DOCSEARCHbyAlgolia
Submit Docs

Thanatos C2 Agent Documentation

repository·main·Indexed 19 days ago

https://github.com/mythicagents/thanatos

Thanatos is a Rust-based Command and Control (C2) agent for Windows and Linux that integrates with the Mythic C2 framework. It supports multiple output formats including PE, DLL, shellcode, and ELF. Key features include a built-in SSH client, SSH agent hijacking, TCP redirectors, port scanning, and configurable working hours. Currently, it supports the HTTP C2 profile with options for AES encryption and key exchange.

Tokens
20.1K
Snippets
68
Records
114
Agent score
62%

What's inside Thanatos

  1. Overview of Thanatos C2 Agent

    main

    Thanatos is a general-purpose Mythic C2 agent designed for both Windows and Linux targets. It is written in Rust and can be compiled into various formats including executables, shared libraries, and Windows shellcode.

    Key capabilities include:

    • Port scanning and TCP redirection
    • SSH agent hijacking and a built-in SSH client
    • File transfers via scp
    • Directory listings via browser scripts (including SSH)
    • Ability to spawn commands in separate threads
    • Configurable working hours and checkin retry logic

  3. Configure Checkin Retries and Backoff Logic

    main

    Thanatos allows you to configure the number of check-in attempts. If a check-in fails, the agent uses an increasing interval for subsequent attempts.

    Backoff Behavior: The agent doubles the configured sleep interval after each failed check-in attempt. Once a successful check-in occurs, the sleep interval reverts to the original configured value.

  4. OPSEC considerations for ssh-rm

    main

    When using ssh -rm, be aware of the following operational security implications:

    • SSH Connections: The agent will establish an SSH connection to the target system.
    • Logging: The command logs into the target system using SSH. By default, OpenSSH servers log these connections, which may be visible to defenders.
    • Shell Activity: Thanatos will not spawn any shell commands for the SSH connection itself.

  5. OPSEC considerations for ssh-download

    main

    When using the ssh-download command, be aware of the following operational security implications:

    • Network Activity: The agent will establish an SSH connection to the target system.
    • Host Artifacts: The command will not produce any artifacts on the host system (files are transferred in memory).
    • Egress Profile: Egress file chunk size is 512KB.
    • Logging: The target system's OpenSSH server will log the connection by default.
    • Authentication Note: Key-based authentication from memory only works when the SSH agent is running on a Linux host.

  6. OPSEC and technical notes for ssh-cat

    main

    When using ssh-cat, be aware of the following operational and technical constraints:

    Technical Notes

    • SSH Agent: Key-based authentication via an SSH agent only works when the agent is running on a Linux host.
    • Execution: The command will not spawn any shell commands to establish the SSH connection.

    OPSEC Considerations

    • The agent will establish an active SSH connection to the target system.
    • The agent will log into the target system using SSH; by default, OpenSSH servers log these connections.

  8. Use the built-in SSH client in Thanatos

    main

    Thanatos includes a built-in SSH client that allows the agent to establish remote connections without spawning external processes on the host system. This means the agent does not require a system-installed SSH client to function.

    Supported authentication mechanisms include:

    • SSH keys
    • Username/password combinations
    • Interaction with running SSH agents (see the ssh-agent command documentation for details).

  10. Use the ssh-agent command to manage SSH identities

    main

    The ssh-agent command allows you to connect to running SSH agents to use their identities for authentication, list existing identities, or disconnect from a currently connected agent.

    Once connected, you can leverage these identities in other Thanatos commands like ssh or ssh-spawn by setting the use ssh agent option to true in their respective task parameters.

    # List identities
ssh-agent -l

# Connect to a specific agent socket
ssh-agent -c /tmp/ssh-XXXXXXbIjCH9/agent.14

# Disconnect from the current agent
ssh-agent -d

  11. Run shell commands via ssh-exec

    main

    The ssh-exec command allows you to execute a shell command on a target system using SSH. Parameters are configured through the Mythic UI using the Execute parameter group.

    Parameters

    ParameterDescription
    credentialsSelect credentials from the Mythic credentials database. The Account Name is used as the username. For plaintext types, the password is used; for key types, the SSH private key is used.
    use ssh agentIf enabled, Thanatos uses a connected SSH agent for authentication. It will use the username from the credentials parameter but relies on the agent for the rest of the authentication.
    hostThe hostname or IP address of the target machine.
    portThe port for the SSH connection.
    execThe specific shell command to execute on the target.

    Important Notes

    • SSH Agent Limitation: Key-based authentication from memory only works when the SSH agent is running on a Linux host.
    • OPSEC: This command logs into a target system and spawns a process. By default, OpenSSH servers will log these connections.
    ssh -exec

  12. Use the ssh-download command

    main

    The ssh-download command allows you to download a file from a remote system using scp and upload it directly to Mythic. This process occurs in memory; the file being downloaded never touches the host's disk during transfer, and the command does not spawn any shell commands for the SSH connection.

    To use this command, enter parameters through the Mythic UI using the Download parameter group.

    Parameters

    • credentials: Select credentials from the Mythic credentials database.
      • plaintext credential types use the plain text password.
      • key credential types use the plain text SSH private key.
      • The Account Name from the credentials is used as the username.
    • use ssh agent: A boolean option to use a connected SSH agent for authentication. If enabled, Thanatos uses the supplied username but relies on the agent for the remaining authentication fields.
    • host: The hostname or IP address of the remote machine.
    • port: The SSH connection port.
    • download path: The absolute path of the file on the remote system.

    Browser Script Integration

    You can issue ssh -download tasks directly from the browser script provided by the ssh -ls command. In the ACTIONS menu next to a file, click the Download button.

    ssh -download