Agent only exfiltrating data (credentials).

[piolug93]

Hello i need to create new payload type. My payload type can only send data to c2 without created task by operator. Agent can't save callback uuid because is only run for one task. It possible only creating new payload type or/and translator ?

[its-a-feature]

hmm Is the payload created for just one task, then never executed again? You have a few options:

• look at the arachne payload type - it's a webshell, so it also can't store data long term. Instead, during the "build" phase, we make a fake callback and bake that callback UUID into the payload so that when it does communicate, we can do the correlation properly
• you can do a similar thing by issuing a task to that callback when you create it and then taking that task UUID and also baking it into the agent. Then, when the agent is executed, you can ship data back specifically as the output of that task
• if you need this one payload to run multiple commands, then I'd suggest the first bullet and baking in the callback id and making a fake callback, then somehow upon execution you pass in a new task UUID each time so that single execution can report back data for that task

[piolug93]

In arachne, there is one key difference operator run task. In my case is only one way communication. I creating stealer and would like to store data in mythic :) I think about translator module and add task using rpc when message received by translator. When i use translator i can get one more benefit. Assigning an callback uuid based on hostname. Correct me if I'm wrong.

[piolug93]

It's possible to get callback_ids only based on hostname ? Method MythicRPCCallbackSearch require AgentCallbackUUID or AgentCallbackID.

[piolug93]

I don't know for what is that code. https://github.com/its-a-feature/Mythic/blob/6361d936723a695ddb3d8436a9fc335257611d41/mythic-docker/src/rabbitmq/recv_mythic_rpc_callback_search.go#L90

callback := databaseStructs.Callback{}
err := database.DB.Get(&callback, `SELECT
	operation_id
	FROM callback
	WHERE agent_callback_id=$1 OR id=$2`, input.AgentCallbackUUID, input.AgentCallbackID)
if err != nil {
	logging.LogError(err, "Failed to find callback UUID")
	response.Error = err.Error()
	return response
}

I found trick in silver agent repo. When add AgentCallbackID = 1, that RPC search work only based on callback hostname. https://github.com/MythicAgents/sliver/blob/8675e0be9ad21e86772bf1e968b71da03006407b/Payload_Type/sliverapi/sliverapi/SliverRequests/SliverAPI.py#L114