d00mfist/mystikal

macOS Initial Access Payload Generator

Mystikal

macOS Initial Access Payload Generator

• Intended to be used with https://github.com/its-a-feature/Mythic

Related Blog Post:

• https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520

Usage:

1. Install Xcode on build machine (Required for Installer Package w/ Installer Plugin)
2. Install python requirements

sudo pip3 install -r requirements.txt

3. Change settings within the Settings/MythicSettings.py file to match your Mythic configs
4. Run mystikal

python3 mystikal.py

5. Select your desired payload from the options

 _______               __   __ __           __
|   |   |.--.--.-----.|  |_|__|  |--.---.-.|  |
|       ||  |  |__ --||   _|  |    <|  _  ||  |
|__|_|__||___  |_____||____|__|__|__|___._||__|
         |_____|
         
Mystikal: macOS Payload Generator
Main Choice: Choose 1 of 11 choices
Choose 1 for Installer Packages
Choose 2 for Mobile Configuration: Chrome Extension
Choose 3 for Mobile Configuration: Webloc File
Choose 4 for Office Macros: VBA
Choose 5 for Office Macros: XLM Macros in SYLK Files
Choose 6 for Disk Images
Choose 7 for Armed PDFs
Choose 8 for Armed Python PIP Packages
Choose 9 for Armed Ruby Gems
Choose 10 for Armed NodeJS NPM Packages
Choose 11 to exit

Note:

Option 1, Option 1.4, Option 4, Option 8, Option 9, and Option 11 have submenus shown below

Selected Installer Packages
SubMenu: Choose 1 of 5 choices
Choose 1 for Installer Package w/ only pre/postinstall scripts
Choose 2 for Installer Package w/ Launch Daemon for Persistence
Choose 3 for Installer Package w/ Installer Plugin
Choose 4 for Installer Package w/ JavaScript Functionality
Choose 5 for Installer Package w/ Dylib
Choose 6 to exit

Selected Installer Package w/ JavaScript Functionality
SubMenu Choice: Choose 1 of 3 choices
Choose 1 for Installer Package w/ JavaScript Functionality embedded
Choose 2 for Installer Package w/ JavaScript Functionality in Script
Choose 3 to exit

Selected Office Macros: VBA
SubMenu Choice: Choose 1 of 4 choices
Choose 1 for VBA Macros for Word
Choose 2 for VBA Macros for Excel
Choose 3 for VBA Macros for PowerPoint
Choose 4 to exit

Selected Armed Python PIP Package
SubMenu Choice: Choose 1 of 3 choices
Choose 1 for Armed Python PIP Packages w/ osascript execution
Choose 2 for Armed Python PIP Packages w/ dylib load
Choose 3 to exit

Selected Armed Ruby Gem
SubMenu Choice: Choose 1 of 3 choices
Choose 1 for Armed Ruby Gem w/ osascript execution
Choose 2 for Armed Ruby Gem w/ dylib load
Choose 3 to exit

Selected Tclsh
SubMenu Choice: Choose 1 of 3 choices
Choose 1 for Tclsh w/ local files
Choose 2 for Tclsh w/ hosted dylibs
Choose 3 to exit

Behavior Modifications:

To change the execution behavior (which binaries are called upon payload execution)

• Modifications will be required in either the specific payload file under the Modules folder or the related template file under the Templates folder.

Common Issues

Make sure mythic python package is on the latest version

pip3 uninstall -y mythic && pip3 install mythic

mystikal's Issues

how to send pdf to victim?

I haved generated the doomfist.pdf .app

but when i send it to other people. the app always get the error:
"Doomfist.pdf" is corrupted and cannot be opened. You should move it to the Trash.

i have tried via email or im such as wechat, but no one can run successfully

TypeError: __init__() got an unexpected keyword argument 'selected_os'

Please make a choice: 4
Selected Office Macros: VBA
SubMenu Choice: Choose 1 of 4 choices
Choose 1 for VBA Macros for Word
Choose 2 for VBA Macros for Excel
Choose 3 for VBA Macros for PowerPoint
Choose 4 to exit
Please make a choice: 1
[+] Logging into Mythic
Traceback (most recent call last):
File "mystikal.py", line 161, in
main()
File "mystikal.py", line 73, in main
office_macros_menu()
File "mystikal.py", line 136, in office_macros_menu
macro_word()
File "/Users/ccccc/Downloads/Mystikal/Modules/Macro_Word.py", line 104, in macro_word
loop.run_until_complete(main())
File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/asyncio/base_events.py", line 616, in run_until_complete
return future.result()
File "/Users/cccc/Downloads/Mystikal/Modules/Macro_Word.py", line 86, in main
await scripting()
File "/Users/ccc/Downloads/Mystikal/Modules/Macro_Word.py", line 30, in scripting
p = mythic_rest.Payload(
TypeError: init() got an unexpected keyword argument 'selected_os'

got unexpected keyword argument 'mythic_encrypts'

Hey, I'm getting the following error when trying to create an Armed PDF in Mystikal

 _______               __   __ __           __
|   |   |.--.--.-----.|  |_|__|  |--.---.-.|  |
|       ||  |  |__ --||   _|  |    <|  _  ||  |
|__|_|__||___  |_____||____|__|__|__|___._||__|
         |_____|

Mystikal: macOS Initial Access Payload Generator
Main Choice: Choose 1 of 8 choices
Choose 1 for Installer Packages
Choose 2 for Mobile Configuration: Chrome Extension
Choose 3 for Mobile Configuration: Webloc File
Choose 4 for Office Macros: VBA
Choose 5 for Office Macros: XLM Macros in SYLK Files
Choose 6 for Disk Images
Choose 7 for Armed PDFs
Choose 8 to exit
Please make a choice: 7
Selected Armed PDF
!!! This module currently downloads a pdf to modify as a default example
[+] Copied Template Folder to './Payloads/PDF_Payload'
[+] Logging into Mythic
[+] Creating new apfell payload
Traceback (most recent call last):
  File "mystikal.py", line 141, in <module>
    main()
  File "mystikal.py", line 48, in main
    pdf()
  File "/Users/rt/Downloads/Mystikal/Modules/PDF.py", line 103, in pdf
    loop.run_until_complete(main())
  File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.8/lib/python3.8/asyncio/base_events.py", line 616, in run_until_complete
    return future.result()
  File "/Users/rt/Downloads/Mystikal/Modules/PDF.py", line 85, in main
    await scripting()
  File "/Users/rt/Downloads/Mystikal/Modules/PDF.py", line 56, in scripting
    resp = await mythic.create_payload(p, all_commands=True, wait_for_build=True)
  File "/Users/rt/Downloads/Mystikal/mythic.py", line 4026, in create_payload
    resp = await self.get_payloadtypes()
  File "/Users/rt/Downloads/Mystikal/mythic.py", line 4132, in get_payloadtypes
    tmp.append(PayloadType(**x))
TypeError: __init__() got an unexpected keyword argument 'mythic_encrypts'

Mythic Version: Current main branch (2.2)
Mystikal Version: Current main branch

Any idea why I might be getting this error? pip says all requirements are satisfied and as far as I can see all the settings in MythicSettings.py are correct.

Undefined name 'payload'

Helo, I found: mythic.py:2279:50: F821 undefined name 'payload'