Skip to content

Commit 768caa2

Browse files
its-a-featureits-a-feature
committed
Updating TCP/SMB P2P code
1 parent 0b45033 commit 768caa2

File tree

14 files changed

+2018
-1649
lines changed

14 files changed

+2018
-1649
lines changed

‎Payload_Type/apollo/CHANGELOG.MD

+9
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
55
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

7+
## [v2.3.0] - 2025-02-10
8+
9+
### Changed
10+
11+
- Updated TCP and SMB profiles to function the same way
12+
- Updated TCP and SMB profiles to use new TCP and SMB profile definitions
13+
- Message formats changed, so v2.3 apollo agents cannot link to v2.2 apollo agents
14+
- This change means that apollo TCP can link with Poseidon TCP
15+
716
## [v2.2.25] - 2025-01-30
817

918
### Changed

‎Payload_Type/apollo/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ RUN curl -L -o donut_shellcode-2.0.0.tar.gz https://github.com/MEhrn00/donut/rel
1212

1313
WORKDIR /Mythic/
1414
RUN python3 -m venv /venv
15-
RUN /venv/bin/python -m pip install mythic-container==0.5.14
15+
RUN /venv/bin/python -m pip install mythic-container==0.5.22
1616
RUN /venv/bin/python -m pip install git+https://github.com/MEhrn00/[email protected]
1717
RUN /venv/bin/python -m pip install mslex
1818

‎Payload_Type/apollo/apollo/agent_code/Apollo/Config.cs

+177-175
Original file line numberDiff line numberDiff line change
@@ -1,175 +1,177 @@
1-
#define C2PROFILE_NAME_UPPER
2-
3-
#if DEBUG
4-
//#define HTTP
5-
#define WEBSOCKET
6-
#endif
7-
8-
#if HTTP
9-
using HttpTransport;
10-
#endif
11-
using System;
12-
using System.Collections.Generic;
13-
using System.Linq;
14-
using System.Text;
15-
using ApolloInterop.Structs.ApolloStructs;
16-
using PSKCryptography;
17-
using ApolloInterop.Serializers;
18-
#if WEBSOCKET
19-
using WebsocketTransport;
20-
#endif
21-
#if SMB
22-
using NamedPipeTransport;
23-
#endif
24-
#if TCP
25-
using TcpTransport;
26-
#endif
27-
namespace Apollo
28-
{
29-
public static class Config
30-
{
31-
public static Dictionary<string, C2ProfileData> EgressProfiles = new Dictionary<string, C2ProfileData>()
32-
{
33-
#if HTTP
34-
{ "http", new C2ProfileData()
35-
{
36-
TC2Profile = typeof(HttpProfile),
37-
TCryptography = typeof(PSKCryptographyProvider),
38-
TSerializer = typeof(EncryptedJsonSerializer),
39-
Parameters = new Dictionary<string, string>()
40-
{
41-
#if DEBUG
42-
{ "callback_interval", "5" },
43-
{ "callback_jitter", "0" },
44-
{ "callback_port", "80" },
45-
{ "callback_host", "http://mythic" },
46-
{ "post_uri", "data" },
47-
{ "encrypted_exchange_check", "T" },
48-
{ "proxy_host", "" },
49-
{ "proxy_port", "" },
50-
{ "proxy_user", "" },
51-
{ "proxy_pass", "" },
52-
{ "domain_front", "domain_front" },
53-
{ "killdate", "-1" },
54-
{ "USER_AGENT", "Apollo-Refactor" },
55-
#else
56-
{ "callback_interval", "http_callback_interval_here" },
57-
{ "callback_jitter", "http_callback_jitter_here" },
58-
{ "callback_port", "http_callback_port_here" },
59-
{ "callback_host", "http_callback_host_here" },
60-
{ "post_uri", "http_post_uri_here" },
61-
{ "encrypted_exchange_check", "http_encrypted_exchange_check_here" },
62-
{ "proxy_host", "http_proxy_host_here" },
63-
{ "proxy_port", "http_proxy_port_here" },
64-
{ "proxy_user", "http_proxy_user_here" },
65-
{ "proxy_pass", "http_proxy_pass_here" },
66-
{ "killdate", "http_killdate_here" },
67-
HTTP_ADDITIONAL_HEADERS_HERE
68-
#endif
69-
}
70-
}
71-
},
72-
#endif
73-
#if WEBSOCKET
74-
{ "websocket", new C2ProfileData()
75-
{
76-
TC2Profile = typeof(WebsocketProfile),
77-
TCryptography = typeof(PSKCryptographyProvider),
78-
TSerializer = typeof(EncryptedJsonSerializer),
79-
Parameters = new Dictionary<string, string>()
80-
{
81-
#if DEBUG
82-
{ "tasking_type", "Push" },
83-
{ "callback_interval", "5" },
84-
{ "callback_jitter", "0" },
85-
{ "callback_port", "8081" },
86-
{ "callback_host", "ws://mythic" },
87-
{ "ENDPOINT_REPLACE", "socket" },
88-
{ "encrypted_exchange_check", "T" },
89-
{ "domain_front", "domain_front" },
90-
{ "killdate", "-1" },
91-
{ "USER_AGENT", "Apollo-Refactor" },
92-
#else
93-
{ "tasking_type", "websocket_tasking_type_here"},
94-
{ "callback_interval", "websocket_callback_interval_here" },
95-
{ "callback_jitter", "websocket_callback_jitter_here" },
96-
{ "callback_port", "websocket_callback_port_here" },
97-
{ "callback_host", "websocket_callback_host_here" },
98-
{ "ENDPOINT_REPLACE", "websocket_ENDPOINT_REPLACE_here" },
99-
{ "encrypted_exchange_check", "websocket_encrypted_exchange_check_here" },
100-
{ "domain_front", "websocket_domain_front_here" },
101-
{ "USER_AGENT", "websocket_USER_AGENT_here" },
102-
{ "killdate", "websocket_killdate_here" },
103-
HTTP_ADDITIONAL_HEADERS_HERE
104-
#endif
105-
}
106-
}
107-
},
108-
#endif
109-
#if SMB
110-
{ "smb", new C2ProfileData()
111-
{
112-
TC2Profile = typeof(NamedPipeProfile),
113-
TCryptography = typeof(PSKCryptographyProvider),
114-
TSerializer = typeof(EncryptedJsonSerializer),
115-
Parameters = new Dictionary<string, string>()
116-
{
117-
#if DEBUG
118-
{ "pipename", "ahatojqq-bo0w-oc3r-wqtg-4jf7voepqqbs" },
119-
{ "encrypted_exchange_check", "T" },
120-
#else
121-
{ "pipename", "smb_pipename_here" },
122-
{ "encrypted_exchange_check", "smb_encrypted_exchange_check_here" },
123-
#endif
124-
}
125-
}
126-
},
127-
#elif TCP
128-
{ "tcp", new C2ProfileData()
129-
{
130-
TC2Profile = typeof(TcpProfile),
131-
TCryptography = typeof(PSKCryptographyProvider),
132-
TSerializer = typeof(EncryptedJsonSerializer),
133-
Parameters = new Dictionary<string, string>()
134-
{
135-
#if DEBUG
136-
{ "port", "40000" },
137-
{ "encrypted_exchange_check", "T" },
138-
#else
139-
{ "port", "tcp_port_here" },
140-
{ "encrypted_exchange_check", "tcp_encrypted_exchange_check_here" },
141-
#endif
142-
}
143-
}
144-
}
145-
#endif
146-
};
147-
148-
149-
public static Dictionary<string, C2ProfileData> IngressProfiles = new Dictionary<string, C2ProfileData>();
150-
#if DEBUG
151-
#if HTTP
152-
public static string StagingRSAPrivateKey = "Z16/29rxT59Ur23tVzIboE4UcnPGeWJcTszZYwJckOE= ";
153-
#elif WEBSOCKET
154-
public static string StagingRSAPrivateKey = "Hl3IzCYy3io5QU70xjpYyCNrOmA84aWMZLkCwumrAFM=";
155-
#elif SMB
156-
public static string StagingRSAPrivateKey = "cnaJ2eDg1LVrR5LK/u6PkXuBjZxCnksWjy0vEFWsHIU=";
157-
#elif TCP
158-
public static string StagingRSAPrivateKey = "LbFpMoimB+aLx1pq0IqXJ1MQ4KIiGdp0LWju5jUhZRg=";
159-
#endif
160-
#if HTTP
161-
public static string PayloadUUID = "9d4c064d-667b-49d1-99f0-ac310c72c394";
162-
#elif WEBSOCKET
163-
public static string PayloadUUID = "7546e204-aae4-42df-b28a-ade1c13594d2";
164-
#elif SMB
165-
public static string PayloadUUID = "869c4909-30eb-4a90-99b2-874dae07a0a8";
166-
#elif TCP
167-
public static string PayloadUUID = "a51253f6-7885-4fea-9109-154ecc54060d";
168-
#endif
169-
#else
170-
// TODO: Make the AES key a config option specific to each profile
171-
public static string StagingRSAPrivateKey = "AESPSK_here";
172-
public static string PayloadUUID = "payload_uuid_here";
173-
#endif
174-
}
175-
}
1+
#define C2PROFILE_NAME_UPPER
2+
3+
#if DEBUG
4+
//#define HTTP
5+
//#define WEBSOCKET
6+
//#define TCP
7+
#define SMB
8+
#endif
9+
10+
#if HTTP
11+
using HttpTransport;
12+
#endif
13+
using System;
14+
using System.Collections.Generic;
15+
using System.Linq;
16+
using System.Text;
17+
using ApolloInterop.Structs.ApolloStructs;
18+
using PSKCryptography;
19+
using ApolloInterop.Serializers;
20+
#if WEBSOCKET
21+
using WebsocketTransport;
22+
#endif
23+
#if SMB
24+
using NamedPipeTransport;
25+
#endif
26+
#if TCP
27+
using TcpTransport;
28+
#endif
29+
namespace Apollo
30+
{
31+
public static class Config
32+
{
33+
public static Dictionary<string, C2ProfileData> EgressProfiles = new Dictionary<string, C2ProfileData>()
34+
{
35+
#if HTTP
36+
{ "http", new C2ProfileData()
37+
{
38+
TC2Profile = typeof(HttpProfile),
39+
TCryptography = typeof(PSKCryptographyProvider),
40+
TSerializer = typeof(EncryptedJsonSerializer),
41+
Parameters = new Dictionary<string, string>()
42+
{
43+
#if DEBUG
44+
{ "callback_interval", "1" },
45+
{ "callback_jitter", "0" },
46+
{ "callback_port", "80" },
47+
{ "callback_host", "http://192.168.53.1" },
48+
{ "post_uri", "data" },
49+
{ "encrypted_exchange_check", "T" },
50+
{ "proxy_host", "" },
51+
{ "proxy_port", "" },
52+
{ "proxy_user", "" },
53+
{ "proxy_pass", "" },
54+
{ "domain_front", "domain_front" },
55+
{ "killdate", "-1" },
56+
{ "USER_AGENT", "Apollo-Refactor" },
57+
#else
58+
{ "callback_interval", "http_callback_interval_here" },
59+
{ "callback_jitter", "http_callback_jitter_here" },
60+
{ "callback_port", "http_callback_port_here" },
61+
{ "callback_host", "http_callback_host_here" },
62+
{ "post_uri", "http_post_uri_here" },
63+
{ "encrypted_exchange_check", "http_encrypted_exchange_check_here" },
64+
{ "proxy_host", "http_proxy_host_here" },
65+
{ "proxy_port", "http_proxy_port_here" },
66+
{ "proxy_user", "http_proxy_user_here" },
67+
{ "proxy_pass", "http_proxy_pass_here" },
68+
{ "killdate", "http_killdate_here" },
69+
HTTP_ADDITIONAL_HEADERS_HERE
70+
#endif
71+
}
72+
}
73+
},
74+
#endif
75+
#if WEBSOCKET
76+
{ "websocket", new C2ProfileData()
77+
{
78+
TC2Profile = typeof(WebsocketProfile),
79+
TCryptography = typeof(PSKCryptographyProvider),
80+
TSerializer = typeof(EncryptedJsonSerializer),
81+
Parameters = new Dictionary<string, string>()
82+
{
83+
#if DEBUG
84+
{ "tasking_type", "Push" },
85+
{ "callback_interval", "5" },
86+
{ "callback_jitter", "0" },
87+
{ "callback_port", "8081" },
88+
{ "callback_host", "ws://mythic" },
89+
{ "ENDPOINT_REPLACE", "socket" },
90+
{ "encrypted_exchange_check", "T" },
91+
{ "domain_front", "domain_front" },
92+
{ "killdate", "-1" },
93+
{ "USER_AGENT", "Apollo-Refactor" },
94+
#else
95+
{ "tasking_type", "websocket_tasking_type_here"},
96+
{ "callback_interval", "websocket_callback_interval_here" },
97+
{ "callback_jitter", "websocket_callback_jitter_here" },
98+
{ "callback_port", "websocket_callback_port_here" },
99+
{ "callback_host", "websocket_callback_host_here" },
100+
{ "ENDPOINT_REPLACE", "websocket_ENDPOINT_REPLACE_here" },
101+
{ "encrypted_exchange_check", "websocket_encrypted_exchange_check_here" },
102+
{ "domain_front", "websocket_domain_front_here" },
103+
{ "USER_AGENT", "websocket_USER_AGENT_here" },
104+
{ "killdate", "websocket_killdate_here" },
105+
HTTP_ADDITIONAL_HEADERS_HERE
106+
#endif
107+
}
108+
}
109+
},
110+
#endif
111+
#if SMB
112+
{ "smb", new C2ProfileData()
113+
{
114+
TC2Profile = typeof(NamedPipeProfile),
115+
TCryptography = typeof(PSKCryptographyProvider),
116+
TSerializer = typeof(EncryptedJsonSerializer),
117+
Parameters = new Dictionary<string, string>()
118+
{
119+
#if DEBUG
120+
{ "pipename", "h20iexte-2l1t-mmfu-ipjh-6ofmobkaruq8" },
121+
{ "encrypted_exchange_check", "true" },
122+
#else
123+
{ "pipename", "smb_pipename_here" },
124+
{ "encrypted_exchange_check", "smb_encrypted_exchange_check_here" },
125+
#endif
126+
}
127+
}
128+
},
129+
#elif TCP
130+
{ "tcp", new C2ProfileData()
131+
{
132+
TC2Profile = typeof(TcpProfile),
133+
TCryptography = typeof(PSKCryptographyProvider),
134+
TSerializer = typeof(EncryptedJsonSerializer),
135+
Parameters = new Dictionary<string, string>()
136+
{
137+
#if DEBUG
138+
{ "port", "40000" },
139+
{ "encrypted_exchange_check", "true" },
140+
#else
141+
{ "port", "tcp_port_here" },
142+
{ "encrypted_exchange_check", "tcp_encrypted_exchange_check_here" },
143+
#endif
144+
}
145+
}
146+
}
147+
#endif
148+
};
149+
150+
151+
public static Dictionary<string, C2ProfileData> IngressProfiles = new Dictionary<string, C2ProfileData>();
152+
#if DEBUG
153+
#if HTTP
154+
public static string StagingRSAPrivateKey = "wkskVa0wTi4E3EZ6bi9YyKpbHb01NNDgZ1BXnJJM5io=";
155+
#elif WEBSOCKET
156+
public static string StagingRSAPrivateKey = "Hl3IzCYy3io5QU70xjpYyCNrOmA84aWMZLkCwumrAFM=";
157+
#elif SMB
158+
public static string StagingRSAPrivateKey = "NNLlAegRMB8DIX7EZ1Yb6UlKQ4la90QsisIThCyhfCc=";
159+
#elif TCP
160+
public static string StagingRSAPrivateKey = "Zq24zZvWPRGdWwEQ79JXcHunzvcOJaKLH7WtR+gLiGg=";
161+
#endif
162+
#if HTTP
163+
public static string PayloadUUID = "b40195db-22e5-4f9f-afc5-2f170c3cc204";
164+
#elif WEBSOCKET
165+
public static string PayloadUUID = "7546e204-aae4-42df-b28a-ade1c13594d2";
166+
#elif SMB
167+
public static string PayloadUUID = "aff94490-1e23-4373-978b-263d9c0a47b3";
168+
#elif TCP
169+
public static string PayloadUUID = "bfc167ea-9142-4da3-b807-c57ae054c544";
170+
#endif
171+
#else
172+
// TODO: Make the AES key a config option specific to each profile
173+
public static string StagingRSAPrivateKey = "AESPSK_here";
174+
public static string PayloadUUID = "payload_uuid_here";
175+
#endif
176+
}
177+
}

0 commit comments

Comments
 (0)