Skip to main content

​
What is it?

Command and Control (C2) profiles are the way an agent actually communicates with Mythic to get tasking and post responses. There are two main pieces for every C2 profile:
  1. Server code - code that runs in a docker container to convert the C2 profile communication specification (twitter, slack, dropbox, websocket, etc) into the corresponding REST endpoints that Mythic uses
  2. Agent code - the code that runs in a callback to implement the C2 profile on the target machine.

​
Where is it?

C2 profiles can be found by going to Installed Services (headphone icon) from the left navigational bar.

​
How do they work?

Each C2 profile is in its own docker container, the status of which is indicated on the C2 Profiles tab. Each docker container has a python or golang service running in it that connects to a RabbitMQ message broker to receive tasking. This allows Mythic to modify files, execute programs, and more within other docker containers. Mythic 4.0 container messages carry authenticated context. Update C2 profiles to a compatible container library and preserve that context in any hand-written RabbitMQ forwarding. See Container RPC Authentication.

​
Parameters and hosted files

C2 parameters can provide display names, labeled static choices, groups and UI ordering, expanded hide conditions, service-backed dynamic choices, and schema-driven JSONString values. Dynamic queries receive the other parameter values already selected, so one field can condition its choices on another. See C2 Parameters. V4 also tracks files hosted by a C2 profile. Hosting records expose state and output and can be updated, retried, stopped, or removed from Mythic.

​
Where can I find more documentation about them?

The documentation container contains detailed information about the OPSEC considerations, traffic flow, and more for each container when you install the c2 profile. From the C2 Profiles tab, you can click the document icon to automatically open up the local documentation website to that profile.