ Mythic ↔ Agent ↔ Target

Using the Proxy

# Start SOCKS proxy
socks {"action":"start","port":7002}

# Configure proxychains
# Edit /etc/proxychains.conf
[ProxyList]
socks5 <mythic_server_ip> 7002

# Use with any tool
proxychains curl https://internal-server.local
proxychains nmap -sT 192.168.1.0/24

Performance Considerations

  • Latency: Proxy speed depends on beacon interval. SOCKS mode automatically reduces sleep to 100ms
  • Throughput: Suitable for interactive sessions and moderate data transfer
  • Concurrent Connections: Supports multiple simultaneous SOCKS connections

Reverse Port Forwarding (RPFWD) Support

Cazalla includes reverse port forwarding (RPFWD) support, allowing you to tunnel incoming connections from the agent to a remote destination through Mythic.

Features

  • Reverse Tunneling: Connections originate from external clients to the agent
  • Remote Destination: Forwards connections to configured remote destinations
  • Multiple Connections: Supports multiple simultaneous RPFWD connections
  • Automatic Cleanup: Closed connections are automatically cleaned up

How It Works

  1. Agent opens a listener on a local port (e.g., 8080 on the agent host)
  2. External client connects to the agent's listener port
  3. Agent sends connection data to Mythic via RPFWD protocol
  4. Mythic connects to the configured remote destination (remote_host:remote_port)
  5. Bidirectional relay between client ↔ Agent ↔ Mythic ↔ Remote destination

Use Cases

  • Access internal services: Expose internal services (e.g., database, web server)
  • Bypass firewall restrictions: When you can't connect from Mythic but can connect to the agent
  • Service tunneling: Tunnel arbitrary TCP services through the agent

Example

# Start reverse port forward
rpfwd {"action":"start","port":8080,"remote_host":"192.168.1.100","remote_port":80}

# Connect to agent:8080 will forward to 192.168.1.100:80
curl http://<agent_ip>:8080

Token Support

Cazalla supports Windows token manipulation and impersonation, following Mythic's Token specification.

Features

  • Token Listing: Enumerate all viewable tokens from running processes
  • Token Theft: Steal tokens from processes to impersonate different users
  • Token Creation: Create new tokens using credentials (domain, username, password)
  • Token Impersonation: Impersonate tokens for subsequent tasking
  • Token Revert: Revert to original token when done impersonating
  • SeDebugPrivilege: Automatically enables SeDebugPrivilege for accessing system processes
  • Mythic Integration: Tokens are tracked in Mythic's Token UI and can be selected for tasking

Token Commands

  • list_tokens: Enumerate all available tokens
  • steal_token <pid>: Steal token from a process
  • make_token domain username password: Create token from credentials
  • rev2self: Revert to original token
  • whoami: Display current security context

Using Tokens for Tasking

  1. Execute list_tokens to see available tokens
  2. Execute steal_token <pid> to steal a token (or use make_token to create one)
  3. In the Mythic UI, a dropdown appears next to the tasking bar
  4. Select a token from the dropdown before issuing commands
  5. Commands will execute with the selected token's security context

Keylogging Support

Cazalla supports capturing keystrokes from the target system and reporting them to Mythic's Keylogs feature.

Features

  • Window-Aware Keylogging: Captures keystrokes along with the active window title
  • User Context: Includes the username in each keylog entry
  • Process-Agnostic: Works with any application (Notepad, browsers, terminals, etc.)
  • Automatic Buffering: Buffers keystrokes and sends them periodically (every 3 seconds or 128 bytes)
  • Background Thread: Runs as a separate thread, allowing other commands to execute while keylogging

How It Works

  1. Start Keylogging: Execute keylog_start
  2. Background Thread: Agent creates a background thread that monitors keyboard input
  3. Keystroke Capture: Uses GetAsyncKeyState to detect key presses
  4. Window Detection: Captures the active window title
  5. Periodic Transmission: Sends keystrokes every 3 seconds or when buffer reaches 128 bytes
  6. Stop Keylogging: Execute keylog_stop to terminate the keylogger

Universal Process Support

The keylogger works with any Windows application because it:

  • Uses GetForegroundWindow() to get the currently active window
  • Captures keystrokes system-wide using GetAsyncKeyState
  • Doesn't require injection into specific processes

Viewing Keylogs

  1. Navigate to your callback in the Mythic UI
  2. Click the KEYLOGS tab in the top navigation
  3. View all captured keystrokes grouped by task, user, window, and timestamp

File Downloads Support

Cazalla supports downloading files from the target to the Mythic server using chunked transfers.

Features

  • Chunked File Transfers: Large files are automatically split into chunks (512KB default)
  • Automatic Registration: Files are automatically registered with Mythic before transfer
  • Progress Tracking: Mythic tracks download progress (chunks received/total chunks)
  • File Read Artifacts: Automatically reports File Read artifacts when files are downloaded
  • Full Path Tracking: Reports full file paths for proper tracking

How It Works

  1. Command Execution: Execute download C:\path\to\file.txt
  2. File Registration: Agent sends file metadata to Mythic
  3. Chunk Transfer: Agent sends file data in chunks (base64-encoded)
  4. Completion: File appears in Mythic's file browser once all chunks are received

Download Process

  • Chunk Size: 512KB per chunk (configurable)
  • File Size Limit: Supports files up to 2GB (can be extended)
  • Base64 Encoding: Chunk data is base64-encoded before transmission
  • Artifact Reporting: Automatically reports "File Read" artifact

File Uploads Support

Cazalla supports uploading files from the Mythic server to the target using chunked transfers.

Features

  • Chunked File Transfers: Large files are automatically split into chunks (512KB default)
  • Automatic Path Normalization: Automatically handles path formatting
  • Smart Path Handling: Automatically appends filename when path is a directory
  • File Browser Integration: Fully integrated with Mythic's File Browser UI
  • Progress Tracking: Mythic tracks upload progress (chunks sent/total chunks)
  • File Write Artifacts: Automatically reports File Write artifacts

How It Works

  1. Command Execution: Execute upload <file_id> C:\path\to\destination.txt
  2. Path Normalization: Agent normalizes the destination path
  3. Chunk Requests: Agent requests file chunks from Mythic sequentially
  4. Chunk Writing: Agent decodes and writes chunks to the destination file
  5. Completion: File Write artifact is reported when complete

Path Handling

  • Normalization: Automatically normalizes double backslashes
  • Directory Detection: Automatically detects directories and appends filename
  • Parent Directory Creation: Automatically creates parent directories if they don't exist
  • Error Handling: Clear error messages for invalid paths, access denied, etc.

System Information Gathering

Cazalla includes commands for gathering system information with low detection risk.

Features

  • Browser Detection: Identify installed web browsers and default browser
  • Read-Only Operations: No system modifications, minimal detection risk
  • Version Information: Extract version details from browser executables
  • Registry Queries: Query Windows registry for browser associations

Commands

browser_info

Identifies all installed web browsers on the target system and determines the default browser.

Supported Browsers:

  • Google Chrome
  • Microsoft Edge
  • Mozilla Firefox
  • Opera
  • Brave

Output Includes:

  • Installation paths for each detected browser
  • Version information (when available)
  • Default browser identification

OPSEC Considerations:

  • Low detection risk - read-only operations
  • Registry reads may be logged if auditing enabled
  • No process creation or network activity
  • No file modifications

Example:

browser_info

Output:

=== Installed Browsers ===

[1] Microsoft Edge
    Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    Version: 142.0.3595.94

[2] Mozilla Firefox
    Path: C:\Program Files\Mozilla Firefox\firefox.exe
    Version: 145.0.1.627

=== Default Browser ===

Name: Microsoft Edge
Path: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

For detailed information, see browser_info command documentation.

browser_dump

Extracts cookies, saved passwords, and bookmarks from web browsers.

Supported Browsers:

  • Google Chrome
  • Mozilla Firefox

Extracted Data:

  • Cookies with decrypted values (display only, NOT stored as credentials)
  • Saved passwords (logins) with usernames
  • Bookmarks with URLs

Credential Reporting:

  • Passwords: Automatically saved to Mythic's credential store as plaintext credential type
  • Cookies: Displayed in output but NOT stored as credentials (for manual use only)
  • Realms automatically extracted from URLs

Cookie Filtering:

  • Only shows session cookies useful for authentication/impersonation
  • Filters out tracking cookies and cookies with security flags

OPSEC Considerations:

  • HIGH DETECTION RISK - Browser credential access is heavily monitored
  • EDR/XDR solutions have specific detection rules
  • File access to browser databases triggers alerts
  • Always requires approval from another operator

Example:

browser_dump chrome

For detailed information, see browser_dump command documentation.

OPSEC Checking

Cazalla includes comprehensive OPSEC Checking functionality that provides operational security warnings and blocking for commands based on their detection risks.

Features

  • Pre-execution Blocking: Commands can be blocked before execution
  • Post-execution Warnings: Artifacts are automatically tracked and warned about
  • Customizable Bypass Roles: Configure who can approve blocked tasks
  • Detailed Warnings: Comprehensive explanations of OPSEC risks

How It Works

  1. OPSEC Pre-Check (opsec_pre): Runs before task creation, can block execution
  2. OPSEC Post-Check (opsec_post): Runs after task creation, warns about artifacts

Commands with OPSEC Checking

  • High-Risk Commands (Blocking): shell, steal_token, kill, keylog_start, rm (system files), browser_dump
  • Warning-Only Commands: screenshot, rpfwd, socks, download, upload, make_token, browser_info, etc.

Bypass Roles

  • operator: Any operator can bypass
  • other_operator: Requires approval from a different operator
  • lead: Only operation lead can approve

For detailed information, see OPSEC Guide.

Related Documentation

Last Updated: 2024

Reference in New Issue View Git Blame Copy Permalink