Athena icon indicating copy to clipboard operation
Athena copied to clipboard

GitHub C2 profile malfunctioning on some situations

Open armysick opened this issue 1 month ago • 3 comments

Describe the bug

For the GitHub profile to work with Athena, it is mandatory that the repository is not empty, and that the default branch is named "main".

In https://github.com/MythicAgents/Athena/blob/a2bfe4784eca50e16a68ecc242474127f4cc8d52/Payload_Type/athena/athena/agent_code/Agent.Profiles.GitHub/GitHubProfile.cs#L101 will fail unless two conditions are met:

  • Repository is not empty
  • Branch main exists

Expected behavior Either handle this edge case scenario (see additional data below); Or describe these two conditions as a quick note on the setup documentation.

Additional data

Stack trace for "Git Repository is empty" Exception (empty repo):

   at Octokit.Connection.RunRequest(IRequest request, CancellationToken cancellationToken, Func`2 preprocessResponseBody) in /_/Octokit/Http/Connection.cs:line 798
   at Octokit.Connection.Run[T](IRequest request, CancellationToken cancellationToken, Func`2 preprocessResponseBody) in /_/Octokit/Http/Connection.cs:line 783
   at Octokit.ApiConnection.Get[T](Uri uri, IDictionary`2 parameters)
   at Agent.Profiles.GitHub.StartBeacon()

Stack trace for "Not Found" Exception (main branch does not exist):

   at Octokit.Connection.RunRequest(IRequest request, CancellationToken cancellationToken, Func`2 preprocessResponseBody) in /_/Octokit/Http/Connection.cs:line 798
   at Octokit.Connection.Run[T](IRequest request, CancellationToken cancellationToken, Func`2 preprocessResponseBody) in /_/Octokit/Http/Connection.cs:line 783
   at Octokit.ApiConnection.Get[T](Uri uri, IDictionary`2 parameters)
   at Agent.Profiles.GitHub.StartBeacon()

armysick avatar Jan 13 '25 16:01 armysick