This is a Mythic C2 Profile called dynamichttp. It simply provides a way to get HTTP messages off the wire and forward them to the Mythic server. This profiles includes:
- Kill Dates
- Sleep Intervals
- Custom Headers
- Proxy Information
- Support for SSL
This profile leverages JSON structure for nested information about how to dynamically generate/parse HTTP messages of your choosing. This allows you to craft HTTP messages that look like anything you want rather than the static format used in the http profile.
The c2 profile has mythic_c2_container==0.0.22 PyPi package installed and reports to Mythic as version "3".
When it's time for you to test out your install or for another user to install your agent, it's pretty simple. Within Mythic is a install_agent_from_github.sh script (https://github.com/its-a-feature/Mythic/blob/master/install_agent_from_github.sh). You can run this in one of two ways:
sudo ./install_agent_from_github.sh https://github.com/user/repoto install the main branchsudo ./install_agent_from_github.sh https://github.com/user/repo branchnameto install a specific branch of that repo
Now, you might be wondering when should you or a user do this to properly add your agent to their Mythic instance. There's no wrong answer here, just depends on your preference. The three options are:
- Mythic is already up and going, then you can run the install script and just direct that agent's containers to start (i.e.
sudo ./start_payload_types.sh agentNameand if that agent has its own special C2 containers, you'll need to start them too viasudo ./start_c2_profiles.sh c2profileName). - Mythic is already up and going, but you want to minimize your steps, you can just install the agent and run
sudo ./start_mythic.sh. That script will first stop all of your containers, then start everything back up again. This will also bring in the new agent you just installed. - Mythic isn't running, you can install the script and just run
sudo ./start_mythic.sh.