Merge branch 'main-refactor' into dev

MythicAgents · Sep 1, 2024 · fabb89a · fabb89a
2 parents 05e975a + c3b38a9
commit fabb89a
Show file tree

Hide file tree

Showing 176 changed files with 3,936 additions and 7,059 deletions.
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -17,7 +17,6 @@ on:
       - Payload_Type/thanatos/agent
       - Payload_Type/thanatos/mythic
 
-  workflow_call:
 
 env:
   AGENT_CODE: Payload_Type/thanatos/agent
@@ -82,7 +81,6 @@ jobs:
         working-directory: ${{ env.AGENT_CODE }}
         run: cargo fmt -- --color always --check
         env:
-          RUSTFLAGS: "--cfg http"
           UUID: ""
           AESPSK: ""
           callback_host: ""
@@ -121,7 +119,6 @@ jobs:
         working-directory: ${{ env.AGENT_CODE }}
         run: cargo clippy --color always --all-features --all-targets -- -D warnings
         env:
-          RUSTFLAGS: "--cfg http"
           UUID: ""
           AESPSK: ""
           callback_host: ""

diff --git a/.vscode/tasks.json b/.vscode/tasks.json
@@ -0,0 +1,45 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "Deploy changes",
+            "type": "shell",
+            "options": {
+                "cwd": "${workspaceFolder}",
+            },
+            "command": "ssh",
+            "args": [
+                "mythic",
+                "./redeploy.sh",
+            ],
+            "group": "build",
+            "dependsOn": [
+                "Build base Docker image"
+            ]
+        },
+        {
+            "label": "Build base Docker image",
+            "type": "shell",
+            "options": {
+                "cwd": "${workspaceFolder}/Payload_Type/thanatos",
+            },
+            "command": "docker",
+            "args": [
+                "build",
+                "-f",
+                ".docker/Dockerfile",
+                "-t",
+                "ghcr.io/mythicagents/thanatos:${input:tag}",
+                "."
+            ],
+            "group": "build"
+        }
+    ],
+    "inputs": [
+        {
+            "id": "tag",
+            "description": "Image tag",
+            "type": "promptString"
+        }
+    ]
+}
diff --git a/Payload_Type/thanatos/.docker/Dockerfile b/Payload_Type/thanatos/.docker/Dockerfile
@@ -0,0 +1,122 @@
+### Real Dockerfile for the thanatos payload
+
+# Pull Alpine for musl libssl files
+FROM docker.io/library/alpine:3.19 as musl-ssl
+RUN apk update && apk add --no-cache \
+    openssl-dev \
+    openssl-libs-static
+
+# Pull in Fedora for mingw libssl files
+FROM docker.io/library/fedora:39 as mingw-ssl
+RUN dnf install -y \
+    mingw64-openssl-static \
+    mingw32-openssl-static
+
+# Thanatos builder image
+FROM docker.io/library/debian:bookworm-slim
+
+# Copy over openssl files
+# x86_64-linux-musl
+RUN mkdir -p /usr/lib/x86_64-linux-musl
+COPY --from=musl-ssl /usr/lib/libcrypto.a /usr/lib/x86_64-linux-musl/libcrypto.a
+COPY --from=musl-ssl /usr/lib/libssl.a /usr/lib/x86_64-linux-musl/libssl.a
+
+RUN mkdir -p /usr/include/x86_64-linux-musl
+COPY --from=musl-ssl /usr/include/openssl /usr/include/x86_64-linux-musl/openssl
+
+# x86_64-w64-mingw32
+RUN mkdir -p /usr/x86_64-w64-mingw32/lib
+COPY --from=mingw-ssl \
+    /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libcrypto.a \
+    /usr/x86_64-w64-mingw32/lib/libcrypto.a
+COPY --from=mingw-ssl \
+    /usr/x86_64-w64-mingw32/sys-root/mingw/lib/libssl.a \
+    /usr/x86_64-w64-mingw32/lib/libssl.a
+
+RUN mkdir -p /usr/x86_64-w64-mingw32/include
+COPY --from=mingw-ssl \
+    /usr/x86_64-w64-mingw32/sys-root/mingw/include/openssl \
+    /usr/x86_64-w64-mingw32/include
+
+# i686-w64-mingw32
+RUN mkdir -p /usr/i686-w64-mingw32/lib
+COPY --from=mingw-ssl \
+    /usr/i686-w64-mingw32/sys-root/mingw/lib/libcrypto.a \
+    /usr/i686-w64-mingw32/lib/libcrypto.a
+COPY --from=mingw-ssl \
+    /usr/i686-w64-mingw32/sys-root/mingw/lib/libssl.a \
+    /usr/i686-w64-mingw32/lib/libssl.a
+
+RUN mkdir -p /usr/i686-w64-mingw32/include
+COPY --from=mingw-ssl \
+    /usr/i686-w64-mingw32/sys-root/mingw/include/openssl \
+    /usr/i686-w64-mingw32/include
+
+# Install packages
+RUN dpkg --add-architecture i386
+RUN apt-get update -y && apt-get install -y \
+    curl \
+    python3 \
+    python3-venv \
+    gcc \
+    gcc-multilib \
+    mingw-w64-x86-64-dev \
+    gcc-mingw-w64-x86-64 \
+    mingw-w64-i686-dev \
+    gcc-mingw-w64-i686 \
+    libssl-dev \
+    libssl-dev:i386 \
+    musl \
+    musl-dev \
+    && apt-get clean
+
+# Create a thanatos service user for running the Mythic payload service
+RUN useradd \
+    -r \
+    -c "Thanatos service account" \
+    -m \
+    -d /thanatos \
+    -s /usr/sbin/nologin \
+    thanatos
+
+COPY mythic /thanatos/mythic
+COPY agent /thanatos/agent
+RUN chown -R thanatos:thanatos /thanatos
+
+USER thanatos
+WORKDIR /thanatos
+
+# Install rust
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o rustup.sh \
+    && sh rustup.sh -y \
+    --profile minimal \
+    --default-toolchain stable \
+    -t x86_64-unknown-linux-gnu \
+    -t i686-unknown-linux-gnu \
+    -t x86_64-unknown-linux-musl \
+    -t x86_64-pc-windows-gnu \
+    -t i686-pc-windows-gnu
+
+RUN rm -vf rustup.sh
+ENV PATH=$PATH:/thanatos/.cargo/bin
+
+# Fetch Rust dependencies
+WORKDIR /thanatos/agent
+RUN cargo fetch
+
+# Copy Rust Cargo config.toml
+COPY .docker/config.toml /thanatos/.cargo/config.toml
+
+WORKDIR /thanatos
+
+# Setup poetry
+RUN python3 -m venv .poetry-venv
+RUN .poetry-venv/bin/pip install -U pip setuptools
+RUN .poetry-venv/bin/pip install poetry
+ENV PATH=$PATH:/thanatos/.poetry-venv/bin
+
+# Install dependencies
+WORKDIR /thanatos/mythic
+RUN poetry install --only main
+
+CMD ["poetry", "run", "thanatos"]
diff --git a/Payload_Type/thanatos/.docker/config.toml b/Payload_Type/thanatos/.docker/config.toml
@@ -0,0 +1,18 @@
+[env]
+OPENSSL_STATIC = "true"
+
+X86_64_UNKNOWN_LINUX_GNU_OPENSSL_LIB_DIR = "/usr/lib/x86_64-linux-gnu"
+X86_64_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR = "/usr/include/x86_64-linux-gnu"
+
+I686_UNKNOWN_LINUX_GNU_OPENSSL_LIB_DIR = "/usr/lib/i386-linux-gnu"
+I686_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR = "/usr/include/i386-linux-gnu"
+
+X86_64_PC_WINDOWS_GNU_OPENSSL_LIB_DIR = "/usr/x86_64-w64-mingw32/lib"
+X86_64_PC_WINDOWS_GNU_OPENSSL_INCLUDE_DIR = "/usr/x86_64-w64-mingw32/include"
+
+I686_PC_WINDOWS_GNU_OPENSSL_LIB_DIR = "/usr/i686-w64-mingw32/lib"
+I686_PC_WINDOWS_GNU_OPENSSL_INCLUDE_DIR = "/usr/i686-w64-mingw32/include"
+
+CC_x86_64-unknown-linux-musl = "x86_64-linux-musl-gcc"
+X86_64_UNKNOWN_LINUX_MUSL_OPENSSL_LIB_DIR = "/usr/lib/x86_64-linux-musl"
+X86_64_UNKNOWN_LINUX_MUSL_OPENSSL_INCLUDE_DIR = "/usr/include/x86_64-linux-musl"
diff --git a/Payload_Type/thanatos/.dockerignore b/Payload_Type/thanatos/.dockerignore
@@ -0,0 +1,6 @@
+agent/target
+mythic/.pytest_cache
+__pycache__
+.vscode
+.env*
+.gitignore
diff --git a/Payload_Type/thanatos/agent/.cargo/config.toml b/Payload_Type/thanatos/agent/.cargo/config.toml
@@ -1,10 +1,11 @@
-[build]
-dep-info-basedir = "."
-incremental = true
-
 [target.x86_64-pc-windows-gnu]
-linker = "x86_64-w64-mingw32-gcc"
+rustflags = ["-C", "target-feature=+crt-static"]
 
 [target.i686-pc-windows-gnu]
-linker = "i686-w64-mingw32-gcc"
-rustflags = "-C panic=abort"
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.x86_64-pc-windows-msvc]
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.i686-pc-windows-msvc]
+rustflags = ["-C", "target-feature=+crt-static"]
diff --git a/Payload_Type/thanatos/agent/.env.ps1 b/Payload_Type/thanatos/agent/.env.ps1
@@ -0,0 +1,21 @@
+$env:UUID="1234"
+$env:connection_retries="1234"
+$env:working_start="1234"
+$env:working_end="1234"
+$env:callback_port="1234"
+$env:killdate="1234"
+$env:callback_jitter="1234"
+$env:headers="1234"
+$env:AESKEY="1234"
+$env:callback_host="1234"
+$env:get_uri="1234"
+$env:post_uri="1234"
+$env:query_path_name="1234"
+$env:proxy_port="1234"
+$env:proxy_user="1234"
+$env:proxy_pass="1234"
+$env:callback_interval="1234"
+$env:OPENSSL_STATIC="true"
+$env:OPENSSL_LIBS="ssl"
+$env:OPENSSL_INCLUDE_DIR="C:\Strawberry\c\include\"
+$env:OPENSSL_LIB_DIR="C:\Strawberry\c\lib\"
diff --git a/Payload_Type/thanatos/agent/.vscode/settings.json b/Payload_Type/thanatos/agent/.vscode/settings.json
@@ -0,0 +1,16 @@
+{
+    "rust-analyzer.server.extraEnv": {
+        "UUID": "1234",
+        "AESPSK": "1234",
+        "callback_host": "1234",
+        "callback_interval": "1234",
+        "callback_jitter": "1234",
+        "callback_port": "1234",
+        "connection_retries": "1234",
+        "encrypted_exchange_check": "1234",
+        "get_uri": "1234",
+        "headers": "1234",
+        "post_uri": "1234",
+        "working_hours": "1234"
+    }
+}
diff --git a/Payload_Type/thanatos/agent/Cargo.toml b/Payload_Type/thanatos/agent/Cargo.toml
@@ -1,73 +1,57 @@
 [package]
 name = "thanatos"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+license.workspace = true
+homepage.workspace = true
+
+[workspace]
+members = ["binary", "library"]
+
+[workspace.package]
 version = "0.1.9"
 authors = ["Matt Ehrnschwender (@M_alphaaa)"]
 edition = "2021"
-
-
-[lib]
-name = "thanatos"
-path = "src/lib.rs"
-crate-type = ["cdylib", "lib"]
-
-
-[[bin]]
-name = "thanatos"
-path = "src/main.rs"
+license = "BSD-3-Clause"
+homepage = "https://github.com/MythicAgents/thanatos"
 
 [profile.release]
-strip = "symbols"
+lto = true
+codegen-units = 1
+panic = "abort"
+strip = true
+opt-level = 'z'
 
 [dependencies]
-aes = "0.7.5"
-base64 = "0.13"
-block-modes = "0.8.1"
-cfg-if = "1.0"
-chrono = "0.4"
-ctor = "0.1.21"
-hmac = "0.11"
-path-clean = "0.1.0"
-rand = "0.8"
+generic-array = "1.0.0"
 serde_json = "1.0"
-sha2 = "0.9.8"
-
-[dependencies.minreq]
-version = "2.4.2"
-features = ["https-rustls-probe"]
-
-[dependencies.openssl]
-version = "0.10.45"
-features = ["vendored"]
 
 [dependencies.serde]
 version = "1"
 features = ["derive"]
 
 [dependencies.ssh2]
-version = "0.9.3"
-features = ["vendored-openssl"]
-
-[dependencies.tokio]
-version = "1.16.1"
-features = ["net", "rt-multi-thread", "io-util", "macros", "process"]
+version = "0.9"
+git = "https://github.com/alexcrichton/ssh2-rs"
+rev = "ec94100b4a1c1730bfb30c3a1c88af3ea54fdd78"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 libc = "0.2"
+openssl = "0.10.45"
 
-[target.'cfg(target_os = "windows")'.dependencies]
-windows-acl = "0.1.0"
-wmi = "0.9.2"
-
-[target.'cfg(target_os = "windows")'.dependencies.winapi]
-version = "0.3.9"
+[target.'cfg(target_os = "windows")'.dependencies.windows]
+version = "0.56.0"
 features = [
-  "aclapi",
-  "errhandlingapi",
-  "impl-default",
-  "securitybaseapi",
-  "tlhelp32",
-  "winbase",
-  "wincon",
-  "wow64apiset",
-  "sysinfoapi",
+  "Wdk_System_SystemServices",
+  "Win32_Networking_WinSock",
+  "Win32_NetworkManagement_IpHelper",
+  "Win32_NetworkManagement_Ndis",
+  "Win32_Security_Cryptography",
+  "Win32_System_LibraryLoader",
+  "Win32_System_Performance",
+  "Win32_System_SystemInformation",
+  "Win32_System_SystemServices",
+  "Win32_System_Threading",
+  "Win32_System_WindowsProgramming",
 ]