responsesand aggregates all of the responses into one string called
combinedthen asks Mythic to render it via:
file_idof the screenshot you're trying to render. If you want to return this information from the agent, then this will be the same
file_idthat Mythic returns to you for transferring the file. If you display this information via
process_responseoutput from your agent, then you're likely to pull the file data via an RPC call, and in that case, you're looking for the
agent_file_idvalue. You'll notice that this is an array of identifiers. This allows you to supply multiple at once (for example: you took 5 screenshots over a few minutes or you took screenshots of multiple monitors) and Mythic will create a modal where you can easily click through all of them.
screenshotthat has an array of Dictionaries. We do this so that you can actually render multiple screenshots at once (such as if you fetched information for multiple monitors at a time). For each screenshot, you just need three pieces of information: the
nameof the button you want to render, and the
variantis how you want the button presented (
containedis a solid button and
outlinedis just an outline for the button).
processed. In that case, if we have data we want to also display the partial screenshot, but if we have no responses yet, then we want to just inform the user that we don't have anything yet.
agent_file_idfor the file, then you won't be able to link to it in the UI. Let's take an example and look at what this means:
agent_file_idis the file UUID of the file we're going to download through the UI
variantallows you to control if the button is a solid or just outlined button (
nameis the text inside the button
plaintextis any leading text data you want to dispaly to the user instead of just a single download button
file_idwhich we use to pass in as
agent_file_idfor the browser script, and
total_chunksisn't strictly necessary for anything, but if you look back at the script, you'll see that we display that as plaintext to the user while we're waiting for the download to finish so that the user has some sort of idea how long it'll take (is it 1 chunk, 5, 50, etc).
downloadkey is an array. So yes, if you're downloading multiple files, as long as you can keep track of the responses you're getting back from your agent, you can render and show multiple download buttons.
downloadexample, but the actual dictionary we're returning is a little different. Specifically, we have:
plaintextas a string we want to display before our actual link to the search page
hoverTextas a string for what to display as a tooltip when you hover over the link to the search page
searchis the actual query parameters for the search we want to do. In this case, we're showing that we want to be on the
filestab, with the
Filename, and we want the actual
searchparameter to be what is shown to the user in the display parameters (
display_params). If you're ever curious about what you should include here for your specific search, whenever you're clicking around on the search page, the URL will update to reflect what's being shown. So, you can navigate to what you'd want, then copy and paste it here.
nameis the text represented that is the link to the search page.
tablewhich has an array of Dictionaries. This means that you can have multiple tables if you want. For each one, we need three things: information about headers, the rows, and the title of the table itself. Not too bad right? Let's dive into the headers:
type, and optionally
width. As you might expect,
plaintextis the value that we'll actually use for the title of the column.
typeis controlling what kind of data will be displayed in that column's cells. There are a few options here:
string(just displays a standard string),
size(takes a size in bytes and converts it into something human readable - i.e. 1024 -> 1KB),
date(process date values and display them and sort them properly),
number(display numbers and sort them properly), and finally
button(display a button of some form that does something). The last value here is
width- this is a pixel value of how much width you want the column to take up by default. If you want one or more columns to take up the remaining widths, specify
"fillWidth": true. Columns by default allow for sorting, but this doesn't always make sense. If you want to disable this ( for example, for a button column), set
"disableSort": truein the header information.
plaintextkey with the value we're going to use. You'll notice that aside from
rowStyle, each of these other keys match up with the
plaintextheader values so that we know which values go in which columns.
plaintextvalue that is going to be displayed, there are a few other properties we can specify:
startIcon- specify the name of an icon to use at the beginning of the
plaintextvalue. The available
startIconHoverText- this is text you want to appear when the user hovers over the icon
endIconthis is the same as the
startIconexcept it's at the end of the text
endIconHoverTextthis is the text you want to appear when the user hovers over the icon
plaintextHoverTextthis is the text you want to appear when the user hovers over the plaintext value
copyIcon- use this to indicate true/false if you want a
copyicon to appear at the front of the text. If this is present, this will allow the user to copy all of the text in
plaintextto the clipboard. This is handy if you're displaying exceptionally long pieces of information.
startIconColor- You can specify the color for your start icon. You can either do a color name, like
"gold"or you can do an rgb value like
endIconColor- this is the same as the
startIconColorbut applies to any icon you want to have at the end of your text
nameis the name of the button you want to display to the user. the
typefield is what kind of button we're going to display - in this case we use
dictionaryto indicate that we're going to display a dictionary of information to the user. The other type is
taskthat we'll cover next. The
valuehere should be a Dictionary value that we want to display. We'll display the dictionary as a table where the first column is the key and the second column is the value, so we can provide the column titles we want to use. We can optionally make this button disabled by providing a
disabledfield with a value of
true. Just like with the normal
plaintextsection, we can also specify
startIconColor.Lastly, we provide a
titlefield for what we want to title the overall popup for the user.
hoverTextfor this button as well.
typefields as the dictionary button. Just like with the dictionary button we can make the button disabled or not with the
disabledfield. You might be wondering which task we'll invoke with the button. This works the same way we identify which command to issue via the file browser or the process browser -
ui_feature. These can be anything you want, just make sure you have the corresponding feature listed somewhere in your commands or you'll never be able to task it. Just like with the dictionary button, we can specify
openDialogflag allows you to specify that the tasking popup modal should open and be partially filled out with the data you supplied in the
parametersfield. Similarly, the
getConfirmationflag allows you to force an
accept/canceldialog to get the user's confirmation before issuing a task. This is handy, especially if the tasking is something potentially dangerous (killing a process, removing a file, etc). If you're setting
getConfirmationto true, you can also set
acceptTextto something that makes sense for your tasking, like "yes", "remove", "delete", "kill", etc.
parameters. If you provide parameters, then Mythic will automatically use them when tasking. In this example, we're pre-creating the full path for the files in question and passing that along as the parameters to the
downloadfunction. If you don't provide any parameters and the task you're trying to issue takes parameters, then you will get a popup to provide the parameters, just like if you tasked it from the command line.
tablebutton type and provide all of the same data you did when creating this table to create a new table (yes, you can even have menu buttons on that table).
menu. With this we can wrap the other kinds of buttons:
dictionarybuttons as before, but they're just in an array format now. It's as easy as that. You can even keep your logic for disabling entries or conditionally not even add them. This allows us to create a dropdown menu like the following screenshot: