Scripting File Hosting

[nblair2]

Hi, first off want to say thank you for the the tool.

Question

What is the best way to programmatically create a payload and then host it through C2 for victim download? I am currently using the mythic pypi package to create the payload, but I can't seem to find a way to script the C2 hosting, like you can do through the UI:

Approaches

I am open to anything (curl, a python script, etc.) I just want to be able to do it without human interaction. I think there are a couple routes, interested in thoughts on any of the below (or others):

1. New python method mythic.host_file or similar- would just wrap 2.
2. Raw GraphQL - I tried to use Hasura to browse through the database - I can find the "Adjusted File Hosting" message in the operationeventlog table that gets created when I do this manually, but am a neophyte here and can't find the corresponding GraphQL query.
3. Workflows? I have not looked at these yet

Any pointers to documentation or methods would be appreciated, thanks!

[its-a-feature]

Thank you for the question! I can add a helpful python method to do this for sure, but in the meantime, anything that you can do in the UI you can do via scripting (it all uses the same API). You were absolutely right about trying to look in Hasura. If you go to the "Actions" tab you'll see all the custom, non-standard, mutations or queries you can do:

The one you want is c2HostFile:

mutation hostFileMutation($c2_id: Int!, $file_uuid: String!, $host_url: String!, $alert_on_download: Boolean, $remove: Boolean) {
  c2HostFile(c2_id: $c2_id, file_uuid: $file_uuid, host_url: $host_url, alert_on_download: $alert_on_download, remove: $remove) {
      status
      error
  }
}

You can do this with the custom query scripting method:

operation = await mythic.execute_custom_query(
    mythic=mythic_instance,
    query="""
    mutation hostFileMutation($c2_id: Int!, $file_uuid: String!, $host_url: String!, $alert_on_download: Boolean, $remove: Boolean) {
  c2HostFile(c2_id: $c2_id, file_uuid: $file_uuid, host_url: $host_url, alert_on_download: $alert_on_download, remove: $remove) {
      status
      error
  }
}
""", variables={"c2_id": 1, "file_uuid": "some uuid", "host_url": "/test", "alert_on_download": false, "remove": false}
)

The trick here is that you need to get the ID for the c2 profile you're interested in. You can do another GraphQL API call to fetch c2 profiles where the name is the one you're interested in, like:

query getMyC2ByName($name: String!){
    c2profile(where: {name: {_eq: $name}}){
        id
    }
}

which will return an array of c2 profiles, so get [0].id

[nblair2]

Thank you for the very quick and helpful reply. How in the world I missed the 'Actions' tab, I do not know.