Typhon is a macOS specific payload aimed at targetting Jamf managed devices. This payload can be used to manipulate macOS devices into communicating with a Mythic instance, which acts as a Jamf server with the ability to execute commands.
This version of Typhon is compatable with Mythic 3.0.
Please use an older version if on Mythic 2.x.
-
Typhon was presented in the Black Hat USA 2021 talk Come to the Dark Side, We Have Apples: Turning macOS Management Evil.
-
Further information about detecting typhon can be found at TheMacPack.io - Detecting Orthrus and Typhon
To install typhon, you'll need Mythic installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page.
From the Mythic install root, run the command:
./mythic-cli install github https://github.com/MythicAgents/typhon.git
Once installed, restart Mythic to build a new agent.
The typhon agent utilises functionality provided by the Jamf binary. As such no additional code needs to be introduced to the compromised device for this agent to operate.
The client-side Jamf agent contains a variety of functionality that may be utilised by this Mythic payload/profile, however the main focus of the initial release is providing code execution through the agent itself. Any additional feature requests are welcomed.
The agent currently employs three commands that imitate standard Jamf policy instructions.
| Command | Syntax | Description |
|---|---|---|
| add_user | add_user |
Add a standard or administrative user to the device. |
| delete_user | delete_user |
Deletes a user account on the device. |
| execute_command | execute_command |
Executes a bash command on the target device with root privileges. |