2. Payload Type Definition

1.0 Payload Type Definition

Payload Type information must be set and pulled from a definition either in Python or in GoLang. Below are basic examples in Python and GoLang:

Python

from mythic_container.PayloadBuilder import *
from mythic_container.MythicCommandBase import *
from mythic_container.MythicRPC import *
import json


class Apfell(PayloadType):
    name = "apfell"
    file_extension = "js"
    author = "@its_a_feature_"
    supported_os = [SupportedOS.MacOS]
    wrapper = False
    wrapped_payloads = []
    note = """This payload uses JavaScript for Automation (JXA) for execution on macOS boxes."""
    supports_dynamic_loading = True
    c2_profiles = ["http", "dynamichttp"]
    mythic_encrypts = True
    translation_container = None # "myPythonTranslation"
    build_parameters = []
    agent_path = pathlib.Path(".") / "apfell"
    agent_icon_path = agent_path / "agent_functions" / "apfell.svg"
    agent_code_path = agent_path / "agent_code"

    build_steps = [
        BuildStep(step_name="Gathering Files", step_description="Making sure all commands have backing files on disk"),
        BuildStep(step_name="Configuring", step_description="Stamping in configuration values")
    ]

    async def build(self) -> BuildResponse:
        # this function gets called to create an instance of your payload
        resp = BuildResponse(status=BuildStatus.Success)
        return resp
        

There are a couple key pieces of information here:

• Line 1-2 imports all of basic classes needed for creating an agent

• line 7 defines the new class (our agent). This can be called whatever you want, but the important piece is that it extends the PayloadType class as shown with the ().

• Lines 8-27 defines the parameters for the payload type that you'd see throughout the UI.

  • the name is the name of the payload type

  • supported_os is an array of supported OS versions

  • supports_dynamic_loading indicates if the agent allows you to select only a subset of commands when creating an agent or not

  • build_parameters is an array describing all of the build parameters when creating your agent

  • c2_profiles is an array of c2 profile names that the agent supports

• Line 18 defines the name of a "translation container" which we will talk about in another section, but this allows you to support your own, non-mythic message format, custom crypto, etc.

• The last piece is the function that's called to build the agent based on all of the information the user provides from the web UI.

The PayloadType base class is in the PayloadBuilder.py file. This is an abstract class, so your instance needs to provide values for all these fields.

Golang

package agentfunctions

import (
	"bytes"
	"encoding/json"
	"fmt"
	agentstructs "github.com/MythicMeta/MythicContainer/agent_structs"
	"github.com/MythicMeta/MythicContainer/mythicrpc"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
)

var payloadDefinition = agentstructs.PayloadType{
	Name:                                   "basicAgent",
	FileExtension:                          "bin",
	Author:                                 "@xorrior, @djhohnstein, @Ne0nd0g, @its_a_feature_",
	SupportedOS:                            []string{agentstructs.SUPPORTED_OS_LINUX, agentstructs.SUPPORTED_OS_MACOS},
	Wrapper:                                false,
	CanBeWrappedByTheFollowingPayloadTypes: []string{},
	SupportsDynamicLoading:                 false,
	Description:                            "A fully featured macOS and Linux Golang agent",
	SupportedC2Profiles:                    []string{"http", "websocket", "poseidon_tcp"},
	MythicEncryptsData:                     true,
	BuildParameters: []agentstructs.BuildParameter{
		{
			Name:          "mode",
			Description:   "Choose the build mode option. Select default for executables, c-shared for a .dylib or .so file, or c-archive for a .Zip containing C source code with an archive and header file",
			Required:      false,
			DefaultValue:  "default",
			Choices:       []string{"default", "c-archive", "c-shared"},
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_CHOOSE_ONE,
		},
		{
			Name:          "architecture",
			Description:   "Choose the agent's architecture",
			Required:      false,
			DefaultValue:  "AMD_x64",
			Choices:       []string{"AMD_x64", "ARM_x64"},
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_CHOOSE_ONE,
		},
		{
			Name:          "proxy_bypass",
			Description:   "Ignore HTTP proxy environment settings configured on the target host?",
			Required:      false,
			DefaultValue:  false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_BOOLEAN,
		},
		{
			Name:          "garble",
			Description:   "Use Garble to obfuscate the output Go executable.\nWARNING - This significantly slows the agent build time.",
			Required:      false,
			DefaultValue:  false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_BOOLEAN,
		},
	},
	BuildSteps: []agentstructs.BuildStep{
		{
			Name:        "Configuring",
			Description: "Cleaning up configuration values and generating the golang build command",
		},

		{
			Name:        "Compiling",
			Description: "Compiling the golang agent (maybe with obfuscation via garble)",
		},
	},
}

func build(payloadBuildMsg agentstructs.PayloadBuildMessage) agentstructs.PayloadBuildResponse {
	payloadBuildResponse := agentstructs.PayloadBuildResponse{
		PayloadUUID:        payloadBuildMsg.PayloadUUID,
		Success:            true,
		UpdatedCommandList: &payloadBuildMsg.CommandList,
	}
	return payloadBuildResponse
}

1.1 Wrapper Payloads

A quick note about wrapper payload types - there's only a few differences between a wrapper payload type and a normal payload type. A configuration variable, wrapper, determines if something is a wrapper or not. A wrapper payload type takes as input the output of a previous build (normal payload type or wrapper payload type) along with build parameters and generates a new payload. A wrapper payload type does NOT have any c2 profiles associated with it because it's simply wrapping an existing payload.

An easy example is thinking of the service_wrapper - this wrapper payload type takes in the shellcode version of another payload and "wraps" it in the execution of a service so that it'll properly respond to the service control manager on windows. A similar example would be to take an agent and wrap it in an MSBuild format. These things don't have their own C2, but rather just package/wrap an existing agent into a new, more generic, format.

Python

To access the payload that you're going to wrap, use the self.wrapped_payload attribute during your build execution. This will be the base64 encoded version of the payload you're going to wrap.

Golang

To access the payload that you're going to wrap, use the payloadBuildMsg.WrappedPayload attribute during your build execution. This will be the raw bytes of the payload you're going to wrap.

When you're done generating the payload, you'll return your new result the exact same way as normal payloads (as part of the build process).

2.0 Build Parameters

Build parameters define the components shown to the user when creating a payload.

The BuildParameter class has a couple of pieces of information that you can use to customize and validate the parameters supplied to your build:

Python

The most up-to-date code is available in the https://github.com/MythicMeta/MythicContainerPyPi repository.

class BuildParameterType(str, Enum):
    """Types of parameters available for building payloads

    Attributes:
        String:
            A string value
        ChooseOne:
            A list of choices for the user to select exactly one
        ChooseMultiple:
            A list of choices for the user to select 0 or more
        Array:
            The user can supply multiple values in an Array format
        Date:
            The user can select a Date in YYYY-MM-DD format
        Dictionary:
            The user can supply a dictionary of values
        Boolean:
            The user can toggle a switch for True/False
        File:
            The user can select a file that gets uploaded - a file UUID gets passed in during build
        TypedArray:
            The user can supply an array where each element also has a drop-down option of choices
    """
    String = "String"
    ChooseOne = "ChooseOne"
    ChooseMultiple = "ChooseMultiple"
    Array = "Array"
    Date = "Date"
    Dictionary = "Dictionary"
    Boolean = "Boolean"
    File = "File"
    TypedArray = "TypedArray"

Golang

The most up-to-date code is available at https://github.com/MythicMeta/MythicContainer.

type BuildParameterType = string

const (
   BUILD_PARAMETER_TYPE_STRING          BuildParameterType = "String"
   BUILD_PARAMETER_TYPE_BOOLEAN                            = "Boolean"
   BUILD_PARAMETER_TYPE_CHOOSE_ONE                         = "ChooseOne"
   BUILD_PARAMETER_TYPE_CHOOSE_MULTIPLE                    = "ChooseMultiple"
   BUILD_PARAMETER_TYPE_DATE                               = "Date"
   BUILD_PARAMETER_TYPE_DICTIONARY                         = "Dictionary"
   BUILD_PARAMETER_TYPE_ARRAY                              = "Array"
   BUILD_PARAMETER_TYPE_NUMBER                             = "Number"
   BUILD_PARAMETER_TYPE_FILE                               = "File"
   BUILD_PARAMETER_TYPE_TYPED_ARRAY                        = "TypedArray"
)

// BuildParameter - A structure defining the metadata about a build parameter for the user to select when building a payload.
type BuildParameter struct {
   // Name - the name of the build parameter for use during the Payload Type's build function
   Name string `json:"name"`
   // Description - the description of the build parameter to be presented to the user during build
   Description string `json:"description"`
   // Required - indicate if this requires the user to supply a value or not
   Required bool `json:"required"`
   // VerifierRegex - if the user is supplying text and it needs to match a specific pattern, specify a regex pattern here and the UI will indicate to the user if the value is valid or not
   VerifierRegex string `json:"verifier_regex"`
   // DefaultValue - A default value to show the user when building in the Mythic UI. The type here depends on the Parameter Type - ex: for a String, supply a string. For an array, provide an array
   DefaultValue interface{} `json:"default_value"`
   // ParameterType - The type of parameter this is so that the UI can properly render components for the user to modify
   ParameterType BuildParameterType `json:"parameter_type"`
   // FormatString - If Randomize is true, this regex format string is used to generate a value when presenting the option to the user
   FormatString string `json:"format_string"`
   // Randomize - Should this value be randomized each time it's shown to the user so that each payload has a different value
   Randomize bool `json:"randomize"`
   // IsCryptoType -If this is True, then the value supplied by the user is for determining the _kind_ of crypto keys to generate (if any) and the resulting stored value in the database is a dictionary composed of the user's selected and an enc_key and dec_key value
   IsCryptoType bool `json:"crypto_type"`
   // Choices - If the ParameterType is ChooseOne or ChooseMultiple, then the options presented to the user are here.
   Choices []string `json:"choices"`
   // DictionaryChoices - if the ParameterType is Dictionary, then the dictionary choices/preconfigured data is set here
   DictionaryChoices []BuildParameterDictionary `json:"dictionary_choices"`
}

// BuildStep - Identification of a step in the build process that's shown to the user to eventually collect start/end time as well as stdout/stderr per step
type BuildStep struct {
   Name        string `json:"step_name"`
   Description string `json:"step_description"`
}

• name is the name of the parameter, if you don't provide a longer description, then this is what's presented to the user when building your payload

• parameter_type describes what is presented to the user - valid types are:

  • BuildParameterType.String

    • During build, this is a string

  • BuildParameterType.ChooseOne

    • During build, this is a string

  • BuildParameterType.ChooseMultiple

    • During build, this is an array of strings

  • BuildParameterType.Array

    • During build, this is an array of strings

  • BuildParameterType.Date

    • During build, this is a string of the format YYYY-MM-DD

  • BuildParameterType.Dictionary

    • During build, this is a dictionary

  • BuildParameterType.Boolean

    • During build, this is a boolean

  • BuildParameterType.File

    • During build, this is a string UUID of the file (so that you can use a MythicRPC call to fetch the contents of the file)

  • BuildParameterType.TypedArray

    • During build, this is an arrray of arrays, always in the format [ [ type, value], [type value], [type, value] ...]

• required indicates if there must be a value supplied. If no value is supplied by the user and no default value supplied here, then an exception is thrown before execution gets to the build function.

• verifier_regex is a regex the web UI can use to provide some information to the user about if they're providing a valid value or not

• default_value is the default value used for building if the user doesn't supply anything

• choices is where you can supply an array of options for the user to pick from if the parameter_type is ChooseOne

• dictionary_choices are the choices and metadata about what to display to the user for key-value pairs that the user might need to supply

• value is the component you access when building your payload - this is the final value (either the default value or the value the user supplied)

• verifier_func is a function you can provide for additional checks on the value the user supplies to make sure it's what you want. This function should either return nothing or raise an exception if something isn't right

As a recap, where does this come into play? In the first section, we showed a section like:

Python

build_parameters = [
        BuildParameter(name="string", parameter_type=BuildParameterType.String, 
                       description="test string", default_value="test"),
        BuildParameter(name="choose one", parameter_type=BuildParameterType.ChooseOne, 
                       description="test choose one",
                       choices=["a", "b"], default_value="a"),
        BuildParameter(name="choose one crypto", 
                       parameter_type=BuildParameterType.ChooseOne, 
                       description="choose one crypto",
                       crypto_type=True, choices=["aes256_hmac", "none"]),
        BuildParameter(name="date", parameter_type=BuildParameterType.Date, 
                       default_value=30, description="test date offset from today"),
        BuildParameter(name="array", parameter_type=BuildParameterType.Array, 
                       default_value=["a", "b"],
                       description="test array"),
        BuildParameter(name="dict", parameter_type=BuildParameterType.Dictionary, 
                       dictionary_choices=[
            DictionaryChoice(name="host", default_value="abc.com", default_show=False),
            DictionaryChoice(name="user-agent", default_show=True, default_value="mozilla")
        ],
                       description="test dictionary"),
        BuildParameter(name="random", parameter_type=BuildParameterType.String, 
                       randomize=True, format_string="[a,b,c]{3}",
                       description="test randomized string"),
        BuildParameter(name="bool", parameter_type=BuildParameterType.Boolean, 
                       default_value=True, description="test boolean")
    ]
    

Golang

BuildParameters: []agentstructs.BuildParameter{
		{
			Name:          "mode",
			Description:   "Choose the build mode option. Select default for executables, c-shared for a .dylib or .so file, or c-archive for a .Zip containing C source code with an archive and header file",
			Required:      false,
			DefaultValue:  "default",
			Choices:       []string{"default", "c-archive", "c-shared"},
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_CHOOSE_ONE,
		},
		{
			Name:          "architecture",
			Description:   "Choose the agent's architecture",
			Required:      false,
			DefaultValue:  "AMD_x64",
			Choices:       []string{"AMD_x64", "ARM_x64"},
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_CHOOSE_ONE,
		},
		{
			Name:          "proxy_bypass",
			Description:   "Ignore HTTP proxy environment settings configured on the target host?",
			Required:      false,
			DefaultValue:  false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_BOOLEAN,
		},
		{
			Name:          "garble",
			Description:   "Use Garble to obfuscate the output Go executable.\nWARNING - This significantly slows the agent build time.",
			Required:      false,
			DefaultValue:  false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_BOOLEAN,
		},
	},

3.0 Building

You have to implement the build function and return an instance of the BuildResponse class. This response has these fields:

• status - an instance of BuildStatus (Success or Error)

  • Specifically, BuildStatus.Success or BuildStatus.Error

• payload - the raw bytes of the finished payload (if you failed to build, set this to None or empty bytes like b'' in Python.

• build_message - any stdout data you want the user to see

• build_stderr - any stderr data you want the user to see

• build_stdout - any stdout data you want the user to see

• updated_filename - if you want to update the filename to something more appropriate, set it here.

  • For example: the user supplied a filename of apollo.exe but based on the build parameters, you're actually generating a dll, so you can update the filename to be apollo.dll. This is particularly useful if you're optionally returning a zip of information so that the user doesn't have to change the filename before downloading. If you plan on doing this to update the filename for a wide variety of options, then it might be best to leave the file extension field in your payload type definition blank "" so that you can more easily adjust the extension.

The most basic version of the build function would be:

Python

async def build(self) -> BuildResponse:
        # this function gets called to create an instance of your payload
        return BuildResponse(status=BuildStatus.Success)

Golang

func build(payloadBuildMsg agentstructs.PayloadBuildMessage) agentstructs.PayloadBuildResponse {
	payloadBuildResponse := agentstructs.PayloadBuildResponse{
		PayloadUUID:        payloadBuildMsg.PayloadUUID,
		Success:            true,
	}
	return payloadBuildResponse
}

Once the build function is called, all of your BuildParameters will already be verified (all parameters marked as required will have a value of some form (user supplied or default_value) and all of the verifier functions will be called if they exist). This allows you to know that by the time your build function is called that all of your parameters are valid.

Your build function gets a few pieces of information to help you build the agent (other than the build parameters):

From within your build function, you'll have access to the following pieces of information:

Python

• self.uuid - the UUID associated with your payload

  • This is how your payload identifies itself to Mythic before getting a new Staging and final Callback UUID

• self.commands - a wrapper class around the names of all the commands the user selected.

  • Access this list via self.commands.get_commands()

for cmd in self.commands.get_commands():
    command_code += open(self.agent_code_path / "{}.js".format(cmd), 'r').read() + "\n"

• self.agent_code_path - a pathlib.Path object pointing to the path of the agent_code directory that holds all the code for your payload. This is something you pre-define as part of your agent definition.

  • To access "test.js" in that "agent_code" folder, simply do: f = open(self.agent_code_path / "test.js", 'r').

  • With pathlib.Path objects, the / operator allows you to concatenate paths in an OS agnostic manner. This is the recommended way to access files so that your code can work anywhere.

• self.get_parameter("parameter name here")

  • The build parameters that are validated from the user. If you have a build_parameter with a name of "version", you can access the user supplied or default value with self.get_parameter("version")

• self.selected_os - This is the OS that was selected on the first step of creating a payload

• self.c2info - this holds a list of dictionaries of the c2 parameters and c2 class information supplied by the user. This is a list because the user can select multiple c2 profiles (maybe they want HTTP and SMB in the payload for example). For each element in self.c2info, you can access the information about the c2 profile with get_c2profile() and access to the parameters via get_parameters_dict(). Both of these return a dictionary of key-value pairs.

  • the dictionary returned by self.c2info[0].get_c2profile() contains the following:

    • name - name of the c2 profile

    • description - description of the profile

    • is_p2p - boolean of if the profile is marked as a p2p profile or not

  • the dictionary returned by self.c2info[0].get_parameters_dict()contains the following:

    • key - value

      • where each key is the key value defined for the c2 profile's parameters and value is what the user supplied. You might be wondering where to get these keys? Well, it's not too crazy and you can view them right in the UI - Name Fields.

      • If the C2 parameter has a value of crypto_type=True, then the "value" here will be a bit more than just a string that the user supplied. Instead, it'll be a dictionary with three pieces of information: value - the value that the user supplied, enc_key - a base64 string (or None) of the encryption key to be used, dec_key - a base64 string (or None) of the decryption key to be used. This gives you more flexibility in automatically generating encryption/decryption keys and supporting crypto types/schemas that Mythic isn't aware of. In the HTTP profile, the key AESPSK has this type set to True, so you'd expect that dictionary.

      • If the C2 parameter has a type of "Dictionary", then things are a little different.

        • Let's take the "headers" parameter in the http profile for example. This allows you to set header values for your http traffic such as User-Agent, Host, and more. When you get this value on the agent side, you get an array of values that look like the following: {"User-Agent": "the user agent the user supplied", "MyCustomHeader": "my custom value"}. You get the final "dictionary" that's created from the user supplied fields.

• One way to leverage this could be:

for c2 in self.c2info:
    c2_code = ""
    try:
        profile = c2.get_c2profile()
        c2_code = open(
            self.agent_code_path
            / "c2_profiles"
            / "{}.js".format(profile["name"]),
            "r",
        ).read()
        for key, val in c2.get_parameters_dict().items():
            if key == "AESPSK":
                c2_code = c2_code.replace(key, val["enc_key"] if val["enc_key"] is not None else "")
            elif not isinstance(val, str):
                c2_code = c2_code.replace(key, json.dumps(val))
            else:
                c2_code = c2_code.replace(key, val)
    except Exception as p:
        build_msg += str(p)
        pass

Golang

// PayloadBuildMessage - A structure of the build information the user provided to generate an instance of the payload type.
// This information gets passed to your payload type's build function.
type PayloadBuildMessage struct {
	// PayloadType - the name of the payload type for the build
	PayloadType string `json:"payload_type" mapstructure:"payload_type"`
	// Filename - the name of the file the user originally supplied for this build
	Filename string `json:"filename" mapstructure:"filename"`
	// CommandList - the list of commands the user selected to include in the build
	CommandList []string `json:"commands" mapstructure:"commands"`
	// build param name : build value
	// BuildParameters - map of param name -> build value from the user for the build parameters defined
	// File type build parameters are supplied as a string UUID to use with MythicRPC for fetching file contents
	// Array type build parameters are supplied as []string{}
	BuildParameters PayloadBuildArguments `json:"build_parameters" mapstructure:"build_parameters"`
	// C2Profiles - list of C2 profiles selected to include in the payload and their associated parameters
	C2Profiles []PayloadBuildC2Profile `json:"c2profiles" mapstructure:"c2profiles"`
	// WrappedPayload - bytes of the wrapped payload if one exists
	WrappedPayload *[]byte `json:"wrapped_payload,omitempty" mapstructure:"wrapped_payload"`
	// WrappedPayloadUUID - the UUID of the wrapped payload if one exists
	WrappedPayloadUUID *string `json:"wrapped_payload_uuid,omitempty" mapstructure:"wrapped_payload_uuid"`
	// SelectedOS - the operating system the user selected when building the agent
	SelectedOS string `json:"selected_os" mapstructure:"selected_os"`
	// PayloadUUID - the Mythic generated UUID for this payload instance
	PayloadUUID string `json:"uuid" mapstructure:"uuid"`
	// PayloadFileUUID - The Mythic generated File UUID associated with this payload
	PayloadFileUUID string `json:"payload_file_uuid" mapstructure:"payload_file_uuid"`
}

// PayloadBuildC2Profile - A structure of the selected C2 Profile information the user selected to build into a payload.
type PayloadBuildC2Profile struct {
	Name  string `json:"name" mapstructure:"name"`
	IsP2P bool   `json:"is_p2p" mapstructure:"is_p2p"`
	// parameter name: parameter value
	// Parameters - this is an interface of parameter name -> parameter value from the associated C2 profile.
	// The types for the various parameter names can be found by looking at the build parameters in the Mythic UI.
	Parameters map[string]interface{} `json:"parameters" mapstructure:"parameters"`
}

type CryptoArg struct {
	Value  string `json:"value" mapstructure:"value"`
	EncKey string `json:"enc_key" mapstructure:"enc_key"`
	DecKey string `json:"dec_key" mapstructure:"dec_key"`
}

Finally, when building a payload, it can often be helpful to have both stdout and stderr information captured, especially if you're compiling code. Because of this, you can set the build_message ,build_stderr , and build_stdout fields of the BuildResponse to have this data. For example:

Python

    async def build(self) -> BuildResponse:
        # this function gets called to create an instance of your payload
        resp = BuildResponse(status=BuildStatus.Success)
        # create the payload
        build_msg = ""

        #create_payload = await MythicRPC().execute("create_callback", payload_uuid=self.uuid, c2_profile="http")
        try:
            command_code = ""
            for cmd in self.commands.get_commands():
                try:
                    command_code += (
                            open(self.agent_code_path / "{}.js".format(cmd), "r").read() + "\n"
                    )
                except Exception as p:
                    pass
            base_code = open(
                self.agent_code_path / "base" / "apfell-jxa.js", "r"
            ).read()
            await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage(
                PayloadUUID=self.uuid,
                StepName="Gathering Files",
                StepStdout="Found all files for payload",
                StepSuccess=True
            ))
            base_code = base_code.replace("UUID_HERE", self.uuid)
            base_code = base_code.replace("COMMANDS_HERE", command_code)
            all_c2_code = ""
            if len(self.c2info) != 1:
                resp.build_stderr = "Apfell only supports one C2 Profile at a time"
                resp.set_status(BuildStatus.Error)
                return resp
            for c2 in self.c2info:
                c2_code = ""
                try:
                    profile = c2.get_c2profile()
                    c2_code = open(
                        self.agent_code_path
                        / "c2_profiles"
                        / "{}.js".format(profile["name"]),
                        "r",
                    ).read()
                    for key, val in c2.get_parameters_dict().items():
                        if key == "AESPSK":
                            c2_code = c2_code.replace(key, val["enc_key"] if val["enc_key"] is not None else "")
                        elif not isinstance(val, str):
                            c2_code = c2_code.replace(key, json.dumps(val))
                        else:
                            c2_code = c2_code.replace(key, val)
                except Exception as p:
                    build_msg += str(p)
                    pass
                all_c2_code += c2_code
            base_code = base_code.replace("C2PROFILE_HERE", all_c2_code)
            await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage(
                PayloadUUID=self.uuid,
                StepName="Configuring",
                StepStdout="Stamped in all of the fields",
                StepSuccess=True
            ))
            resp.payload = base_code.encode()
            if build_msg != "":
                resp.build_stderr = build_msg
                resp.set_status(BuildStatus.Error)
            else:
                resp.build_message = "Successfully built!\n"
        except Exception as e:
            resp.set_status(BuildStatus.Error)
            resp.build_stderr = "Error building payload: " + str(e)
        return resp

Golang

https://github.com/MythicAgents/poseidon/blob/master/Payload_Type/poseidon/poseidon/agentfunctions/builder.go#L108

package agentfunctions

import (
	"archive/zip"
	"bytes"
	"encoding/base64"
	"encoding/json"
	"fmt"
	agentstructs "github.com/MythicMeta/MythicContainer/agent_structs"
	"github.com/MythicMeta/MythicContainer/mythicrpc"
	"github.com/google/uuid"
	"github.com/pelletier/go-toml"
	"golang.org/x/exp/slices"
	"io"
	"os"
	"os/exec"
	"path/filepath"
	"strconv"
	"strings"
	"time"
)

const version = "2.1.11"

type sleepInfoStruct struct {
	Interval int       `json:"interval"`
	Jitter   int       `json:"jitter"`
	KillDate time.Time `json:"killdate"`
}

var payloadDefinition = agentstructs.PayloadType{
	Name:                                   "poseidon",
	FileExtension:                          "bin",
	Author:                                 "@xorrior, @djhohnstein, @Ne0nd0g, @its_a_feature_",
	SupportedOS:                            []string{agentstructs.SUPPORTED_OS_LINUX, agentstructs.SUPPORTED_OS_MACOS},
	Wrapper:                                false,
	CanBeWrappedByTheFollowingPayloadTypes: []string{},
	SupportsDynamicLoading:                 false,
	Description:                            fmt.Sprintf("A fully featured macOS and Linux Golang agent.\nVersion %s\nNeeds Mythic 3.3.0+", version),
	SupportedC2Profiles:                    []string{"http", "websocket", "poseidon_tcp", "dynamichttp", "webshell", "httpx"},
	MythicEncryptsData:                     true,
	BuildParameters: []agentstructs.BuildParameter{
		{
			Name:          "mode",
			Description:   "Choose the build mode option. Select default for executables, c-shared for a .dylib or .so file, or c-archive for a .Zip containing C source code with an archive and header file",
			Required:      false,
			DefaultValue:  "default",
			Choices:       []string{"default", "c-archive", "c-shared"},
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_CHOOSE_ONE,
		},
		{
			Name:          "architecture",
			Description:   "Choose the agent's architecture",
			Required:      false,
			DefaultValue:  "AMD_x64",
			Choices:       []string{"AMD_x64", "ARM_x64"},
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_CHOOSE_ONE,
		},
		{
			Name:          "proxy_bypass",
			Description:   "Ignore HTTP proxy environment settings configured on the target host?",
			Required:      false,
			DefaultValue:  false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_BOOLEAN,
		},
		{
			Name:          "garble",
			Description:   "Use Garble to obfuscate the output Go executable.\nWARNING - This significantly slows the agent build time.",
			Required:      false,
			DefaultValue:  false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_BOOLEAN,
		},
		{
			Name:          "debug",
			Description:   "Create a debug build with print statements for debugging.",
			Required:      false,
			DefaultValue:  false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_BOOLEAN,
		},
		{
			Name:          "egress_order",
			Description:   "Prioritize the order in which egress connections are made (if including multiple egress c2 profiles)",
			Required:      false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_ARRAY,
			DefaultValue:  []string{"http", "websocket", "dynamichttp"},
		},
		{
			Name:          "egress_failover",
			Description:   "How should egress mechanisms rotate",
			Required:      false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_CHOOSE_ONE,
			Choices:       []string{"failover"},
			DefaultValue:  "failover",
		},
		{
			Name:          "failover_threshold",
			Description:   "How many failed attempts should cause a rotate of egress comms",
			Required:      false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_NUMBER,
			DefaultValue:  10,
		},
		{
			Name:          "static",
			Description:   "Statically compile the payload",
			Required:      false,
			ParameterType: agentstructs.BUILD_PARAMETER_TYPE_BOOLEAN,
			DefaultValue:  false,
		},
	},
	BuildSteps: []agentstructs.BuildStep{
		{
			Name:        "Configuring",
			Description: "Cleaning up configuration values and generating the golang build command",
		},
		{
			Name:        "Garble",
			Description: "Adding in Garble (obfuscation)",
		},
		{
			Name:        "Compiling",
			Description: "Compiling the golang agent",
		},
	},
	CheckIfCallbacksAliveFunction: func(message agentstructs.PTCheckIfCallbacksAliveMessage) agentstructs.PTCheckIfCallbacksAliveMessageResponse {
		response := agentstructs.PTCheckIfCallbacksAliveMessageResponse{Success: true, Callbacks: make([]agentstructs.PTCallbacksToCheckResponse, 0)}
		for _, callback := range message.Callbacks {
			//logging.LogInfo("callback info", "callback", callback)
			if callback.SleepInfo == "" {
				continue // can't do anything if we don't know the expected sleep info of the agent
			}
			sleepInfo := map[string]sleepInfoStruct{}
			err := json.Unmarshal([]byte(callback.SleepInfo), &sleepInfo)
			if err != nil {
				//logging.LogError(err, "failed to parse sleep info struct")
				continue
			}
			atLeastOneCallbackWithinRange := false
			for activeC2, _ := range sleepInfo {
				if activeC2 == "websocket" && callback.LastCheckin.Unix() == 0 {
					atLeastOneCallbackWithinRange = true
					continue
				}
				if activeC2 == "poseidon_tcp" {
					atLeastOneCallbackWithinRange = true
					continue
				}
				maxAdd := sleepInfo[activeC2].Interval
				if sleepInfo[activeC2].Jitter > 0 {
					// maximum would be sleep_interval + (sleep_jitter % of sleep_interval)
					maxAdd = maxAdd + ((sleepInfo[activeC2].Jitter / 100) * (sleepInfo[activeC2].Interval))
				}
				maxAdd *= 2 // double the high end in case we're on a close boundary
				latest := callback.LastCheckin.Add(time.Duration(maxAdd) * time.Second)
				if time.Now().UTC().Before(latest) {
					atLeastOneCallbackWithinRange = true
				}
			}
			response.Callbacks = append(response.Callbacks, agentstructs.PTCallbacksToCheckResponse{
				ID:    callback.ID,
				Alive: atLeastOneCallbackWithinRange,
			})
		}
		return response
	},
}

func build(payloadBuildMsg agentstructs.PayloadBuildMessage) agentstructs.PayloadBuildResponse {
	payloadBuildResponse := agentstructs.PayloadBuildResponse{
		PayloadUUID:        payloadBuildMsg.PayloadUUID,
		Success:            true,
		UpdatedCommandList: &payloadBuildMsg.CommandList,
	}
	if len(payloadBuildMsg.C2Profiles) == 0 {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = "Failed to build - must select at least one C2 Profile"
		return payloadBuildResponse
	}
	macOSVersion := "10.12"
	targetOs := "linux"
	if payloadBuildMsg.SelectedOS == "macOS" {
		targetOs = "darwin"
	} else if payloadBuildMsg.SelectedOS == "Windows" {
		targetOs = "windows"
	}
	egress_order, err := payloadBuildMsg.BuildParameters.GetArrayArg("egress_order")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	egress_failover, err := payloadBuildMsg.BuildParameters.GetChooseOneArg("egress_failover")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	debug, err := payloadBuildMsg.BuildParameters.GetBooleanArg("debug")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	static, err := payloadBuildMsg.BuildParameters.GetBooleanArg("static")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	if static && targetOs == "darwin" {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = "Cannot currently build fully static library for macOS"
		return payloadBuildResponse
	}
	failedConnectionCountThresholdString, err := payloadBuildMsg.BuildParameters.GetNumberArg("failover_threshold")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	// This package path is used with Go's "-X" link flag to set the value string variables in code at compile
	// time. This is how each profile's configurable options are passed in.
	poseidon_repo_profile := "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/pkg/profiles"
	poseidon_repo_utils := "github.com/MythicAgents/poseidon/Payload_Type/poseidon/agent_code/pkg/utils"

	// Build Go link flags that are passed in at compile time through the "-ldflags=" argument
	// https://golang.org/cmd/link/
	ldflags := ""
	if static {
		ldflags += fmt.Sprintf("-extldflags=-static -s -w -X '%s.UUID=%s'", poseidon_repo_profile, payloadBuildMsg.PayloadUUID)
	} else {
		ldflags += fmt.Sprintf("-s -w -X '%s.UUID=%s'", poseidon_repo_profile, payloadBuildMsg.PayloadUUID)
	}
	ldflags += fmt.Sprintf(" -X '%s.debugString=%v'", poseidon_repo_utils, debug)
	ldflags += fmt.Sprintf(" -X '%s.egress_failover=%s'", poseidon_repo_profile, egress_failover)
	ldflags += fmt.Sprintf(" -X '%s.failedConnectionCountThresholdString=%v'", poseidon_repo_profile, failedConnectionCountThresholdString)
	if egressBytes, err := json.Marshal(egress_order); err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	} else {
		stringBytes := base64.StdEncoding.EncodeToString(egressBytes)
		//stringBytes = strings.ReplaceAll(stringBytes, "\"", "\\\"")
		ldflags += fmt.Sprintf(" -X '%s.egress_order=%s'", poseidon_repo_profile, stringBytes)
	}
	// Iterate over the C2 profile parameters and associated variable through Go's "-X" link flag
	for index, _ := range payloadBuildMsg.C2Profiles {
		initialConfig := make(map[string]interface{})
		for _, key := range payloadBuildMsg.C2Profiles[index].GetArgNames() {
			if key == "AESPSK" {
				//cryptoVal := val.(map[string]interface{})
				cryptoVal, err := payloadBuildMsg.C2Profiles[index].GetCryptoArg(key)
				if err != nil {
					payloadBuildResponse.Success = false
					payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
					return payloadBuildResponse
				}
				initialConfig[key] = cryptoVal.EncKey
				//ldflags += fmt.Sprintf(" -X '%s.%s_%s=%s'", poseidon_repo_profile, payloadBuildMsg.C2Profiles[index].Name, key, cryptoVal.EncKey)
			} else if key == "headers" {
				headers, err := payloadBuildMsg.C2Profiles[index].GetDictionaryArg(key)
				if err != nil {
					payloadBuildResponse.Success = false
					payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
					return payloadBuildResponse
				}
				initialConfig[key] = headers
				/*
					if jsonBytes, err := json.Marshal(headers); err != nil {
						payloadBuildResponse.Success = false
						payloadBuildResponse.BuildStdErr = err.Error()
						return payloadBuildResponse
					} else {
						stringBytes := string(jsonBytes)
						stringBytes = strings.ReplaceAll(stringBytes, "\"", "\\\"")
						ldflags += fmt.Sprintf(" -X '%s.%s_%s=%s'", poseidon_repo_profile, payloadBuildMsg.C2Profiles[index].Name, key, stringBytes)
					}

				*/
			} else if key == "raw_c2_config" {
				agentConfigString, err := payloadBuildMsg.C2Profiles[index].GetStringArg(key)
				if err != nil {
					payloadBuildResponse.Success = false
					payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
					return payloadBuildResponse
				}
				configData, err := mythicrpc.SendMythicRPCFileGetContent(mythicrpc.MythicRPCFileGetContentMessage{
					AgentFileID: agentConfigString,
				})
				if err != nil {
					payloadBuildResponse.Success = false
					payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
					return payloadBuildResponse
				}
				if !configData.Success {
					payloadBuildResponse.Success = false
					payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + configData.Error
					return payloadBuildResponse
				}
				tomlConfig := make(map[string]interface{})
				err = json.Unmarshal(configData.Content, &tomlConfig)
				if err != nil {
					err = toml.Unmarshal(configData.Content, &tomlConfig)
					if err != nil {
						payloadBuildResponse.Success = false
						payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
						return payloadBuildResponse
					}
				}
				initialConfig[key] = tomlConfig
				/*
					agentConfigString = strings.ReplaceAll(string(configData.Content), "\\", "\\\\")
					agentConfigString = strings.ReplaceAll(agentConfigString, "\"", "\\\"")
					agentConfigString = strings.ReplaceAll(agentConfigString, "\n", "")
					ldflags += fmt.Sprintf(" -X '%s.%s_%s=%s'", poseidon_repo_profile, payloadBuildMsg.C2Profiles[index].Name, key, agentConfigString)
				*/
			} else if slices.Contains([]string{"callback_jitter", "callback_interval", "callback_port", "port", "callback_port", "failover_threshold"}, key) {

				val, err := payloadBuildMsg.C2Profiles[index].GetNumberArg(key)
				if err != nil {
					stringVal, err := payloadBuildMsg.C2Profiles[index].GetStringArg(key)
					if err != nil {
						payloadBuildResponse.Success = false
						payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
						return payloadBuildResponse
					}
					realVal, err := strconv.Atoi(stringVal)
					if err != nil {
						payloadBuildResponse.Success = false
						payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
						return payloadBuildResponse
					}
					initialConfig[key] = realVal
				} else {
					initialConfig[key] = int(val)
				}

				//ldflags += fmt.Sprintf(" -X '%s.%s_%s=%v'", poseidon_repo_profile, payloadBuildMsg.C2Profiles[index].Name, key, val)
			} else if slices.Contains([]string{"encrypted_exchange_check"}, key) {
				val, err := payloadBuildMsg.C2Profiles[index].GetBooleanArg(key)
				if err != nil {
					stringVal, err := payloadBuildMsg.C2Profiles[index].GetStringArg(key)
					if err != nil {
						payloadBuildResponse.Success = false
						payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
						return payloadBuildResponse
					}
					initialConfig[key] = stringVal == "T"
				} else {
					initialConfig[key] = val
				}
			} else if slices.Contains([]string{"callback_domains"}, key) {
				val, err := payloadBuildMsg.C2Profiles[index].GetArrayArg(key)
				if err != nil {
					payloadBuildResponse.Success = false
					payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
					return payloadBuildResponse
				}
				initialConfig[key] = val
			} else {
				val, err := payloadBuildMsg.C2Profiles[index].GetStringArg(key)
				if err != nil {
					payloadBuildResponse.Success = false
					payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
					return payloadBuildResponse
				}
				if key == "proxy_port" {
					if val == "" {
						initialConfig[key] = 0
					} else {
						intval, err := strconv.Atoi(val)
						if err != nil {
							payloadBuildResponse.Success = false
							payloadBuildResponse.BuildStdErr = "Key error: " + key + "\n" + err.Error()
							return payloadBuildResponse
						}
						initialConfig[key] = intval
					}
				} else {
					initialConfig[key] = val
				}

			}
		}
		initialConfigBytes, err := json.Marshal(initialConfig)
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildStdErr = err.Error()
			return payloadBuildResponse
		}
		initialConfigBase64 := base64.StdEncoding.EncodeToString(initialConfigBytes)
		payloadBuildResponse.BuildStdOut += fmt.Sprintf("%s's config: \n%v\n", payloadBuildMsg.C2Profiles[index].Name, string(initialConfigBytes))
		ldflags += fmt.Sprintf(" -X '%s.%s_%s=%v'", poseidon_repo_profile, payloadBuildMsg.C2Profiles[index].Name, "initial_config", initialConfigBase64)
	}

	proxyBypass, err := payloadBuildMsg.BuildParameters.GetBooleanArg("proxy_bypass")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	architecture, err := payloadBuildMsg.BuildParameters.GetStringArg("architecture")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	mode, err := payloadBuildMsg.BuildParameters.GetStringArg("mode")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	garble, err := payloadBuildMsg.BuildParameters.GetBooleanArg("garble")
	if err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildStdErr = err.Error()
		return payloadBuildResponse
	}
	ldflags += fmt.Sprintf(" -X '%s.proxy_bypass=%v'", poseidon_repo_profile, proxyBypass)
	ldflags += " -buildid="
	goarch := "amd64"
	if architecture == "ARM_x64" {
		goarch = "arm64"
	}
	tags := []string{}
	if static {
		tags = []string{"osusergo", "netgo"}
	}
	for index, _ := range payloadBuildMsg.C2Profiles {
		tags = append(tags, payloadBuildMsg.C2Profiles[index].Name)
	}
	if mode == "c-shared" {
		tags = append(tags, "shared")
	}
	command := fmt.Sprintf("CGO_ENABLED=1 GOOS=%s GOARCH=%s ", targetOs, goarch)
	goCmd := fmt.Sprintf("-tags %s -buildmode %s -ldflags \"%s\"", strings.Join(tags, ","), mode, ldflags)
	if targetOs == "darwin" {
		command += "CC=o64-clang CXX=o64-clang++ "
	} else if targetOs == "windows" {
		command += "CC=x86_64-w64-mingw32-gcc "
	} else {
		if goarch == "arm64" {
			command += "CC=aarch64-linux-gnu-gcc "
		} else {
			command += "CC=x86_64-linux-gnu-gcc "
		}
	}
	command += "GOGARBLE=* "
	if garble {
		command += "/go/bin/garble -tiny -literals -debug -seed random build "
	} else {
		command += "go build "
	}
	payloadName := fmt.Sprintf("%s-%s", payloadBuildMsg.PayloadUUID, targetOs)
	command += fmt.Sprintf("%s -o /build/%s", goCmd, payloadName)
	if targetOs == "darwin" {
		command += fmt.Sprintf("-%s", macOSVersion)
		payloadName += fmt.Sprintf("-%s", macOSVersion)
	}
	command += fmt.Sprintf("-%s", goarch)
	payloadName += fmt.Sprintf("-%s", goarch)
	if mode == "c-shared" {
		if targetOs == "windows" {
			command += ".dll"
			payloadName += ".dll"
		} else if targetOs == "darwin" {
			command += ".dylib"
			payloadName += ".dylib"
		} else {
			command += ".so"
			payloadName += ".so"
		}
	} else if mode == "c-archive" {
		command += ".a"
		payloadName += ".a"
	}

	mythicrpc.SendMythicRPCPayloadUpdateBuildStep(mythicrpc.MythicRPCPayloadUpdateBuildStepMessage{
		PayloadUUID: payloadBuildMsg.PayloadUUID,
		StepName:    "Configuring",
		StepSuccess: true,
		StepStdout:  fmt.Sprintf("Successfully configured\n%s", command),
	})
	if garble {
		mythicrpc.SendMythicRPCPayloadUpdateBuildStep(mythicrpc.MythicRPCPayloadUpdateBuildStepMessage{
			PayloadUUID: payloadBuildMsg.PayloadUUID,
			StepName:    "Garble",
			StepSuccess: true,
			StepStdout:  fmt.Sprintf("Successfully added in garble\n"),
		})
	} else {
		mythicrpc.SendMythicRPCPayloadUpdateBuildStep(mythicrpc.MythicRPCPayloadUpdateBuildStepMessage{
			PayloadUUID: payloadBuildMsg.PayloadUUID,
			StepName:    "Garble",
			StepSkip:    true,
			StepStdout:  fmt.Sprintf("Skipped Garble\n"),
		})
	}
	cmd := exec.Command("/bin/bash")
	cmd.Stdin = strings.NewReader(command)
	cmd.Dir = "./poseidon/agent_code/"
	var stdout bytes.Buffer
	var stderr bytes.Buffer
	cmd.Stdout = &stdout
	cmd.Stderr = &stderr
	if err := cmd.Run(); err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildMessage = "Compilation failed with errors"
		payloadBuildResponse.BuildStdErr += stderr.String() + "\n" + err.Error()
		payloadBuildResponse.BuildStdOut += stdout.String()
		mythicrpc.SendMythicRPCPayloadUpdateBuildStep(mythicrpc.MythicRPCPayloadUpdateBuildStepMessage{
			PayloadUUID: payloadBuildMsg.PayloadUUID,
			StepName:    "Compiling",
			StepSuccess: false,
			StepStdout:  fmt.Sprintf("failed to compile\n%s\n%s\n%s", stderr.String(), stdout.String(), err.Error()),
		})
		return payloadBuildResponse
	} else {
		outputString := stdout.String()
		if !garble {
			// only adding stderr if garble is false, otherwise it's too much data
			outputString += "\n" + stderr.String()
		}

		mythicrpc.SendMythicRPCPayloadUpdateBuildStep(mythicrpc.MythicRPCPayloadUpdateBuildStepMessage{
			PayloadUUID: payloadBuildMsg.PayloadUUID,
			StepName:    "Compiling",
			StepSuccess: true,
			StepStdout:  fmt.Sprintf("Successfully executed\n%s", outputString),
		})
	}
	if !garble {
		payloadBuildResponse.BuildStdErr = stderr.String()
	}
	payloadBuildResponse.BuildStdOut += stdout.String()

	if payloadBytes, err := os.ReadFile(fmt.Sprintf("/build/%s", payloadName)); err != nil {
		payloadBuildResponse.Success = false
		payloadBuildResponse.BuildMessage = "Failed to find final payload"
	} else if mode == "c-archive" && targetOs == "darwin" {
		zipUUID := uuid.New().String()
		archive, err := os.Create(fmt.Sprintf("/build/%s", zipUUID))
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to make temp archive on disk"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			return payloadBuildResponse
		}
		zipWriter := zip.NewWriter(archive)
		fileWriter, err := zipWriter.Create("poseidon-darwin-10.12-amd64.a")
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to save payload to zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			archive.Close()
			return payloadBuildResponse
		}
		_, err = io.Copy(fileWriter, bytes.NewReader(payloadBytes))
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to write payload to zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			archive.Close()
			return payloadBuildResponse
		}
		headerName := fmt.Sprintf("%s.h", payloadName[:len(payloadName)-2])
		headerWriter, err := zipWriter.Create("poseidon-darwin-10.12-amd64.h")
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to save header to zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			archive.Close()
			return payloadBuildResponse
		}
		headerFile, err := os.Open(fmt.Sprintf("/build/%s", headerName))
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to open header to zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			archive.Close()
			return payloadBuildResponse
		}
		_, err = io.Copy(headerWriter, headerFile)
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to write header to zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			archive.Close()
			return payloadBuildResponse
		}
		sharedWriter, err := zipWriter.Create("sharedlib-darwin-linux.c")
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to save payload to zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			archive.Close()
			return payloadBuildResponse
		}
		sharedLib, err := os.Open("./poseidon/agent_code/sharedlib/sharedlib-darwin-linux.c")
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to save sharedlib to zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			archive.Close()
			return payloadBuildResponse
		}
		_, err = io.Copy(sharedWriter, sharedLib)
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to write sharedlib to zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			archive.Close()
			return payloadBuildResponse
		}
		zipWriter.Close()
		archive.Close()
		archiveBytes, err := os.ReadFile(fmt.Sprintf("/build/%s", zipUUID))
		if err != nil {
			payloadBuildResponse.Success = false
			payloadBuildResponse.BuildMessage = "Failed to read final zip"
			payloadBuildResponse.BuildStdErr += fmt.Sprintf("\n%v\n", err)
			return payloadBuildResponse
		}
		payloadBuildResponse.Payload = &archiveBytes
		payloadBuildResponse.Success = true
		payloadBuildResponse.BuildMessage = "Successfully built payload!"
		if !strings.HasSuffix(payloadBuildMsg.Filename, ".zip") {
			updatedFilename := fmt.Sprintf("%s.zip", payloadBuildMsg.Filename)
			payloadBuildResponse.UpdatedFilename = &updatedFilename
		}
	} else {
		payloadBuildResponse.Payload = &payloadBytes
		payloadBuildResponse.Success = true
		payloadBuildResponse.BuildMessage = "Successfully built payload!"
	}

	//payloadBuildResponse.Status = agentstructs.PAYLOAD_BUILD_STATUS_ERROR
	return payloadBuildResponse
}

// dummy example function for executing something on a new poseidon callback
func onNewCallback(data agentstructs.PTOnNewCallbackAllData) agentstructs.PTOnNewCallbackResponse {
	return agentstructs.PTOnNewCallbackResponse{
		AgentCallbackID: data.Callback.AgentCallbackID,
		Success:         true,
		Error:           "",
	}
}
func Initialize() {
	agentstructs.AllPayloadData.Get("poseidon").AddPayloadDefinition(payloadDefinition)
	agentstructs.AllPayloadData.Get("poseidon").AddBuildFunction(build)
	//agentstructs.AllPayloadData.Get("poseidon").AddOnNewCallbackFunction(onNewCallback)
	agentstructs.AllPayloadData.Get("poseidon").AddIcon(filepath.Join(".", "poseidon", "agentfunctions", "poseidon.svg"))
}

Depending on the status of your build (success or error), either the message or build_stderr values will be presented to the user via the UI notifications. However, at any time you can go back to the Created Payloads page and view the build message, build errors, and build stdout for any payload.

When building your payload, if you have to modify files on disk, then it's helpful to do this in a "copy" of the files. You can make a temporary copy of your code and operate there with the following sample:

agent_build_path = tempfile.TemporaryDirectory(suffix=self.uuid)
# shutil to copy payload files over
copy_tree(self.agent_code_path, agent_build_path.name)
# now agent_build_path.name maps to the root folder for your agent code

3.1 Build Steps

The last thing to mention are build steps. These are defined as part of the agent and are simply descriptions of what is happening during your build process. The above example makes some RPC calls for SendMythicRPCPayloadUpdatebuildStep to update the build steps back to Mythic while the build process is happening. For something as fast as the apfell agent, it'll appear as though all of these happen at the same time. For something that's more computationally intensive though, it's helpful to provide information back to the user about what's going on - stamping in values? obfuscating? compiling? more obfuscation? opsec checks? etc. Whatever it is that's going on, you can provide this data back to the operator complete with stdout and stderr.

3.2 Execution flow

So, what's the actual, end-to-end execution flow that goes on? A diagram can be found here: #what-happens-for-building-payloads.

1. PayloadType container is started, it connects to Mythic and sends over its data (by parsing all these python files or GoLang structs)

2. An operator wants to create a payload from it, so they click the hazard icon at the top of Mythic, click the "Actions" dropdown and select "Generate New Payload".

3. The operator selects an OS type that the agent supports (ex. Linux, macOS, Windows)

4. The operator selects the payload type they want to build (this one)

   1. edits all build parameters as needed

5. The operator selects all commands they want included in the payload

6. The operator selects all c2 profiles they want included

   1. and for each c2 selected, provides any c2 required parameters

7. Mythic takes all of this information and sends it to the payload type container

8. The container sends the BuildResponse message back to the Mythic server.

4.0 On New Callback

Starting with Mythic v3.2.12, PyPi version 0.4.1, and MythicContainer version 1.3.1, there's a new function you can define as part of your Payload Type definition. In addition to defining a build process, you can also define a on_new_callback (or onNewCallbackFunction) function that will get executed whenever there's a new callback based on this payload type.

Below are examples in Python and in Golang for how to define and leverage this new functionality. One of the great things about this is that you can use this to automatically issue tasking for new callbacks. The below examples will automatically issue a shell command with parameters of whoami.

These function calls get almost all the same data that you'll see in your Create Tasking calls, except they're missing information about a Task. That's simply because there's no task yet, this is the moment that a new callback is created.

Mythic tracks an operator for all issued tasking. Since there's no operator directly typing out and issuing these tasks, Mythic associates the operator that built the payload with any tasks automatically created in this function.

Python

class Apfell(PayloadType):
    name = "apfell"
    ...
    async def build ...
    
    async def on_new_callback(self, newCallback: PTOnNewCallbackAllData) -> PTOnNewCallbackResponse:
            new_task_resp = await SendMythicRPCTaskCreate(MythicRPCTaskCreateMessage(
                AgentCallbackUUID=newCallback.Callback.AgentCallbackID,
                CommandName="shell",
                Params="whoami",
            ))
            if new_task_resp.Success:
                return PTOnNewCallbackResponse(AgentCallbackUUID=newCallback.Callback.AgentCallbackID, Success=True)
            return PTOnNewCallbackResponse(AgentCallbackUUID=newCallback.Callback.AgentCallbackID, Success=False,
                                           Error=new_task_resp.Error)

Golang

func onNewBuild(data agentstructs.PTOnNewCallbackAllData) agentstructs.PTOnNewCallbackResponse {
	newTasking, err := mythicrpc.SendMythicRPCTaskCreate(mythicrpc.MythicRPCTaskCreateMessage{
		AgentCallbackID: data.Callback.AgentCallbackID,
		CommandName:     "shell",
		Params:          "whoami",
	})
	if err != nil {
		logging.LogError(err, "failed to create new task")
	}
	if newTasking.Success {
		logging.LogInfo("created new task")
	} else {
		logging.LogError(err, "failed to create new tasking")
	}
	return agentstructs.PTOnNewCallbackResponse{
		AgentCallbackID: data.Callback.AgentCallbackID,
		Success:         true,
		Error:           "",
	}
}
func Initialize() {
	agentstructs.AllPayloadData.Get("poseidon").AddPayloadDefinition(payloadDefinition)
	agentstructs.AllPayloadData.Get("poseidon").AddBuildFunction(build)
	agentstructs.AllPayloadData.Get("poseidon").AddOnNewCallbackFunction(onNewBuild)
	agentstructs.AllPayloadData.Get("poseidon").AddIcon(filepath.Join(".", "poseidon", "agentfunctions", "poseidon.svg"))
}