search

MythicAgents / atlas

13 stars 7 forks source link

TLSv1.2 / 1.3 for Atlas agent #5

Closed makim0n closed 2 years ago

makim0n commented 2 years ago

Hello,

I'm actually using Mythic C2 and try to use Atlas agent. My infrastructure involve "Caddy2" server for redirectors, this solution doesn't accept anymore TLSv1 / 1.1 for security reason (as mention here : https://stackoverflow.com/a/65018830) Apollo agent can use TLS1.2 and it's working fine with this configuration.

Here a sample of Atlas TLS traffic with the version used in wireshark :

image

Is there a way to configure TLS version in Atlas agent ? I tried to "diff" Atlas and Apollo code, but they are very different.

Thanks a lot

makim0n commented 2 years ago

I managed to force Atlas using TLS v1.2 for the C2 communication, now it works well. I add the following line on 439 and 481 : 

ServicePointManager.SecurityProtocol = (SecurityProtocolType)(0xc00); // 0c00 = TLS v1.2

image

According to this StackOverflow post (https://stackoverflow.com/a/51346252), it is not possible to use aliases for Tls12, but needs numerical values in .Net 4.0 only.

So, it's solved :)