mythicagents / apollo Goto Github PK

[-] apollo ran into an error processing powershell_import: 
'RPCResponse' object has no attribute 'message'
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/mythic_payloadtype_container/mythic_service.py", line 277, in callback
    final_task = await Command.create_tasking(task)
  File "/Mythic/mythic/agent_functions/powershell_import.py", line 54, in create_tasking
    raise Exception("Failed to create subtask: {}".format(response.message))
AttributeError: 'RPCResponse' object has no attribute 'message'

'RPCResponse' object has no attribute 'message'
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/mythic_payloadtype_container/mythic_service.py", line 277, in callback
    final_task = await Command.create_tasking(task)
  File "/Mythic/mythic/agent_functions/register_assembly.py", line 54, in create_tasking
    raise Exception("Failed to create subtask: {}".format(response.message))
AttributeError: 'RPCResponse' object has no attribute 'message'

[FoobarLegend](https://app.slack.com/team/U024Y0R5M25)
  [6 days ago](https://bloodhoundhq.slack.com/archives/CHG769BL2/p1661499912287659)
[@djhohnstein](https://bloodhoundhq.slack.com/team/U784E8R9A)
 Hi Dwight. We are testing Apollo in our lab environment but encountering some troubles with executing the reg_write_value command. We get an unauthorized exception (we're sure that we've got admin rights an our target machine). Following is the command we're trying to execute: reg_write_value -Hive HKLM -Key SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ -Name 'UseLogonCredential' -Value '1'.  The command parsed by Mythic looks totally different btw so I think our arguments our wrong or in the wrong format that Apollo expects. Can you provide the given command in the correct format?







[djhohnstein](https://app.slack.com/team/U784E8R9A)
  [6 days ago](https://bloodhoundhq.slack.com/archives/CHG769BL2/p1661525323567149?thread_ts=1661499912.287659&cid=CHG769BL2)
What is the command parsed by Mythic?


[djhohnstein](https://app.slack.com/team/U784E8R9A)
  [6 days ago](https://bloodhoundhq.slack.com/archives/CHG769BL2/p1661525464000189?thread_ts=1661499912.287659&cid=CHG769BL2)
It's not a command I tested fully I think once the rewrite happened so it's possible something got screwed up


[U Schmidt](https://app.slack.com/team/U03B8PV7AJ2)
  [6 days ago](https://bloodhoundhq.slack.com/archives/CHG769BL2/p1661567716187749?thread_ts=1661499912.287659&cid=CHG769BL2)
The Readme shows ` at the beginning and end of the whole command compared to other commands, do those perhaps need to be included to parse correctly?
New


[FoobarLegend](https://app.slack.com/team/U024Y0R5M25)
  [6 hours ago](https://bloodhoundhq.slack.com/archives/CHG769BL2/p1662027816176069?thread_ts=1661499912.287659&cid=CHG769BL2)
Problem solved. reg_write_value documented that a leading slash was needed but when provided it leads to a NRE. Looks like a bug or discrepancy between docs and code. Solution could be adding leading and trailing slashes in code where applicable so the user doesn't  need to add them (for simplicity) in command minimising discrepancies. Also the call to OpenSubKey in code needed a true value for second argument if you need write access to the key

./mythic-cli install github https://github.com/MythicAgents/Apollo
2024/05/08 11:07:13 [*] Creating temporary directory
2024/05/08 11:07:13 [*] Cloning https://github.com/MythicAgents/Apollo
Cloning into '/opt/Mythic/tmp'...
2024/05/08 11:07:16 [*] Parsing config.json
[*] Processing Payload Type apollo
[*] apollo already exists. Replace current version?  [y/n]: y
2024/05/08 11:07:17 [*] Stopping current container
2024/05/08 11:07:17 [*] Removing current version
2024/05/08 11:07:17 [+] Successfully removed the current version
2024/05/08 11:07:17 [*] Copying new version of payload into place
2024/05/08 11:07:17 [*] Adding service into docker-compose
WARN[0000] /opt/Mythic/docker-compose.yml: `version` is obsolete
No stopped containers
WARN[0000] /opt/Mythic/docker-compose.yml: `version` is obsolete
[+] Building 16.5s (5/6)                                         docker:default
 => [apollo internal] load build definition from Dockerfile                0.0s
 => => transferring dockerfile: 179B                                       0.0s
 => [apollo internal] load metadata for docker.io/itsafeaturemythic/mythi  0.8s
 => [apollo internal] load .dockerignore                                   0.0s
 => => transferring context: 2B                                            0.0s
 => CACHED [apollo 1/3] FROM docker.io/itsafeaturemythic/mythic_python_do  0.0s
 => ERROR [apollo 2/3] RUN python3 -m pip install donut-shellcode         15.6s
------
 > [apollo 2/3] RUN python3 -m pip install donut-shellcode:
2.141 Collecting donut-shellcode
2.208   Downloading donut-shellcode-1.0.2.tar.gz (293 kB)
2.264      ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 293.0/293.0 kB 6.6 MB/s eta 0:00:00
2.432   Installing build dependencies: started
8.662   Installing build dependencies: finished with status 'done'
8.665   Getting requirements to build wheel: started
9.305   Getting requirements to build wheel: finished with status 'done'
9.313   Preparing metadata (pyproject.toml): started
10.00   Preparing metadata (pyproject.toml): finished with status 'done'
10.01 Building wheels for collected packages: donut-shellcode
10.02   Building wheel for donut-shellcode (pyproject.toml): started
13.12   Building wheel for donut-shellcode (pyproject.toml): finished with status 'error'
**13.15   error: subprocess-exited-with-error**
13.15
13.15   × Building wheel for donut-shellcode (pyproject.toml) did not run successfully.
13.15   │ exit code: 1
13.15   ╰─> [65 lines of output]
13.15       running bdist_wheel
13.15       running build
13.15       running build_ext
13.15       building 'donut' extension
13.15       creating build
13.15       creating build/temp.linux-aarch64-cpython-311
13.15       creating build/temp.linux-aarch64-cpython-311/loader
13.15       gcc -pthread -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fPIC -Iinclude -I/usr/local/include/python3.11 -c donut.c -o build/temp.linux-aarch64-cpython-311/donut.o
13.15       donut.c: In function ‘read_file_info’:
13.15       donut.c:574:19: warning: comparison of integer expressions of different signedness: ‘ULONG64’ {aka ‘long unsigned int’} and ‘int’ [-Wsign-compare]
13.15                  if (ofs != -1) {
13.15                          ^~
13.15       donut.c:579:22: warning: comparison of integer expressions of different signedness: ‘ULONG64’ {aka ‘long unsigned int’} and ‘int’ [-Wsign-compare]
13.15                      if(ofs != -1) {
13.15                             ^~
13.15       donut.c: In function ‘gen_random_string’:
13.15       donut.c:667:15: warning: comparison of integer expressions of different signedness: ‘int’ and ‘uint64_t’ {aka ‘long unsigned int’} [-Wsign-compare]
13.15            for(i=0; i<len; i++) {
13.15                      ^
13.15       donut.c: In function ‘is_dll_export’:
13.15       donut.c:1481:16: warning: comparison of integer expressions of different signedness: ‘ULONG64’ {aka ‘long unsigned int’} and ‘int’ [-Wsign-compare]
13.15                if(ofs != -1) {
13.15                       ^~
13.15       In function ‘build_module’,
13.15           inlined from ‘DonutCreate’ at donut.c:1590:17:
13.15       donut.c:768:7: warning: ‘strncpy’ output may be truncated copying 255 bytes from a string of length 255 [-Wstringop-truncation]
13.15              strncpy(mod->method, c->method, DONUT_MAX_NAME-1);
13.15              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13.15       donut.c:746:9: warning: ‘strncpy’ output may be truncated copying 8 bytes from a string of length 255 [-Wstringop-truncation]
13.15                strncpy(mod->domain, c->domain, DONUT_DOMAIN_LEN);
13.15                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13.15       donut.c:753:9: warning: ‘strncpy’ output may be truncated copying 255 bytes from a string of length 255 [-Wstringop-truncation]
13.15                strncpy(mod->cls, c->cls, DONUT_MAX_NAME-1);
13.15                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13.15       donut.c:756:9: warning: ‘strncpy’ output may be truncated copying 255 bytes from a string of length 255 [-Wstringop-truncation]
13.15                strncpy(mod->method, c->method, DONUT_MAX_NAME-1);
13.15                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13.15       donut.c:763:7: warning: ‘strncpy’ output may be truncated copying 255 bytes from a string of length 255 [-Wstringop-truncation]
13.15              strncpy(mod->runtime, c->runtime, DONUT_MAX_NAME-1);
13.15              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13.15       donut.c:792:7: warning: ‘strncat’ output may be truncated copying 250 bytes from a string of length 255 [-Wstringop-truncation]
13.15              strncat(mod->args, c->args, DONUT_MAX_NAME-6);
13.15              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13.15       gcc -pthread -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fPIC -Iinclude -I/usr/local/include/python3.11 -c donutmodule.c -o build/temp.linux-aarch64-cpython-311/donutmodule.o
13.15       donutmodule.c:199:9: warning: initialization of ‘PyObject * (*)(PyObject *, PyObject *)’ {aka ‘struct _object * (*)(struct _object *, struct _object *)’} from incompatible pointer type ‘PyObject * (*)(PyObject *, PyObject *, PyObject *)’ {aka ‘struct _object * (*)(struct _object *, struct _object *, struct _object *)’} [-Wincompatible-pointer-types]
13.15                Donut_Create, // C wrapper function
13.15                ^~~~~~~~~~~~
13.15       donutmodule.c:199:9: note: (near initialization for ‘Donut_FunctionsTable[0].ml_meth’)
13.15       gcc -pthread -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fPIC -Iinclude -I/usr/local/include/python3.11 -c encrypt.c -o build/temp.linux-aarch64-cpython-311/encrypt.o
13.15       gcc -pthread -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fPIC -Iinclude -I/usr/local/include/python3.11 -c format.c -o build/temp.linux-aarch64-cpython-311/format.o
13.15       format.c: In function ‘base64_template’:
13.15       format.c:94:10: warning: ‘i’ may be used uninitialized in this function [-Wmaybe-uninitialized]
13.15            while(i!=0) { *out++ = '='; i--; }
13.15                 ^
13.15       format.c:58:14: note: ‘i’ was declared here
13.15            uint32_t i, len, x;
13.15                     ^
13.15       gcc -pthread -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fPIC -Iinclude -I/usr/local/include/python3.11 -c hash.c -o build/temp.linux-aarch64-cpython-311/hash.o
13.15       gcc -pthread -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fPIC -Iinclude -I/usr/local/include/python3.11 -c loader/clib.c -o build/temp.linux-aarch64-cpython-311/loader/clib.o
13.15       creating build/lib.linux-aarch64-cpython-311
13.15       gcc -pthread -shared build/temp.linux-aarch64-cpython-311/donut.o build/temp.linux-aarch64-cpython-311/donutmodule.o build/temp.linux-aarch64-cpython-311/encrypt.o build/temp.linux-aarch64-cpython-311/format.o build/temp.linux-aarch64-cpython-311/hash.o build/temp.linux-aarch64-cpython-311/loader/clib.o lib/aplib64.a -Llib -L/usr/local/lib -o build/lib.linux-aarch64-cpython-311/donut.cpython-311-aarch64-linux-gnu.so
13.15       /usr/bin/ld: lib/aplib64.a(elfstubs.o): Relocations in generic ELF (EM: 62)
13.15       /usr/bin/ld: lib/aplib64.a: error adding symbols: file in wrong format
13.15       collect2: error: ld returned 1 exit status
13.15       error: command '/usr/bin/gcc' failed with exit code 1
13.15       [end of output]
13.15
13.15   note: This error originates from a subprocess, and is likely not a problem with pip.
13.15   ERROR: Failed building wheel for donut-shellcode
13.16 ERROR: Could not build wheels for donut-shellcode, which is required to install pyproject.toml-based projects
13.16 Failed to build donut-shellcode
13.26
13.26 [notice] A new release of pip is available: 23.1.2 -> 24.0
13.26 [notice] To update, run: pip install --upgrade pip
------
failed to solve: process "/bin/sh -c python3 -m pip install donut-shellcode" did not complete successfully: exit code: 1
2024/05/08 11:07:36 [+] Successfully installed service
2024/05/08 11:07:36 [+] Successfully installed c2
2024/05/08 11:07:36 [*] Processing Documentation for apollo

        ProxyPass /6666index http://127.0.0.1:6666
        ProxyPassReverse /6666index http://127.0.0.1:6666

Configuration Check message from http:
Failed to find port, 443, in C2 Profile configuration
This could indicate the use of a redirector, or a mismatch in expected connectivity.

This means there should be the following connectivity for success:
Agent via HTTPS on port 443 to https://www.example.com/6666index (should be a redirector).
Redirector then forwards request to C2 Profile container on one of the following ports: [{"port": 9999, "use_ssl": false}, {"port": 6666, "use_ssl": false}]