Installation
Get the code
Pull the code from the official GitHub repository:
This is made to work with docker and docker-compose, so they both need to be installed. If docker is not installed on your ubuntu machine, you can use the ./install_docker_ubuntu.sh script to install it for you.
If you're running on debian, use the ./install_docker_debian.sh instead.
Mythic must be installed on Linux. While macOS supports Docker and Docker-Compose, macOS doesn't handle the shared host networking that Mythic relies on. You can still access the Browser interface from any OS, but the Mythic instance must be installed on Linux
Configure your installation
/Mythic/mythic-docker/config.json contains all of the pieces for you to configure for accessing your operator web UI:
A few important notes here. listen_port will be the port opened on the server where you're running Mythic. The allowed_ip_blocks allow you to restrict access to the login and register pages of Mythic. excluded_c2_profiles and excluded_payload_types allows you to exclude certain docker containers from starting. This is helpful if you know you're not going to use certain payload types or c2 profiles and want to cut down on time/space requirements.
The above configuration does NOT affect the port or SSL information related to your agents or callback information. It's strictly for your operator web UI.
The mythic_server connects to the database via a password specified in Mythic/.env. This password is passed into both the mythic_server and mythic_postgres services via environment variables via docker-compose. This value starts off as POSTGRES_PASSWORD=super_secret_mythic_user_password; however, on first start, Mythic replaces this value with a random 30 character value.
When the mythic_postgres database starts for the first time, it goes through an initialization step where it uses the password from Mythic/.env to create the mythic_user user. Once the database exists, the mythic_postgres container no longer uses that value; however, the password must remain in the Mythic/.env file so that the mythic_server container can connect to the database.
Logging
The web_log_size and web_keep_logs refers only to keeping web logs (i.e. web traffic hitting Mythic). If you're wanting to enable SIEM-based logging, set the siem_log_name to anything but an empty string. Mythic will create that file if it doesn't exist, and log to that file. The following things are logged currently:
Mythic does SIEM-based logging as JSON data where each entry is as follows:
{"timestamp": "UTC Timestring", "mythic_object": "one of the values from above", "message": JSON of the actual message in question}
To start Mythic, simply run sudo ./start_mythic.sh.
Start Mythic
If you came here right from the previous section, your Mythic instance should already be up and running. Check out the next section to confirm that's the case. If at any time you wish to stop Mythic, simply run sudo ./stop_mythic.sh and if you want to start it again run sudo ./start_mythic.sh. If Mythic is currently running and you need to make a change, you can run sudo ./start_mythic.sh again without any issue, that script will automatically stop things and then restart them.
Troubleshooting installation and connection
If something seems off, here's a few places to check:
Run
sudo ./status_check.shto give a status update on all of the docker containers. They should all be up and running. If one is exited or has only been up for less than 30 seconds, that container might be your issue.Your output will be similar to the following. Notice how the
mythic_serverdocker container shows a status ofExited? That looks like an issue
To check the logs of any container, run
sudo ./display_output.sh [container_name]. For example, to see the output of our stopped container, runsudo ./display_output.sh mythic_server. This will help track down if the last thing that happened was an error of some kind.If you don't supply any container names, the script will iterate through all of the containers and dump their output to a file called
display_output.txtthat you can then grep or browse through.
If all of that looks ok, but something still seems off, it's time to check the browser.
If you're seeing "Session Expired, Please Refresh", "Socked errored, please refresh", or "Socket closed, please refresh", then there's an issue with your websocket connections.
First open up the developer tools for your browser and see if there are any errors that might indicate what's wrong. If there's no error though, check the network tab to see if there are any 404 errors.
If that's not the case, make sure you've selected a current operation (more on this in the Quick Usage section). Apfell uses websockets that pull information about your current operation to provide data. If you're not currently in an active operation (indicated at the top of your screen in big letters), then Apfell cannot provide you any data.
Container Sizes
Mythic starts every service (web server, database, each payload type, each C2 profile, rabbitmq, documentation) in its own Docker container. As much as possible, these containers leverage common image bases to reduce size, but due to the nature of so many components, there's going to be a decent footprint. For consideration, here's the Docker footprint for a fresh install of Mythic:
If you want to save space or if you know you're not going to be using a specific container, add that C2 profile or Payload Type name to the appropriate exclude list in the config.json specified above. That indicates to Mythic to not even build or start that container.
Last updated