aryma/Ares-mythic
1
0
Fork 0
mirror of https://github.com/Aryma-f4/Ares-mythic.git synced 2026-06-13 00:34:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
Aryma
2026-04-14 12:17:24 +07:00
commit 2f05f67733
799 changed files with 531884 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
documentation-payload/apollo/opsec/forkandrun.md Normal file
View File

@@ -0,0 +1,24 @@
+++
title = "Fork and Run Commands"
chapter = false
weight = 102
+++
## What is Fork and Run?
"Fork and Run" is an agent architecture that spawns sacrificial processes in a suspended state to inject shellcode into.
## Fork and Run in Apollo
Apollo uses the fork and run architecture for a variety of jobs. These jobs will all first spawn a new process specified by the [`spawnto_x86`](/agents/apollo/commands/spawnto_x86) or [`spawnto_x64`](/agents/apollo/commands/spawnto_x64) commands. The parent process of these new processes is specified by the [`ppid`](/agents/apollo/commands/ppid/) command. Once the process is spawned, Apollo will use the currently set injection technique to inject into the remote process.
The following commands use the fork and run architecture:
- [`execute_assembly`](/agents/apollo/commands/execute_assembly/)
- [`mimikatz`](/agents/apollo/commands/mimikatz/)
- [`powerpick`](/agents/apollo/commands/powerpick/)
- [`printspoofer`](/agents/apollo/commands/printspoofer/)
- [`pth`](/agents/apollo/commands/pth/)
- [`dcsync`](/agents/apollo/commands/pth/)
- [`spawn`](/agents/apollo/commands/spawn/)
- [`execute_pe`](/agents/apollo/commands/execute_pe/)