pub struct MythicAgent {
pub callback_uuid: Uuid,
}Expand description
Post-checkin phase — holds the callback UUID assigned by Mythic.
Encryption state is kept on the C2Transport via
get_aes_psk /
set_aes_psk so the same agent
can switch transports without duplicating key state.
§Examples
use mythic::{C2Transport, MythicAgent, MythicError};
use uuid::Uuid;
let mut c2 = HttpC2;
let payload_uuid = Uuid::parse_str("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee").unwrap();
let agent = MythicAgent::easy_checkin(
payload_uuid,
&mut c2,
vec!["10.0.0.1".into()],
Some("linux".into()),
Some("root".into()),
Some("web01".into()),
Some(1337),
Some("x86_64".into()),
None, None, None, None, None, None,
)
.unwrap();
println!("callback UUID: {}", agent.callback_uuid());Fields§
§callback_uuid: UuidImplementations§
Source§impl MythicAgent
impl MythicAgent
pub fn new(payload_uuid: Uuid) -> Self
pub fn callback_uuid(&self) -> Uuid
Sourcepub fn easy_checkin<C: C2Transport>(
payload_uuid: Uuid,
c2: &mut C,
ips: Vec<String>,
os: Option<String>,
user: Option<String>,
host: Option<String>,
pid: Option<u32>,
architecture: Option<String>,
domain: Option<String>,
integrity_level: Option<u32>,
external_ip: Option<String>,
encryption_key: Option<String>,
decryption_key: Option<String>,
process_name: Option<String>,
) -> MythicResult<Self>
pub fn easy_checkin<C: C2Transport>( payload_uuid: Uuid, c2: &mut C, ips: Vec<String>, os: Option<String>, user: Option<String>, host: Option<String>, pid: Option<u32>, architecture: Option<String>, domain: Option<String>, integrity_level: Option<u32>, external_ip: Option<String>, encryption_key: Option<String>, decryption_key: Option<String>, process_name: Option<String>, ) -> MythicResult<Self>
One-shot checkin — create an agent and check it in, no new() needed.
For full control use checkin with a pre-built
ReqCheckin.
Sourcepub fn checkin<C: C2Transport>(
self,
req: ReqCheckin,
c2: &mut C,
) -> MythicResult<Self>
pub fn checkin<C: C2Transport>( self, req: ReqCheckin, c2: &mut C, ) -> MythicResult<Self>
Perform a direct checkin (plaintext or static-key PSK).
The mode is determined automatically from the transport
via C2Transport::get_aes_psk. req.uuid must be the payload
UUID; it is used both in the JSON body and the wire framing.
This method takes &mut C because RSA/translation staging may
negotiate a new session key that must be stored back into the transport.
Sourcepub fn get_tasking<C: C2Transport>(
&self,
tasking_size: i32,
c2: &C,
) -> MythicResult<RespGetTasking>
pub fn get_tasking<C: C2Transport>( &self, tasking_size: i32, c2: &C, ) -> MythicResult<RespGetTasking>
Poll for new tasks from the Mythic server (no extras).
tasking_size of -1 asks Mythic for all available tasks.
Sourcepub fn get_tasking_with<C: C2Transport>(
&self,
tasking_size: i32,
c2: &C,
extras: AgentMessageExtras,
) -> MythicResult<RespGetTasking>
pub fn get_tasking_with<C: C2Transport>( &self, tasking_size: i32, c2: &C, extras: AgentMessageExtras, ) -> MythicResult<RespGetTasking>
Poll for new tasks, carrying delegates, SOCKS, RPFWD, interactive data, edges, alerts, and/or responses alongside the request.
Sourcepub fn post_response<C: C2Transport>(
&self,
responses: Vec<TaskResponse>,
c2: &C,
) -> MythicResult<RespPostResponse>
pub fn post_response<C: C2Transport>( &self, responses: Vec<TaskResponse>, c2: &C, ) -> MythicResult<RespPostResponse>
Send task responses back to the Mythic server (no extras).
The responses vector contains the output of completed (or in-progress)
tasks. Use crate::protocol::TaskResponse builders like
crate::protocol::TaskResponse::completed or construct custom
responses with hooking-feature data.
Sourcepub fn post_response_with<C: C2Transport>(
&self,
responses: Vec<TaskResponse>,
c2: &C,
shared: AgentExtras,
) -> MythicResult<RespPostResponse>
pub fn post_response_with<C: C2Transport>( &self, responses: Vec<TaskResponse>, c2: &C, shared: AgentExtras, ) -> MythicResult<RespPostResponse>
Send task responses, carrying delegates, SOCKS, RPFWD, interactive data, edges, and/or alerts alongside the response.
shared is the AgentExtras portion — it does not contain
responses (those are the first argument).