Using forge commands in scripting

[hagbartx]

Hey all,

is there a way to use registered forge commands in scripting? Hier some example:

# ################ Create a new task ################
try:
    status = await mythic.issue_task(
        mythic=mythic_instance,
        command_name="forge_net_Rubeus",
        parameters={"args": "triage", "version": "4.7_Any", "execution": "execute_assembly"},
        callback_display_id=5,
        timeout=10,
        wait_for_complete=True,
    )
    print(f"Issued a task: {status}")
except Exception as e:
    print(f"Got exception trying to issue task: {str(e)}")

While this is possible for buildin callback commands whenever I use a forge command I get:

Got exception trying to issue task: Failed to create task: failed to find command matching payload type

Rubeus is registered an works when tasking the callback directly in the browser.

[its-a-feature]

Ah, yup, you can't currently. Right now, Mythic is looking for the forge_net_Rubeus command inside of the payload type associated with callback 5. I need to expose an additional parameter as part of the issue_task functionality to allow you to specify the payload type. Then, you could do everything you're doing now, but you'd specify payload_type="forge" and Mythic would look to the forge container for that command instead of the callback's payload type. Easy fix. I can get that done tomorrow and pushed

[its-a-feature]

If you use scripting version v0.2.6 then you should be able to specify a new field, payload_type with your issue_task like i detailed above

[hagbartx]

Hey,

how can I update to scripting version v0.2.6?

I did a clean install. I purged containers/volumes via system prune. I can see the

RUN pip3 install mythic==0.2.6

in the jupyter-docker/Dockerfile - but all I see in mythic event EventFeed is:

mythic_admin connected via Mythic Scripting (v0.2.5) from 172.18.0.1

Sorry docker noob,
hag

[its-a-feature]

I created a new tagged version for you, so you should be able to just do:

• git pull
• sudo make
• sudo ./mythic-cli start

I had pushed the updated Dockerfile, but didn't trigger a rebuild, but it should be good now.

in general though, in your .env file you'll see a bunch of settings like JUPYTER_USE_BUILD_CONTEXT="false" that are all *_USE_BUILD_CONTEXT. This is just a docker-ism way of saying if you want to use the local files to build a new image for your container or if you want to use a pre-existing image. These default to false so that you pull the latest images hosted on github. If you wanted a local change to appear, you can set that to true then do sudo ./mythic-cli build [thing] and it'll rebuild it with the local settings.

[hagbartx]

Thank you. Works now, realy cool!