kitos
6e82a8253c
Complete rebrand: renamed all files, folders, code references, documentation, Docker paths, env vars, Makefile targets, Python classes, C structs/functions, and git remote URL. Replaced agent icons with new Angerona branding (light + dark mode SVGs). Fixed builder.py to reference SVG instead of PNG for Mythic icon path.
2.0 KiB
2.0 KiB
upload - Upload File to Target
Upload a file from the Mythic server to the target system.
Description
The upload command uploads a file from the Mythic server to the target system. Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written.
Syntax
upload <file_id> <destination_path>
Parameters
file_id(required): File ID from Mythic's file browser. Obtained by uploading a file to Mythic first.destination_path(required): Destination path where the file will be written. Supports both absolute and relative paths.
Examples
upload abc123-def456-ghi789 C:\Users\Administrator\Desktop\payload.exe
upload xyz789 C:\Windows\Temp\stager.dll
upload file123 C:\temp\data.txt
Features
- Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written
- Supports both absolute and relative paths (relative paths are resolved using the current working directory)
- Creates a 'File Write' artifact for tracking
- Uploads to sensitive locations (System32, Windows, Program Files) or with suspicious extensions (.exe, .dll, .ps1, .bat, .vbs) may trigger detection by security tools
Output
[upload] Starting upload: C:\Users\Administrator\Desktop\payload.exe (2048000 bytes)
[upload] Chunk 1/4 written: 512000 bytes
[upload] Chunk 2/4 written: 512000 bytes
[upload] Chunk 3/4 written: 512000 bytes
[upload] Chunk 4/4 written: 512000 bytes
[upload] Upload complete: C:\Users\Administrator\Desktop\payload.exe
OPSEC Considerations
- File writes are logged by EDR/XDR solutions
- Uploads to sensitive locations may trigger alerts
- Suspicious file extensions (.exe, .dll, .ps1, .bat, .vbs) are monitored
- File write artifacts are automatically tracked
Related
Command Category: File System
Requires Admin: No
MITRE ATT&CK: T1105 - Ingress Tool Transfer