Dark Agent

A production-ready Linux/macOS C2 agent written in Crystal for Mythic framework. Features static OpenSSL linking, comprehensive BOF support, and extensive built-in Unix commands.

Overview

Dark Agent is a fully-featured Mythic C2 Agent for Linux and macOS environments. Built in Crystal with statically-linked OpenSSL, it provides comprehensive post-exploitation capabilities through COFF/BOF loading, extensive system commands, SOCKS proxy support, and flexible communication profiles.

Platform Support

Linux builds have OpenSSL statically linked with no libssl dependency on the target. macOS binaries are cross-compiled on Linux via Zig and ad-hoc signed with rcodesign (SHA-256 CodeDirectory hashes required by macOS 14+).

Mythic Configuration

Agent Configuration

• Agent Name: dark
• Supported OS: Linux, macOS
• File Extension: bin
• C2 Profiles: HTTP, HTTPX (malleable)

Build Parameters:

• debug_mode: Boolean (default: false) - Enable debug logging and verbose output
• debug_socks: Boolean (default: false) - Enable SOCKS proxy debug logging
• encryption: Boolean (default: true) - Enable AES-256-CBC encryption for C2 traffic
• disable_ssl_verify: Boolean (default: false) - Skip SSL certificate verification
• symmetric_jitter: Boolean (default: false) - Use symmetric jitter (sleep_time ± jitter%) for better OPSEC
• realtime: Boolean (default: false) - Immediately send command responses without waiting for sleep interval
• chunk_size: Number (default: 512) - Size of file transfer chunks in KB, affects upload/download performance

Available Commands: Extensive built-in commands including system utilities, file operations, network tools, and agent management

OPSEC Checks: Dark Agent includes built-in operational security checks for high-risk commands:

• shell - All shell commands require approval from another operator
• sleep - Sleep intervals < 10 seconds require operator approval (special warning for sleep 0)
• kill - All process termination requires operator approval

C2 Profile Types

HTTP Profile

The standard HTTP profile is a simpler implementation that uses regular HTTP requests. It's easier to configure but offers less customization options.

HTTPX Profile (Malleable C2)

The HTTPX profile is a more advanced implementation that supports malleable C2 profiles with extensive customization options:

• Multiple Domains Support: Configure multiple callback domains with rotation strategies
• Domain Rotation Strategies:
  • round-robin: Rotates through domains for each request
  • fail-over: Switches to next domain after consecutive failures
• Traffic Transforms: Apply custom transformations to C2 traffic:
  • Base64/Base64URL encoding
  • XOR encryption
  • Prepend/append custom data
• Message Placement Options: Place C2 messages in:
  • HTTP headers
  • URL parameters
  • Cookies
  • Request body
• Custom Headers: Define custom HTTP headers for C2 requests

Installation

1. Copy the this entire repository to your Mythic C2 Server
2. Use mythic-cli to install the folder. ./mythic-cli install folder /path/to/dark-agent

Supported Commands

Dark Agent implements commands across two categories: Built-in Commands (native Crystal implementations) and BOF-based Commands (C object files loaded at runtime).

Each command (like hostname and ifconfig) is implemented using a BOF file. When you use the command:

1. The command uses bof_execute to run the associated BOF
2. If the BOF hasn't been loaded yet, you must first use load [command] to load it
3. For example: load hostname followed by hostname

Creating Custom BOFs

Writing a BOF is straightforward. Include beacon.h and implement coffee(). The framework handles loading, execution, and sending output back to the operator.

Minimal Example

#include "../includes/beacon.h"
#include <sys/stat.h>
#include <errno.h>

void coffee(int argc, char **argv) {
    if (argc < 1) { BeaconPrintf("Usage: example <path>"); return; }

    const char *path = argv[0];
    struct stat st;

    // Simple status message
    BeaconPrintf("checking path: %s", path);

    if (stat(path, &st) != 0) {
        BeaconPrintf("error: %s", strerror(errno));
        return;
    }

    // JSON output for browser script rendering
    bof_result_t *r = bof_result_create(512);
    bof_result_append(r, "{");
    bof_field_str(r, "path",  path);
    bof_field_ull(r, "size",  (unsigned long long)st.st_size);
    bof_field_uint(r, "mode", (unsigned int)st.st_mode);
    bof_result_trim(r);
    bof_result_append(r, "}");
    bof_result_send(r);
    bof_result_destroy(r);
}

Compile it, drop the .o into the payload, load it in Mythic. Done.

Output API

BeaconOutput and BeaconPrintf are the most common ways to write data from a BOF. The bof_result_t JSON builder is primarily useful when pairing with a Mythic browser script for structured UI rendering.

bof_result_t *r = bof_result_create(4096);
bof_result_append(r, "{\"entries\":[{");
bof_field_str(r,  "name",  proc_name);
bof_field_int(r,  "pid",   pid);
bof_field_ull(r,  "size",  file_size);
bof_field_hex(r,  "flags", flags);
bof_result_trim(r);
bof_result_append(r, "}]}");
bof_result_send(r);
bof_result_destroy(r);
// → {"entries":[{"name":"ls","pid":1234,"size":102400,"flags":"0x405"}]}

Arguments

BOFs receive (int argc, char **argv). Mythic passes arguments two ways:

Split Arguments (bof_args)

Space-separated → individual argv entries:

• "192.168.1.1 22,80,443" → argv[0]="192.168.1.1", argv[1]="22,80,443"
• Best for BOFs with structured parameters (paths, modes, hosts)
• Example: portscan 192.168.1.1 22,80,443

Single String (bof_args_str)

Full string → argv[0]:

• "ls -latr /tmp" → argv[0]="ls -latr /tmp"
• Best for BOFs that pass a command through as-is
• Example: shell ls -latr /tmp

Building

# Linux
gcc -fPIC -c your_bof.c -o your_bof.o -I src/bofs/includes

# Build all BOFs (runs inside the Mythic build container)
./build.sh -b    # Linux
./build.sh -B    # macOS (aarch64, requires Zig + macOS SDK)

Usage

Running the Agent

# Run the debug version
./output/dark-agent-debug

# Run the release version
./output/dark-agent

Direct Mode

Dark Agent can be built in "direct mode", which creates a standalone COFF loader without any Mythic C2 functionality. This is useful for testing BOFs without needing a full Mythic server.

In direct mode, the agent:

1. Loads the specified COFF file
2. Executes the coffee() function from the BOF
3. Passes any additional command-line arguments to the BOF
4. Displays any output produced by the BOF

This mode is ideal for BOF development and testing before deploying to a full Mythic environment.

Example usage:

# Build direct mode version
./build.sh -D

# Have a cup of COFFee
./output/dark-agent-direct output/bofs/coffee.o