MythicAgents / Apollo

A .NET Framework 4.0 Windows Agent
BSD 3-Clause "New" or "Revised" License
442 stars 91 forks source link

Link Local IP in UI #118

Closed jimplasra closed 2 months ago

jimplasra commented 1 year ago

Continuing from #48 -- Mythic sometimes displays the link local IP address even when other networks are available on the target host. This is because the GetIP() function selects the first of the list from all available IPv4 addresses: https://github.com/MythicAgents/Apollo/blob/f729f2f82cc06a502bf20135fa3975a752b2fdda/Payload_Type/apollo/agent_code/Apollo/Agent/Apollo.cs#L91-L92

Apollo can't know the best address to choose, but it should pick something other than a link local address. If the link local address is the only one available, GetIP() should return a placeholder of some sort.