Mythic is a modular C2 framework whose core consists of the Mythic server, Agents, and C2 Profiles. When using it, first determine the target platform and communication path, then install the corresponding Agent/Profile; do not install a bunch of components first and choose on the fly.
Phase 1: Deployment and startup
Mythic is usually deployed on a Linux server and relies on Docker to run its components. The basic installation process is as follows:
sudo apt-get install build-essential
git clone https://github.com/its-a-feature/Mythic --depth 1
cd Mythic
sudo make
sudo ./mythic-cli start
If installing Docker dependencies for the first time on Ubuntu/Debian, you can use the installation script provided by the project; the script will modify the system Docker environment, so before executing it you should confirm that this is a dedicated C2 server.
./install_docker_ubuntu.sh
./install_docker_debian.sh
After startup, first confirm the Web UI, container status, and logs before proceeding to the Agent/Profile installation phase.
Phase 2: Agent selection
The Agent decision depends on the target OS, runtime constraints, and the required post-exploitation capabilities.
| Agent | Language/platform focus | Applicability assessment |
|---|---|---|
| Apollo | C# / .NET Framework | Windows domain environment, .NET available, mature Windows post-exploitation capabilities required |
| Athena | .NET | Windows/.NET scenarios, prioritize confirming the current maintenance status and supported commands |
| Poseidon | Go / Linux / macOS | Linux/macOS targets, or when good cross-platform capability is required |
| Medusa | Python | When a Python environment is available and scripted extensions are required |
| Hannibal | PIC C | When there are requirements for native payloads and in-memory loading |
| Thanatos | Rust / Linux / Windows | When a Rust Agent or cross-platform experimental capability is required |
| Xenon | C / httpx | When a C Agent is required together with the httpx profile |
Install the Agent:
./mythic-cli install github https://github.com/MythicAgents/Apollo
./mythic-cli install github https://github.com/MythicAgents/poseidon
./mythic-cli install github https://github.com/MythicAgents/Athena
Before choosing, prioritize checking the Mythic Community Agent Feature Matrix to confirm whether the target commands are supported by that Agent; different Agents do not have consistent command, injection, credential, and lateral movement capabilities.
Phase 3: C2 Profile selection
The C2 Profile determines how the Agent calls back. It should match the target network egress, rather than being ranked only by "stealthiness."
| Profile | Applicable scenarios | Points to note |
|---|---|---|
http / httpx |
Conventional Web egress | Requires domain, certificate, and traffic characteristic design |
websocket |
Long connections allowed, low-latency interaction required | Long connections are more conspicuous in some networks |
dns |
HTTP egress is restricted but DNS is available | Slow, suitable as a backup or low-frequency channel |
dynamichttp |
When dynamic adjustment of HTTP behavior is required | First verify Agent support |
smb |
Internal lateral movement, hosts without egress | Depends on SMB reachability between the already-controlled host and the target |
tcp |
Simple direct connection or internal network binding | Easily blocked by network boundaries, suitable for controlled experiments or internal networks |
Install the Profile:
./mythic-cli install github https://github.com/MythicC2Profiles/http
./mythic-cli install github https://github.com/MythicC2Profiles/httpx
./mythic-cli install github https://github.com/MythicC2Profiles/dns
./mythic-cli install github https://github.com/MythicC2Profiles/smb
Phase 4: SSL and domains
Handle certificates before bringing HTTP/HTTPS Profiles online. In production exercises, prioritize using real domains and valid certificates; self-signed certificates are suitable for lab environments but easily expose anomalous characteristics.
Use certbot to obtain a certificate:
sudo apt install certbot
certbot certonly --standalone -d "example.com" --register-unsafely-without-email --non-interactive --agree-tos
Copy the certificate to the corresponding Profile container path, and set in the Profile configuration key_path and cert_path corresponding to the filenames:
docker cp /etc/letsencrypt/archive/example.com/fullchain1.pem http:/Mythic/http/c2_code/fullchain.pem
docker cp /etc/letsencrypt/archive/example.com/privkey1.pem http:/Mythic/http/c2_code/privkey.pem
If the Profile enables use_ssl and there is no certificate on disk, some Profiles will automatically generate a self-signed certificate; this method is only suitable for testing and is not recommended for real authorization exercises.
Phase 5: Payload Build and Task Operations
Basic flow:
安装 Agent → 安装 Profile → 创建 payload → 配置 callback 参数 → 生成并投递 → 等待 callback → 下发 task
When building a payload, focus on confirming:
- The Agent matches the target OS/architecture.
- The Profile matches the target egress network.
- The callback host points to the redirector or C2 domain, rather than exposing the management endpoint.
- The sleep/jitter is consistent with the exercise noise requirements.
- The payload format matches the delivery method.
After tasking, first perform low-noise verification, such as identity, hostname, current directory, and network connectivity; once stable, proceed with file, credential, or lateral movement-related operations.
OPSEC and Troubleshooting
| Issue | Troubleshooting Direction |
|---|---|
| Agent does not call back | callback host/port, Profile container status, certificate, target egress policy |
| No command output after callback | Whether the Agent supports that command, whether the task is complete, whether the sleep is too long |
| HTTPS anomaly | Certificate path, domain SNI, Profile use_ssl configuration |
| DNS Profile is slow | This is a channel characteristic; it is only suitable for low-frequency tasks or as a backup channel |
| SMB/TCP unreachable | First verify network reachability and port listening from the target to the pivot |
The modularity of Mythic means that "successful installation" does not equal "capability available". Before every exercise, rely on the official documentation and feature matrix of the current Agent/Profile to confirm command support, platform limitations, and log characteristics.
References
- Mythic Documentation: https://docs.mythic-c2.net
- Mythic Agents: https://github.com/MythicAgents
- Mythic C2 Profiles: https://github.com/MythicC2Profiles