Initial Access Payloads with Mystikal

Mystikal Setup

Mystikal only runs on macOS. If you don’t have a Mac, AWS has support for x64 and AMD64 macOS. Once this is ready, there are a few prerequirements:

1. Follow Mythic C2 Setup instructions.
2. Install XCode command line tools: xcode-select --install
3. Install Google Chrome
4. Clone the repo and cd into it: git clone https://github.com/D00MFist/Mystikal && cd Mystikal
5. Install the PIP requirements: sudo pip3 install -r requirements.txt
6. Edit Settings/MythicSettings.py with your Mythic server details.

Generate Payloads

Start the Mystikal CLI with python3 mystikal.py. Follow the menu options to generate the following payloads:

• Installer Package - 1>4>1
• Chrome Extension - 2
• VBA Word Macro - 4>1
• Disk Image - 6
• PDF - 7
• Python PIP Package - 8>1
• Ruby Gem - 9>2
• NodeJS NPM Package - 10

Host and Execute Payloads

Some of the payloads require more than a double-click to execute.

• Installer Package
  • Double-click the JSpackage.pkg file and click Allow.
• Chrome Extension
  • Local admin is required.
  • Only works on domain-joined hosts.
  • Must host manifest.xml and extension.crx after Mystikal generates them. Intended file URLs most be in MystikalSettings.py before generation.
  • Double-click the .mobileconfig file. Open Settings, go to Profiles, select the profile and click Install.
• VBA Word Macro
  • Create a new Word document. Copy the contents of macro.txt into the macro editor.
• Disk Image
  • More realistic with local admin, but not required.
  • Double-click the .dmg file.
    • If local admin, copy the file to Applications and then double-click it.
    • If not, double-click the file inside of the popup.
• PDF
  • Double-click the .pdf file.
• Python PIP Package
  • Open a terminal and cd to the directory with setup.cfg. Run pip3 install ..
• Ruby Gem
  • Open a terminal and cd to the directory with Gemfile. Run bundle install.
• NodeJS NPM Package
  • Open a terminal and cd to the directory with package.json. Run npm install.