aryma/Ares-mythic
1
0
Fork 0
mirror of https://github.com/Aryma-f4/Ares-mythic.git synced 2026-06-25 11:14:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: aryma:afac72ad49cdf491813b92cff4bf1057b2ac6570
Branches Tags
aryma:main
..
compare: aryma:286accf2716382bdaf2ad25e09674d7e6f99c27d
Branches Tags
aryma:main

2 Commits
afac72ad49 ... 286accf271

Author SHA1 Message Date
Aryma
286accf271 chore: update Ares container tag and adjust build commands 
Update the remote image tag for Ares from multiarch-fixed-v2 to multiarch-fixed-v3 in the global configuration. Additionally, modify the dotnet build commands in the builder to target the specific WindowsService1.csproj file instead of the broader Ares.sln solution file for more precise and efficient compilation.
 2026-04-15 03:20:05 +07:00
Aryma
3ba28c3197 refactor: rename ApolloInterop to AresInterop and update build process 
Update project references across multiple agent modules to use AresInterop instead of ApolloInterop
Add System.IO import in Program.cs and remove unused Tasks import in WebshellPeer
Fix environmental keying configuration parsing in Config.cs to properly handle string values
Simplify build command in builder.py to target Ares.csproj directly instead of Ares.sln
Update nullable context and suppress warnings in AresInterop.csproj
 2026-04-15 02:54:15 +07:00
29 changed files with 114 additions and 112 deletions
Expand all files Collapse all files

86
Payload_Type/ares/ares/agent_code/Ares/Ares.csproj
View File

@@ -1,43 +1,43 @@
<Project Sdk="Microsoft.NET.Sdk"> <Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup> <PropertyGroup>
<TargetFramework>net451</TargetFramework> <TargetFramework>net451</TargetFramework>
<OutputType>Exe</OutputType> <OutputType>Exe</OutputType>
<LangVersion>12</LangVersion> <LangVersion>12</LangVersion>
<Nullable>enable</Nullable> <Nullable>enable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo> <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL"> <Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
<SpecificVersion>False</SpecificVersion> <SpecificVersion>False</SpecificVersion>
<HintPath>..\..\..\..\..\..\..\..\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll</HintPath> <HintPath>..\..\..\..\..\..\..\..\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll</HintPath>
</Reference> </Reference>
<Reference Include="System.Security" /> <Reference Include="System.Security" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
<ProjectReference Include="..\DInvokeResolver\DInvokeResolver.csproj" /> <ProjectReference Include="..\DInvokeResolver\DInvokeResolver.csproj" />
<ProjectReference Include="..\EncryptedFileStore\EncryptedFileStore.csproj" /> <ProjectReference Include="..\EncryptedFileStore\EncryptedFileStore.csproj" />
<ProjectReference Include="..\HttpProfile\HttpProfile.csproj" /> <ProjectReference Include="..\HttpProfile\HttpProfile.csproj" />
<ProjectReference Include="..\HttpxProfile\HttpxProfile.csproj" /> <ProjectReference Include="..\HttpxProfile\HttpxProfile.csproj" />
<ProjectReference Include="..\HttpxTransform\HttpxTransform.csproj" /> <ProjectReference Include="..\HttpxTransform\HttpxTransform.csproj" />
<ProjectReference Include="..\Injection\Injection.csproj" /> <ProjectReference Include="..\Injection\Injection.csproj" />
<ProjectReference Include="..\KerberosTickets\KerberosTickets.csproj" /> <ProjectReference Include="..\KerberosTickets\KerberosTickets.csproj" />
<ProjectReference Include="..\NamedPipeProfile\NamedPipeProfile.csproj" /> <ProjectReference Include="..\NamedPipeProfile\NamedPipeProfile.csproj" />
<ProjectReference Include="..\PlaintextCrypto\PlaintextCryptography.csproj" /> <ProjectReference Include="..\PlaintextCrypto\PlaintextCryptography.csproj" />
<ProjectReference Include="..\Process\Process.csproj" /> <ProjectReference Include="..\Process\Process.csproj" />
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" /> <ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" />
<ProjectReference Include="..\SimpleResolver\SimpleResolver.csproj" /> <ProjectReference Include="..\SimpleResolver\SimpleResolver.csproj" />
<ProjectReference Include="..\Tasks\Tasks.csproj" /> <ProjectReference Include="..\Tasks\Tasks.csproj" />
<ProjectReference Include="..\TcpProfile\TcpProfile.csproj" /> <ProjectReference Include="..\TcpProfile\TcpProfile.csproj" />
<ProjectReference Include="..\WebsocketProfile\WebsocketProfile.csproj" /> <ProjectReference Include="..\WebsocketProfile\WebsocketProfile.csproj" />
<ProjectReference Include="..\AzureBlobProfile\AzureBlobProfile.csproj" /> <ProjectReference Include="..\AzureBlobProfile\AzureBlobProfile.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" /> <PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
<PackageReference Include="PolySharp" Version="1.14.1" /> <PackageReference Include="PolySharp" Version="1.14.1" />
<PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" /> <PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
</ItemGroup> </ItemGroup>
</Project> </Project>

8
Payload_Type/ares/ares/agent_code/Ares/Config.cs
View File

@@ -1,4 +1,4 @@
#define C2PROFILE_NAME_UPPER #define C2PROFILE_NAME_UPPER
//#define LOCAL_BUILD //#define LOCAL_BUILD
@@ -280,14 +280,14 @@ namespace Apollo
public static int RegistryComparison = 1; // 1=Matches, 2=Contains public static int RegistryComparison = 1; // 1=Matches, 2=Contains
#else #else
// Environmental Keying Configuration // Environmental Keying Configuration
public static bool KeyingEnabled = keying_enabled_here; public static bool KeyingEnabled = "keying_enabled_here" == "true";
public static int KeyingMethod = keying_method_here; // 1=Hostname, 2=Domain, 3=Registry public static int KeyingMethod = int.Parse("keying_method_here"); // 1=Hostname, 2=Domain, 3=Registry
public static string KeyingValueHash = "keying_value_hash_here"; public static string KeyingValueHash = "keying_value_hash_here";
// Registry Keying Configuration // Registry Keying Configuration
public static string RegistryPath = "registry_path_here"; public static string RegistryPath = "registry_path_here";
public static string RegistryValue = "registry_value_here"; public static string RegistryValue = "registry_value_here";
public static int RegistryComparison = registry_comparison_here; // 1=Matches, 2=Contains public static int RegistryComparison = int.Parse("registry_comparison_here"); // 1=Matches, 2=Contains
#endif #endif
} }

1
Payload_Type/ares/ares/agent_code/Ares/Peers/Webshell/WebshellPeer.cs
View File

@@ -10,7 +10,6 @@ using AS = ApolloInterop.Structs.ApolloStructs;
using TTasks = System.Threading.Tasks; using TTasks = System.Threading.Tasks;
using ApolloInterop.Classes.Core; using ApolloInterop.Classes.Core;
using ApolloInterop.Structs.ApolloStructs; using ApolloInterop.Structs.ApolloStructs;
using Tasks;
using ApolloInterop.Utils; using ApolloInterop.Utils;
using System.Net; using System.Net;
using System.IO; using System.IO;

1
Payload_Type/ares/ares/agent_code/Ares/Program.cs
View File

@@ -12,6 +12,7 @@ using System.Collections.Concurrent;
using ApolloInterop.Classes.Core; using ApolloInterop.Classes.Core;
using ApolloInterop.Classes.Events; using ApolloInterop.Classes.Events;
using ApolloInterop.Enums.ApolloEnums; using ApolloInterop.Enums.ApolloEnums;
using System.IO;
using System.Runtime.InteropServices; using System.Runtime.InteropServices;
using ApolloInterop.Utils; using ApolloInterop.Utils;
using System.Security.Cryptography; using System.Security.Cryptography;

5
Payload_Type/ares/ares/agent_code/AresInterop/AresInterop.csproj
View File

@@ -3,9 +3,10 @@
<TargetFramework>net451</TargetFramework> <TargetFramework>net451</TargetFramework>
<OutputType>Library</OutputType> <OutputType>Library</OutputType>
<LangVersion>12</LangVersion> <LangVersion>12</LangVersion>
<Nullable>enable</Nullable> <Nullable>disable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo> <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
<NoWarn>$(NoWarn);0168;0169;0659;0660;0661;8632</NoWarn>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<Reference Include="System.Security" /> <Reference Include="System.Security" />
@@ -23,4 +24,4 @@
<Compile Remove="Serializers\ApolloSerializationBinder.cs" /> <Compile Remove="Serializers\ApolloSerializationBinder.cs" />
<Compile Remove="Serializers\EncryptedSMBSerializer.cs" /> <Compile Remove="Serializers\EncryptedSMBSerializer.cs" />
</ItemGroup> </ItemGroup>
</Project> </Project>

2
Payload_Type/ares/ares/agent_code/AzureBlobProfile/AzureBlobProfile.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/DInvokeResolver/DInvokeResolver.csproj
View File

@@ -7,7 +7,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="PolySharp" Version="1.14.1" /> <PackageReference Include="PolySharp" Version="1.14.1" />

4
Payload_Type/ares/ares/agent_code/EKECryptography/EKECryptography.csproj
View File

@@ -44,9 +44,9 @@
<Compile Include="Properties\AssemblyInfo.cs" /> <Compile Include="Properties\AssemblyInfo.cs" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj"> <ProjectReference Include="..\AresInterop\AresInterop.csproj">
<Project>{5b5bd587-7dca-4306-b1c3-83a70d755f37}</Project> <Project>{5b5bd587-7dca-4306-b1c3-83a70d755f37}</Project>
<Name>ApolloInterop</Name> <Name>AresInterop</Name>
</ProjectReference> </ProjectReference>
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj"> <ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj">
<Project>{c8fc8d87-30db-4fc5-880a-9cd7d156127a}</Project> <Project>{c8fc8d87-30db-4fc5-880a-9cd7d156127a}</Project>

2
Payload_Type/ares/ares/agent_code/EncryptedFileStore/EncryptedFileStore.csproj
View File

@@ -11,7 +11,7 @@
<Reference Include="System.Security" /> <Reference Include="System.Security" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/ExecuteAssembly/ExecuteAssembly.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" /> <PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />

2
Payload_Type/ares/ares/agent_code/ExecutePE.Standalone/ExecutePE.Standalone.csproj
View File

@@ -10,7 +10,7 @@
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
<ProjectReference Include="..\ExecutePE\ExecutePE.csproj" /> <ProjectReference Include="..\ExecutePE\ExecutePE.csproj" />
</ItemGroup> </ItemGroup>
</Project> </Project>

2
Payload_Type/ares/ares/agent_code/ExecutePE/ExecutePE.csproj
View File

@@ -9,7 +9,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<Content Include="FodyWeavers.xml" /> <Content Include="FodyWeavers.xml" />

2
Payload_Type/ares/ares/agent_code/HttpProfile/HttpProfile.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/HttpxProfile/HttpxProfile.csproj
View File

@@ -9,7 +9,7 @@
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
<ProjectReference Include="..\HttpxTransform\HttpxTransform.csproj" /> <ProjectReference Include="..\HttpxTransform\HttpxTransform.csproj" />
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" /> <ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" />
</ItemGroup> </ItemGroup>

2
Payload_Type/ares/ares/agent_code/Injection/Injection.csproj
View File

@@ -9,7 +9,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/KerberosTickets/KerberosTickets.csproj
View File

@@ -8,6 +8,6 @@
<GenerateAssemblyInfo>false</GenerateAssemblyInfo> <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
</Project> </Project>

2
Payload_Type/ares/ares/agent_code/KeylogInject/KeylogInject.csproj
View File

@@ -10,7 +10,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<Content Include="FodyWeavers.xml" /> <Content Include="FodyWeavers.xml" />

2
Payload_Type/ares/ares/agent_code/NamedPipeProfile/NamedPipeProfile.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/PSKCrypto/PSKCryptography.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/PlaintextCrypto/PlaintextCryptography.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/PowerShellHost/PowerShellHost.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" /> <PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />

2
Payload_Type/ares/ares/agent_code/Process/Process.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/ScreenshotInject/ScreenshotInject.csproj
View File

@@ -10,7 +10,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<Content Include="FodyWeavers.xml" /> <Content Include="FodyWeavers.xml" />

2
Payload_Type/ares/ares/agent_code/SimpleResolver/SimpleResolver.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="PolySharp" Version="1.14.1" /> <PackageReference Include="PolySharp" Version="1.14.1" />

58
Payload_Type/ares/ares/agent_code/Tasks/Tasks.csproj
View File

@@ -1,30 +1,30 @@
<Project Sdk="Microsoft.NET.Sdk"> <Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup> <PropertyGroup>
<TargetFramework>net451</TargetFramework> <TargetFramework>net451</TargetFramework>
<OutputType>Library</OutputType> <OutputType>Library</OutputType>
<LangVersion>12</LangVersion> <LangVersion>12</LangVersion>
<Nullable>enable</Nullable> <Nullable>enable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo> <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<UseWindowsForms>true</UseWindowsForms> <UseWindowsForms>true</UseWindowsForms>
<ImportWindowsDesktopTargets>true</ImportWindowsDesktopTargets> <ImportWindowsDesktopTargets>true</ImportWindowsDesktopTargets>
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<Reference Include="System.Management.Automation"> <Reference Include="System.Management.Automation">
<HintPath>..\packages\System.Management.Automation6.1.7\System.Management.Automation.dll</HintPath> <HintPath>..\packages\System.Management.Automation6.1.7\System.Management.Automation.dll</HintPath>
</Reference> </Reference>
<Reference Include="System.ServiceProcess" /> <Reference Include="System.ServiceProcess" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" /> <PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
<PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" /> <PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
<PackageReference Include="System.ValueTuple" Version="4.5.0" /> <PackageReference Include="System.ValueTuple" Version="4.5.0" />
<PackageReference Include="PolySharp" Version="1.14.1" /> <PackageReference Include="PolySharp" Version="1.14.1" />
<PackageReference Include="System.DirectoryServices" Version="4.5.0" /> <PackageReference Include="System.DirectoryServices" Version="4.5.0" />
<PackageReference Include="System.Management" Version="4.5.0" /> <PackageReference Include="System.Management" Version="4.5.0" />
</ItemGroup> </ItemGroup>
</Project> </Project>

2
Payload_Type/ares/ares/agent_code/TcpProfile/TcpProfile.csproj
View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms> <Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

2
Payload_Type/ares/ares/agent_code/WebsocketProfile/WebsocketProfile.csproj
View File

@@ -10,7 +10,7 @@
<AssemblyName>WebsocketProfile</AssemblyName> <AssemblyName>WebsocketProfile</AssemblyName>
</PropertyGroup> </PropertyGroup>
<ItemGroup> <ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" /> <ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" /> <PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

19
Payload_Type/ares/ares/mythic/agent_functions/builder.py
View File

@@ -135,19 +135,21 @@ def validate_httpx_config(config_data):
class Ares(PayloadType): class Ares(PayloadType):
name = "ares" name = "ares"
file_extension = "exe" file_extension = "exe"
author = "@djhohnstein, @its_a_feature_" author = "Aryma-f4"
mythic_encrypts = True mythic_encrypts = True
supported_os = [ supported_os = [
SupportedOS.Windows SupportedOS.Windows
] ]
semver = "2.4.12" semver = "2.4.12"
description = "Ares Windows payload type for Mythic."
wrapper = False wrapper = False
wrapped_payloads = ["scarecrow_wrapper", "service_wrapper"] wrapped_payloads = ["scarecrow_wrapper", "service_wrapper"]
c2_profiles = ["http", "httpx", "smb", "tcp", "websocket", "azure_blob"] c2_profiles = ["http", "httpx", "smb", "tcp", "websocket", "azure_blob"]
note = """ note = """
A fully featured .NET 4.0 compatible training agent. Version: {}. Ares Windows payload type for Mythic. Version: {}.
NOTE: P2P Not compatible with v2.2 agents! Supports WinExe, shellcode, source, and service builds.
NOTE: v2.3.2+ has a different bof loader than 2.3.1 and are incompatible since their arguments are different NOTE: P2P is not compatible with v2.2 agents.
NOTE: v2.3.2+ uses a different BOF loader than v2.3.1 and they are not compatible.
""".format(semver) """.format(semver)
supports_dynamic_loading = True supports_dynamic_loading = True
shellcode_format_options = ["Binary", "Base64", "C", "Ruby", "Python", "Powershell", "C#", "Hex"] shellcode_format_options = ["Binary", "Base64", "C", "Ruby", "Python", "Powershell", "C#", "Hex"]
@@ -607,9 +609,9 @@ NOTE: v2.3.2+ has a different bof loader than 2.3.1 and are incompatible since t
# Build command with conditional embedding # Build command with conditional embedding
if self.get_parameter('debug'): if self.get_parameter('debug'):
command = f"dotnet build Ares.sln -c {compileType} -p:Platform=\"Any CPU\" -p:EmbedDefaultConfig={str(embed_default_config).lower()} -o {agent_build_path.name}/{buildPath}/ --verbosity quiet" command = f"dotnet build Ares/Ares.csproj -c {compileType} -p:Platform=\"Any CPU\" -p:EmbedDefaultConfig={str(embed_default_config).lower()} -o {agent_build_path.name}/{buildPath}/ --verbosity quiet"
else: else:
command = f"dotnet build Ares.sln -c {compileType} -p:DebugType=None -p:DebugSymbols=false -p:DefineConstants=\"\" -p:Platform=\"Any CPU\" -p:EmbedDefaultConfig={str(embed_default_config).lower()} -o {agent_build_path.name}/{buildPath}/ --verbosity quiet" command = f"dotnet build Ares/Ares.csproj -c {compileType} -p:DebugType=None -p:DebugSymbols=false -p:DefineConstants=\"\" -p:Platform=\"Any CPU\" -p:EmbedDefaultConfig={str(embed_default_config).lower()} -o {agent_build_path.name}/{buildPath}/ --verbosity quiet"
await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage( await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage(
PayloadUUID=self.uuid, PayloadUUID=self.uuid,
StepName="Gathering Files", StepName="Gathering Files",
@@ -763,9 +765,9 @@ NOTE: v2.3.2+ has a different bof loader than 2.3.1 and are incompatible since t
) )
shutil.move(shellcode_path, working_path) shutil.move(shellcode_path, working_path)
if self.get_parameter('debug'): if self.get_parameter('debug'):
command = f"dotnet build Ares.sln -c {compileType} -p:OutputType=WinExe -p:Platform=\"Any CPU\"" command = f"dotnet build WindowsService1/WindowsService1.csproj -c {compileType} -p:OutputType=WinExe -p:Platform=\"Any CPU\""
else: else:
command = f"dotnet build Ares.sln -c {compileType} -p:DebugType=None -p:DebugSymbols=false -p:DefineConstants=\"\" -p:OutputType=WinExe -p:Platform=\"Any CPU\"" command = f"dotnet build WindowsService1/WindowsService1.csproj -c {compileType} -p:DebugType=None -p:DebugSymbols=false -p:DefineConstants=\"\" -p:OutputType=WinExe -p:Platform=\"Any CPU\""
proc = await asyncio.create_subprocess_shell( proc = await asyncio.create_subprocess_shell(
command, command,
stdout=asyncio.subprocess.PIPE, stdout=asyncio.subprocess.PIPE,
@@ -1011,4 +1013,3 @@ def adjust_file_name(filename, shellcode_format, output_type, adjust_filename):
return original_filename + ".txt" return original_filename + ".txt"
else: else:
return filename return filename

4
config.json
View File

@@ -4,5 +4,5 @@
"exclude_documentation_payload": false, "exclude_documentation_payload": false,
"exclude_documentation_c2": false, "exclude_documentation_c2": false,
"exclude_agent_icons": false, "exclude_agent_icons": false,
"remote_images": {"ares" :"ghcr.io/aryma-f4/ares-mythic:multiarch-fixed-v2"} "remote_images": {"ares" :"ghcr.io/aryma-f4/ares-mythic:multiarch-fixed-v3"}
} }