This is a Lark (飞书) webhook logging container for Mythic v3.0.0+. This container connects to RabbitMQ queues for logging and sends messages to a Lark webhook in real-time.
- Sends log events to Lark webhook as messages are received
- Supports: Callback, Task, Payload, Keylog, Credential, Artifact, File, Response events
- Falls back to local logging if
WEBHOOK_DEFAULT_URLis not set - Logs are still written to
mythic.logfile
Set the WEBHOOK_DEFAULT_URL environment variable with your Lark webhook URL:
export WEBHOOK_DEFAULT_URL=https://open.feishu.cn/open-apis/bot/v2/hook/your-webhook-urlTo create a Lark webhook:
- Open a Lark group
- Click "Group Settings" > " Bots"
- Add a custom bot and copy the webhook URL
When it's time for you to test out your install or for another user to install your c2 profile, it's pretty simple. Within Mythic you can run the mythic-cli binary to install this in one of three ways:
sudo ./mythic-cli install github https://github.com/user/repoto install the main branchsudo ./mythic-cli install github https://github.com/user/repo branchnameto install a specific branch of that reposudo ./mythic-cli install folder /path/to/local/folder/cloned/from/githubto install from an already cloned down version of an agent repo
Now, you might be wondering when should you or a user do this to properly add your profile to their Mythic instance. There's no wrong answer here, just depends on your preference. The three options are:
- Mythic is already up and going, then you can run the install script and just direct that profile's containers to start (i.e.
sudo ./mythic-cli c2 start profileName. - Mythic is already up and going, but you want to minimize your steps, you can just install the profile and run
sudo ./mythic-cli mythic start. That script will first stop all of your containers, then start everything back up again. This will also bring in the new profile you just installed. - Mythic isn't running, you can install the script and just run
sudo ./mythic-cli mythic start.