refactor(payload): rename apollo to ares and update documentation

This commit renames the Apollo payload type to Ares, moving all associated files and updating documentation accordingly. The change includes:
- Renaming directories from `apollo` to `ares`
- Updating documentation image references
- Maintaining the same code functionality while changing the payload name
- Adding new Ares-specific documentation files
- Removing old Apollo documentation files

The rename is done to reflect the new payload name while preserving all existing functionality.

documentation-payload/ares/commands/_index.md

@@ -0,0 +1,84 @@
++++
+title = "Commands"
+chapter = true
+weight = 15
+pre = "<b>2. </b>"
++++
+
+![logo](/agents/apollo/XF-09_Ares.png?width=600px)
+
+## Table of Contents
+
+- Lateral Movement
+    * [link](/agents/apollo/commands/link/)
+    * [unlink](/agents/apollo/commands/unlink/)
+- Credential/Token Commands
+    * [whoami](/agents/apollo/commands/whoami/)
+    * [rev2self](/agents/apollo/commands/rev2self/)
+    * [getprivs](/agents/apollo/commands/getprivs/)
+    * [make_token](/agents/apollo/commands/make_token/)
+    * [steal_token](/agents/apollo/commands/steal_token/)
+    * [mimikatz](/agents/apollo/commands/mimikatz/)
+    * [pth](/agents/apollo/commands/pth/)
+    * [dcsync](/agents/apollo/commands/dcsync/)
+- User Exploitation
+    * [keylog_inject](/agents/apollo/commands/keylog_inject/)
+    * [screenshot_inject](/agents/apollo/commands/screenshot_inject/)
+    * [screenshot](/agents/apollo/commands/screenshot/)
+- .NET Assembly Commands
+    * [inline_assembly](/agents/apollo/commands/inline_assembly/)
+    * [execute_assembly](/agents/apollo/commands/execute_assembly/)
+    * [assembly_inject](/agents/apollo/commands/assembly_inject/)
+    * [register_assembly](/agents/apollo/commands/register_assembly/)
+- PowerShell Commands
+    * [powershell](/agents/apollo/commands/powershell/)
+    * [psinject](/agents/apollo/commands/psinject/)
+    * [powerpick](/agents/apollo/commands/powerpick/)
+    * [powershell_import](/agents/apollo/commands/powershell_import/)
+- File Operations
+    * [upload](/agents/apollo/commands/upload/)
+    * [download](/agents/apollo/commands/download/)
+    * [rm](/agents/apollo/commands/rm/)
+    * [mkdir](/agents/apollo/commands/mkdir/)
+    * [cp](/agents/apollo/commands/cp/)
+    * [cat](/agents/apollo/commands/cat/)
+    * [mv](/agents/apollo/commands/mv/)
+    * [ls](/agents/apollo/commands/ls/)
+    * [pwd](/agents/apollo/commands/pwd/)
+    * [cd](/agents/apollo/commands/cd/)
+- Job Management
+    * [jobs](/agents/apollo/commands/jobs/)
+    * [jobkill](/agents/apollo/commands/jobkill/)
+- Net Enumeration
+    * [net_dclist](/agents/apollo/commands/net_dclist/)
+    * [net_localgroup_member](/agents/apollo/commands/net_localgroup_member/)
+    * [net_localgroup](/agents/apollo/commands/net_localgroup/)
+    * [net_shares](/agents/apollo/commands/net_shares/)
+- Process Management
+    * [shell](/agents/apollo/commands/shell/)
+    * [run](/agents/apollo/commands/run/)
+    * [kill](/agents/apollo/commands/kill/)
+    * [ps](/agents/apollo/commands/ps/)
+- Registry Management
+    * [reg_query](/agents/apollo/commands/reg_query/)
+    * [reg_write_value](/agents/apollo/commands/reg_write_value/)
+- Evasion Management
+    * [blockdlls](/agents/apollo/commands/blockdlls)
+    * [ppid](/agents/apollo/commands/ppid)
+    * [spawnto_x64](/agents/apollo/commands/spawnto_x64/)
+    * [spawnto_x86](/agents/apollo/commands/spawnto_x86/)
+    * [get_injection_techniques](/agents/apollo/commands/get_injection_techniques/)
+    * [set_injection_technique](/agents/apollo/commands/set_injection_technique/)
+- Session Management
+    * [spawn](/agents/apollo/commands/spawn/)
+    * [inject](/agents/apollo/commands/inject/)
+    * [exit](/agents/apollo/commands/exit/)
+    * [sleep](/agents/apollo/commands/sleep/)
+- Host Enumeration
+    * [ifconfig](/agents/apollo/commands/ifconfig)
+    * [netstat](/agents/apollo/commands/netstat)
+- Miscellaneous
+    * [printspoofer](/agents/apollo/commands/printspoofer/)
+    * [shinject](/agents/apollo/commands/shinject/)
+    * [socks](/agents/apollo/commands/socks/)
+    * [execute_pe](/agents/apollo/commands/execute_pe/)

documentation-payload/ares/commands/assembly_inject.md

@@ -0,0 +1,40 @@
++++
+title = "assembly_inject"
+chapter = false
+weight = 103
+hidden = false
++++
+
+{{% notice info %}}
+Artifacts Generated: Process Inject
+{{% /notice %}}
+
+## Summary
+
+Inject the .NET assembly loader into a remote process and execute an assembly registered with `register_file`. This assembly is injected into the remote process using the injection technique currently specified by `get_injection_techniques`.
+
+### Arguments (Positional or Popup)
+
+![args](../images/assembly_inject.png)
+
+#### Arguments
+Any arguments to be executed with the assembly.
+
+#### Assembly
+Name used when registering assembly with the `register_file` command (e.g., `Seatbelt.exe`)
+
+#### PID
+Process ID to inject into.
+
+## Usage
+```
+assembly_inject -PID 7344 -Assembly Seatbelt.exe -Arguments DotNet
+```
+
+Example
+
+![ex](../images/assembly_inject_resp.png)
+
+## MITRE ATT&CK Mapping
+
+- T1055

documentation-payload/ares/commands/blockdlls.md

@@ -0,0 +1,15 @@
++++
+title = "blockdlls"
+chapter = false
+weight = 103
+hidden = false
++++
+
+## Summary
+Prevent non-Microsoft signed DLLs from loading into post-exploitation jobs.
+
+## Usage
+```
+blockdlls
+blockdlls -EnableBlock [true|false]
+```

documentation-payload/ares/commands/cat.md

@@ -0,0 +1,34 @@
++++
+title = "cat"
+chapter = false
+weight = 103
+hidden = false
++++
+
+{{% notice info %}}
+Artifacts Generated: File Open
+{{% /notice %}}
+
+## Summary
+
+Read the contents of a file 256kb at a time.
+
+### Arguments
+![args](../images/cat.png)
+#### Path
+Specify path to file to read contents
+
+## Usage
+```
+cat -Path [path]
+```
+Example
+```
+cat -Path C:\config.txt
+cat C:\config.txt
+```
+
+## MITRE ATT&CK Mapping
+
+- T1081
+- T1106

documentation-payload/ares/commands/cd.md

@@ -0,0 +1,42 @@
++++
+title = "cd"
+chapter = false
+weight = 103
+hidden = false
++++
+
+## Summary
+Change the process's current working directory to a specified directory. This command accepts relative paths such as `..\` as well.
+
+## Arguments
+
+![args](../images/cd.png)
+
+### Path
+Change to the directory specified by path.
+
+## Usage
+```
+cd -Path [path]
+cd [path]
+```
+Example
+```
+cd -Path C:\Users
+```
+Change to the root directory.
+```
+cd C:\
+```
+Change to the previous level directory.
+```
+cd ..
+```
+Change to a directory with spaces in name.
+```
+cd C:\Program Files
+```
+
+## MITRE ATT&CK Mapping
+
+- T1083

documentation-payload/ares/commands/cp.md

@@ -0,0 +1,38 @@
++++
+title = "cp"
+chapter = false
+weight = 103
+hidden = false
++++
+
+{{% notice info %}}
+### Artifacts
+- File Open
+- File Write
+{{% /notice %}}
+
+## Summary
+Copy a specified file to another location.
+
+### Arguments
+
+![args](../images/cp.png)
+
+#### Path
+The path to the original file that will be copied and placed in the location specified by `Destination`.
+
+#### Destination
+The path to copy a file too.
+
+## Usage
+```
+cp -Path [source] -Destination [destination]
+```
+Example
+```
+cp -Path test1.txt -Destination "C:\Program Files\test2.txt"
+```
+
+## MITRE ATT&CK Mapping
+
+- T1570

documentation-payload/ares/commands/dcsync.md

@@ -0,0 +1,42 @@
++++
+title = "dcsync"
+chapter = false
+weight = 103
+hidden = false
++++
+
+{{% notice info %}}
+Artifacts Generated: Process Create, Process Inject, Process Kill
+{{% /notice %}}
+
+## Summary
+Use mimikatz's `lsadump::dcsync` module to retrieve a user's kerberos keys from a Domain Controller.
+
+### Arguments
+#### Domain
+Domain to query information from.
+
+#### User (Optional)
+Username to sync kerberos keys for. Default is all users.
+
+#### DC (Optional)
+Domain controller to sync credential material from.
+
+## Usage
+```
+dcsync -Domain domain.local [-User username -DC dc.domain.local]
+```
+
+Example
+```
+dcsync -Domain contoso.local -User djhohnstein -DC 10.120.30.204
+dcsync -Domain contoso.local
+```
+
+
+## MITRE ATT&CK Mapping
+
+- T1003.006
+
+### Resrouces
+- [mimikatz](https://github.com/gentilkiwi/mimikatz)

documentation-payload/ares/commands/download.md

@@ -0,0 +1,46 @@
++++
+title = "download"
+chapter = false
+weight = 103
+hidden = false
++++
+
+{{% notice info %}}
+Artifacts Generated: File Open
+{{% /notice %}}
+
+## Summary
+Download a specified file from the agent's host to the Mythic server.
+
+### Arguments (Positional)
+#### Path
+
+Path to the file to download.
+
+#### Host (optional)
+
+Host to download the file from. Default: localhost.
+
+## Usage
+```
+download -Path [path to file] [-Host [127.0.0.1]]
+```
+Example
+```
+download -Path C:\Users\user\Downloads\test.txt
+
+download -Path C:\Users\user\Downloads\test.txt -Host 127.0.0.1
+
+From the file browser, Actions -> Task a Download
+```
+
+When the download completes, clicking the link will automatically download the file to your Downloads folder.
+
+![download2](../images/download02.png)
+
+
+## MITRE ATT&CK Mapping
+
+- T1020
+- T1030
+- T1041

documentation-payload/ares/commands/execute_assembly.md

@@ -0,0 +1,48 @@
++++
+title = "execute_assembly"
+chapter = false
+weight = 103
+hidden = false
++++
+
+{{% notice info %}}
+Artifacts Generated: Process Create, Process Inject, Process Kill
+{{% /notice %}}
+
+## Summary
+
+Execute a .NET Framework assembly with the specified arguments. This assembly must first be cached in the agent using the `register_assembly` command before being executed.
+
+### Arguments
+
+![exeasm](../images/execute_assembly.png)
+
+#### Assembly
+The name of the assembly to execute. This must match the file name used with `register_file`. 
+
+#### Arguments (optional)
+Arguments to pass to the assembly.
+
+## Usage
+```
+execute_assembly -Assembly [assembly_name] -Arguments [arguments]
+execute_assembly [assembly_name] [arguments]
+```
+
+Example
+```
+execute_assembly SeatBelt.exe --groups=all
+```
+
+
+## MITRE ATT&CK Mapping
+
+- T1547
+
+## Detailed Summary
+The `execute_assembly` command uses a .NET Common Language Runtime loader to execute assemblies within a sacrificial process and return output over a named pipe back to the agent. This loader is injected into a sacrificial process (specified by the `spawnto_*` commands) and passes the assembly's bytes over a named pipe, which is then loaded reflectively using `System.Reflection.Assembly.Load`. This assembly is then invoked and passed any passed arguments while streaming data over the named pipeLine truncated
+
+This creates a new artifact relating to the sacrificial process spawned, which can be viewed in the artifacts page.
+
+### Resources
+- [DotNetReflectiveLoading](https://github.com/ambray/DotNetReflectiveLoading)

documentation-payload/ares/commands/execute_coff.md

@@ -0,0 +1,53 @@
++++
+title = "execute_coff"
+chapter = false
+weight = 103
+hidden = false
++++
+
+## Summary
+
+Execute a Beacon Object File (BOF) with the specified arguments. This object file must first be cached in the agent using the `register_coff` command before being executed.
+The `RunOF.dll` ia now automatically obtained from mythic if Apollo does not have it loaded in its file store already. 
+
+### Arguments
+
+![execoff](../images/execute_coff.png)
+
+#### Object File
+The name of the object file to execute. This must match the file name used with `register_file` or `register_coff`.
+
+#### Function
+Function of the object file to call, usually 'go'.
+
+#### TimeOut
+Maximum time (in seconds) that the object file should run.
+
+#### Arguments (optional)
+Arguments to pass to the function, using the following format:
+
+-s:123 or int16:123
+-i:123 or int32:123
+-z:hello or string:hello
+-Z:hello or wchar:hello
+-b:abc== or base64:abc==
+
+## Usage
+```
+execute_coff -Coff [coff_name] -Function [go] -Timeout [30] [-Arguments [arguments]]
+```
+
+Example
+```
+execute_coff -Coff dir.x64.o -Function go -Timeout 30 -Arguments wchar:C:\\
+```
+
+## MITRE ATT&CK Mapping
+
+- T1027
+
+## Detailed Summary
+The `execute_coff` command uses a Object File loader to execute object files within a new thread and returning output back to the agent using the implementation of Beacon functions.
+
+### Resources
+- [RunOF](https://github.com/nettitude/RunOF)

documentation-payload/ares/commands/execute_pe.md

@@ -0,0 +1,49 @@
++++
+title = "execute_pe"
+chapter = false
+weight = 103
+hidden = false
++++
+
+{{% notice info %}}
+Artifacts Generated: Process Create, Process Inject, Process Kill
+{{% /notice %}}
+
+## Summary
+
+Execute a statically compiled PE file (e.g., compiled with /MT) with the specified arguments. This PE must first be cached in the agent using the `register_file` command before being executed.
+
+{{% notice info %}}
+Executables must be compiled for the architecture of the machine. e.g., if Apollo is running on a 64-bit machine, compile the executable for x64.
+{{% /notice %}}
+
+This is based on the work put forward by Nettitude's [RunPE](https://github.com/nettitude/RunPE) project with modifications.
+
+### Arguments
+![exepe](../images/execute_pe.png)
+
+#### PE
+The name of the assembly to execute. This must match the file name used with `register_file`. 
+
+#### Arguments (optional)
+Arguments to pass to the assembly.
+
+## Usage
+```
+execute_pe -PE [pe_name] -Arguments [arguments]
+execute_pe [pe_name] [arguments]
+```
+
+Example
+```
+execute_pe -PE SpoolSample.exe -Arguments "127.0.0.1 127.0.0.1"
+execute_pe SpoolSample.exe 127.0.0.1 127.0.0.1
+```
+
+
+## MITRE ATT&CK Mapping
+
+- T1547
+
+### Resources
+- [RunPE](https://github.com/nettitude/RunPE)

documentation-payload/ares/commands/exit.md

@@ -0,0 +1,17 @@
++++
+title = "exit"
+chapter = false
+weight = 103
+hidden = false
++++
+
+## Summary
+Task an agent to exit.
+
+## Usage
+```
+exit
+```
+
+## Detailed Summary
+The `exit` command uses the `Environment.Exit` method to exit the agent's running process. 

documentation-payload/ares/commands/get_injection_techniques.md

@@ -0,0 +1,33 @@
++++
+title = "get_injection_techniques"
+chapter = false
+weight = 103
+hidden = false
++++
+
+## Summary
+Retrieve a list of available injection techniques the agent can use.
+
+## Usage
+```
+get_injection_techniques
+```
+
+## Detailed Summary
+The `get_injection_techniques` command displays the various process injection techniques the agent is capable of using for post-exploitation jobs. You can see the current technique being used by an agent with the [`get_injection_techniques`](/agents/apollo/commands/get_injection_techniques/) command. The technique can also be changed using the [`set_injection_technique`](/agents/apollo/commands/set_injection_technique/) command.
+
+You are encouraged to create your own injection technique and submit a new pull request!
+
+### Available techniques
+
+#### CreateRemoteThread
+"Classic" process injection technique that uses the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` Windows APIs to execute shellcode in a specified process.
+
+#### Early-Bird QueueUserAPC
+Works for all jobs spawning sacrificial processes, but mileage may vary for injection-type commands. Calls `VirtualAllocEx`, `WriteProcessMemory`, `QueueUserAPC` and `ResumeThread` calls.
+
+#### NtCreateThreadEx
+Leverages syscalls from the NTDLL library to directly invoke shellcode associated with `NtOpenProcess`, `NtClose`, `NtDuplicateObject`, `NtAllocateVirtualMemory`, `NtProtectVirtualMemory`, `NtWriteVirtualMemory`, and `NtCreateThreadEx`
+
+
+![get_injection_techniques](../images/get_injection_techniques.png)

documentation-payload/ares/commands/getprivs.md

@@ -0,0 +1,21 @@
++++
+title = "getprivs"
+chapter = false
+weight = 103
+hidden = false
++++
+
+## Summary
+Enable as many privileges as possible for your current access token.
+
+## Usage
+```
+getprivs
+```
+
+## MITRE ATT&CK Mapping
+
+- T1078
+
+## Detailed Summary
+The `getprivs` command uses the `AdjustTokenPrivileges` Windows API to enable all privileges assigned to the current thread's token.

documentation-payload/ares/commands/ifconfig.md

@@ -0,0 +1,19 @@
++++
+title = "ifconfig"
+chapter = false
+weight = 103
+hidden = false
++++
+
+## Summary
+Retrieve network interface information.
+
+## Usage
+```
+ifconfig
+```
+
+
+## MITRE ATT&CK Mapping
+
+- T1590.005