full_pathof the file and determine how many chunks it'll take to transfer the file. It then creates the following structure:
hostfield allows us to track if you're downloading files on the current host or remotely. If you leave this out or leave it blank (
""), then it'll automatically be populated with the callback's hostname. Because you can use this same process for downloading files and downloading screenshots from the remote endpoint in a chunked fashion, the
is_screenshotflag allows this distinction. This helps the UI track whether something should be shown in the screenshot pages or in the files pages. If this information is omitted, then the Mythic server assumes it's a file (i.e.
is_screenshotis assumed to be
false). This message is what's sent as an Action: post_response message.