hub / github.com/MythicAgents/thanatos
github.com/MythicAgents/thanatos @v0.1.14
Chat with this repo
386 symbols
883 edges
87 files
124 documented · 32%
What it actually does AI analysis from the code graph — generated when you open this
loading…
README
Thanatos
Thanatos is a Windows and Linux C2 agent written in rust.
Installation
To install Thanatos, you will need Mythic set up on a machine.
In the Mythic root directory, use mythic-cli to install the agent.
sudo ./mythic-cli install github https://github.com/MythicAgents/thanatos
sudo ./mythic-cli payload start thanatos
Thanatos supports the http C2 profile:
sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http
sudo ./mythic-cli c2 start http
Features
- Background job management
- Built-in ssh client
- Connect to a machine and download/upload files between that machine and Mythic
- Get directory listings from machines using sftp
- Spawn agents on machines using ssh
- ssh-agent hijacking
- Streaming portscan
- Stand up TCP redirectors
Future Additions
- v0.2.0
- [ ] Socks proxying
- [ ] Windows token manipulation
- [ ] More browser script integration
- [ ] DNS C2 profile
- [ ] p2p capabilities
- [ ] In memory shellcode execution
execute-shellcode
General Commands
| Command | Syntax | Description |
|---|---|---|
| cat | cat [file] |
Output the contents of a file. |
| cd | cd [new directory] |
Change directory. |
| cp | cp [source] [destination] |
Copy a file from [source] to [destination]. |
| download | download [path] |
Download a file from the target system (supports relative paths). |
| exit | exit |
Exit the agent. |
| getenv | getenv |
Get the current environment variables. |
| getprivs | getprivs |
Get the privileges of the agent session. |
| jobkill | jobkill [job id] |
Shutdown a running background job. |
| jobs | jobs |
List currently running background jobs. |
| ls | ls [directory] |
List files or directories (supports relative paths). |
| mkdir | mkdir [directory] |
Make a new directory. |
| mv | mv [source] [destination] |
Move a file from [source] to [destination] (supports relative paths). |
| portscan | portscan [popup] |
Scan a list of IPs for open ports. |
| ps | ps |
Get a list of currently running processes. |
| pwd | pwd |
Print working directory. |
| redirect | redirect [<bindhost>:<bindport>:<connecthost>:<connectport>] |
Setup a TCP redirector on the remote system. |
| rm | rm [path] |
Remove a file or directory (supports relative paths). |
| setenv | setenv [name] [value] |
Set environment variable [name] to [value]. |
| shell | shell [command] |
Run a shell command with bash -c on Linux or cmd.exe /c on Windows in a new thread. |
| sleep | sleep [interval][units] [jitter] |
Set the sleep interval and jitter (supports unit suffixing). |
| ssh | ssh [popup] |
Use ssh to execute commands, download/upload files or grab directory listings. |
| ssh-agent | ssh-agent [-c <socket>] [-d] [-l] |
Connect to running ssh agent sockets on the host or list identities. |
| ssh-spawn | ssh-spawn [popup] |
Spawn a Mythic agent on a remote host using ssh. |
| unsetenv | unsetenv [var] |
Unset an environment variable. |
| upload | upload [popup] |
Upload a file to the host machine. |
Windows-specific Commands
| Command | Syntax | Description |
|---|---|---|
| powershell | powershell [command] |
Run a command using powershell.exe /c in a new thread. |
Extension points exported contracts — how you extend this code
C2Profile (Interface)Trait which C2 profiles implement in order to connect to Mythic [1 implementers]
Payload_Type/thanatos/thanatos/agent_code/src/profiles/mod.rs
Core symbols most depended-on inside this repo
unverbatimcalled by 10
Payload_Type/thanatos/thanatos/agent_code/src/utils/mod.rs
spawn_background
called by 8
Payload_Type/thanatos/thanatos/agent_code/src/tasking.rs
payload_uuid
called by 4
Payload_Type/thanatos/thanatos/agent_code/src/payloadvars.rs
send_data
called by 4
Payload_Type/thanatos/thanatos/agent_code/src/profiles/mod.rs
sleep
called by 3
Payload_Type/thanatos/thanatos/agent_code/src/agent.rs
calculate_sleep_time
called by 3
Payload_Type/thanatos/thanatos/agent_code/src/agent.rs
callback_interval
called by 3
Payload_Type/thanatos/thanatos/agent_code/src/payloadvars.rs
callback_jitter
called by 3
Payload_Type/thanatos/thanatos/agent_code/src/payloadvars.rs
Shape
Languages
Python51%
Rust49%
Modules by API surface
Payload_Type/thanatos/thanatos/agent_code/src/profiles/http.rs15 symbols
Payload_Type/thanatos/thanatos/agent_code/src/utils/windows.rs13 symbols
Payload_Type/thanatos/thanatos/agent_code/src/profiles/mod.rs12 symbols
Payload_Type/thanatos/thanatos/agent_code/src/agent.rs12 symbols
Payload_Type/thanatos/thanatos/agent_code/src/payloadvars.rs10 symbols
Payload_Type/thanatos/thanatos/mythic/agent_functions/workinghours.py9 symbols
Payload_Type/thanatos/thanatos/mythic/agent_functions/sshspawn.py9 symbols
Payload_Type/thanatos/thanatos/mythic/agent_functions/sleep.py9 symbols
Payload_Type/thanatos/thanatos/agent_code/src/utils/linux.rs9 symbols
Payload_Type/thanatos/thanatos/agent_code/src/ps/linux_ps.rs9 symbols
Payload_Type/thanatos/thanatos/mythic/agent_functions/upload.py7 symbols
Payload_Type/thanatos/thanatos/mythic/agent_functions/unsetenv.py7 symbols
For agents
$ claude mcp add thanatos \
-- python -m otcore.mcp_server <graph>