$ show its-a-feature/Mythic
Mythic is a cross-platform, post-exploitation, red teaming command-and-control (C2) framework. It enables operators to manage remote agents (callbacks), generate payloads, issue tasks, exfiltrate files, harvest credentials, and automate workflows through an event-driven system. The architecture is a multi-container Docker deployment: a Go backend (using Gin, RabbitMQ, PostgreSQL, gRPC) handles agent communication, task orchestration, and data persistence; a React frontend (Material-UI, Apollo Client) provides a rich operator interface with real-time updates via GraphQL subscriptions (backed by Hasura); and a CLI tool (Mythic_CLI) manages container lifecycle, configuration, and service installation. Key entry points include the agent message webhook (HTTP POST/GET), web controllers for CRUD operations, and RabbitMQ RPC handlers for internal service communication. External dependencies include RabbitMQ, PostgreSQL, Hasura GraphQL engine, Docker, and gRPC. The system is designed for extensibility through payload type containers, C2 profiles, translation containers, and custom browser scripts.
The LLM identified 3 files worth highlighting for reuse:
A custom React grid component that supports resizable columns via drag handles, column autosize, sorting, filtering, and context menus. It is self-contained with its own styles and subcomponents (Cell, HeaderCell, DraggableHandles). Could be extracted and reused in any React project needing a flexible, interactive data grid.
A parser that reads YAML, TOML, or JSON event group definitions and validates triggers, actions, and dependencies. It supports cyclic dependency detection and action type validation. This is a standalone workflow definition parser that could be reused in other event-driven automation systems.
Implements AES-256-CBC encryption/decryption with HMAC-SHA256 authentication, including key derivation from a passphrase. The code is clean, well-commented, and uses standard Go crypto libraries. It is a self-contained cryptographic utility that could be extracted for any Go project requiring authenticated symmetric encryption.