Link command buggy

[who1smrrobot]

When trying to laterally move via the link command, something seems to be broken (unless there is a layer 8 problem on my side):

What I've tried so far:

1. Create apollo payload with SMB profile
2. modal link, click on add and enter host and select payload:

3. python error:

Questions:

• What is the intended approach for a lateral movement via psexec/link
• How/Where to complete the fields host, payload, c2profile in the modal from step 2?

[djhohnstein]

This is a mythic-ism. What you need to do is click that "add" once you've entered those fields in the first image you linked. Then you should see Host, Payload, and C2 Profile populate with data. When that's populated with data, you can submit the task.

[djhohnstein]

RE: "What is the intended approach for lateral movement via psexec/link," that's a loaded question. I will say though that the sc command can do everything you would need to do for psexec, such as creating and starting a new service.

[who1smrrobot]

Thx for the quick reply which brought some light on the field:

Unfortunately, I am stuck at this point:

1. link
2. variant a: modal click add and enter host + payload (Apollo Shellcode + service wrapper):

2. variant b: modal click add and enter host + payload (Apollo WinExe + service wrapper)
3. click add to really add it
4. get the following response:

Any idea on what is wrong?

[djhohnstein]

So to troubleshoot:

1. How did you launch apollo_smb.bin?
2. What is the process than ran apollo_smb.bin?
3. Is the process from above still running?
4. Is the named pipe associated with apollo_smb.bin created? (e.g., if you do something like ls \\.\pipe on DC50.STUDENT5.ECORP.LOCAL you should see the named pipe associated with that shellcode (the GUID beginning with "79m...")

[who1smrrobot]

First of all, layer 8 problem as I overlooked that the sc command does exist, but is currently missing in the documentation part.

I fixed my lateral movement issue with the following command sc -DisplayName mrrobot -BinPath C:\LabSetup\service_wrapper.exe -ServiceName mrrobot -Computer dc50.student5.ecorp.local -Create + sc start mrrobot.

And I also fixed the link issue:

Goal: Mythic Server <---HTTP--> Callback (e.g. to my CLIENT50.student5.ecorp.local) <--- SMB ----> DC50.student5.ecorp.local

1. Create Apollo shellcode payload with SMB c2 profile
2. Create service wrapper and select payload from step 1
3. Upload service wrapper binary to target host
4. Create service and choose as binPath the target path of 3
5. Start (created) service
6. Link target host with apollo shellcode payload from step 1
7. voilà :)

[djhohnstein]

sc documentation is now available in the documentation container via this PR: https://github.com/MythicAgents/Apollo/pull/86