Closed DrorDvash closed 1 month ago
its-a-feature
commented
2 months ago Once this latest build is done (https://github.com/its-a-feature/Mythic/actions/runs/10148225060) can you give that a shot? I added a bunch of UI updates to help with this and the auto scrolling issues. It's for Mythic 3.3 though.
DrorDvash
commented
2 months ago Yes i will! How to upgrade existing Mythic to branch 3.3 (if its not in master) ? I don't to mess things up so asking nooby question. Thanks!
its-a-feature
commented
2 months ago No worries! I wouldn't recommend upgrades during an assessment, so if you're actively operating for something then I'd suggest holding off. Since Mythic3.3 is currently in beta as we're testing out some new features, the process is a little more involved, but not much. Essentially:
sudo ./mythic-cli install github https://github.com/MythicAgents/poseidon -b Mythic3.3 -f)its-a-feature
commented
2 months ago That work for you like you expect with the Mythic 3.3 updates?
DrorDvash
commented
1 month ago @its-a-feature I'm unsure what is wrong, but i can't get the Mythic3.3 or maybe you forgot to update the sidebar UI? I did the steps twice but still version is v3.2.20-rc7. how can i be sure i'm on Mythic3.3?
also, this error popped up (and i cannot work with posiedon anymore):
its-a-feature
commented
1 month ago I believe the issue is here:
ubuntu@ip-10-0-9-160:~/Mythic$ git checkout -b Mythic3.3 Switched to a new branch 'Mythic3.3'
I think what you did was update your branch (git pull), then create a new local branch called Mythic3.3 (based on your current, Master branch), then you built the mythic-cli (from master). When you used mythic-cli to install the Mythic3.3 version of Poseidon though, that worked correctly, so you have Mythic3.2 and Poseidon for Mythic3.3 (hence the issue).
I think it might be as simple as like git checkout -b Mythic3.3 origin/Mythic3.3 which says to switch to a local branch called Mythic3.3 which pulls changes from the origin/remote Mythic3.3 branch.
DrorDvash
commented
1 month ago I believe the issue is here:
ubuntu@ip-10-0-9-160:~/Mythic$ git checkout -b Mythic3.3 Switched to a new branch 'Mythic3.3'
I think what you did was update your branch (git pull), then create a new local branch called
Mythic3.3(based on your current, Master branch), then you built the mythic-cli (from master). When you usedmythic-clito install the Mythic3.3 version of Poseidon though, that worked correctly, so you have Mythic3.2 and Poseidon for Mythic3.3 (hence the issue).I think it might be as simple as like
git checkout -b Mythic3.3 origin/Mythic3.3which says to switch to a local branch called Mythic3.3 which pulls changes from the origin/remote Mythic3.3 branch.
ok done thanks for that.
now back to the original issue -> i don't see any auto-scroll in console view
typing a command (in this example getuser) will NOT scroll down and show the output when received, so it's the same as before.
This is how i expected it to be:
its-a-feature
commented
1 month ago Gotcha, I'll look into why the auto scroll seems to be working for the normal view but not the console view. You mentioned another issue originally about sometimes things like ls would show JSON until you clicked away and clicked back. Does that still happen for you?
DrorDvash
commented
1 month ago The ls seems to be fine now, it was rendered right away!
The only thing i notice is the width of the columns that they lake to contains / wrap the button text (this is just ui stuff)
i tried also ps to see if it render right away, and it does- the output looks OK
but on the terminal i got this - should it bother me?
its-a-feature
commented
1 month ago awesome! I'm glad that part is fixed! I think in the browserscripts there's definitely room to adjust the desired widths for certain columns to make sure they are wide enough to show all the data. That's an easy thing we can adjust per script (Mythic isn't defining it, each script is saying like "give me a table with these columns and here's each column's widths")
its-a-feature
commented
1 month ago ok, try pulling the latest from the Mythic3.3 branch https://github.com/its-a-feature/Mythic/actions/runs/10270124358 and seeing if that works for you now with the scroll. It should scroll to the output if you're at the bottom of the scroll window, but if you're scrolled up, then it shouldn't auto scroll down on you
DrorDvash
commented
1 month ago ok, try pulling the latest from the Mythic3.3 branch https://github.com/its-a-feature/Mythic/actions/runs/10270124358 and seeing if that works for you now with the scroll. It should scroll to the output if you're at the bottom of the scroll window, but if you're scrolled up, then it shouldn't auto scroll down on you
I've probably missed your last reply. I have a few days off from work but be sure I'll test it out! Will update here asap, thanks!
DrorDvash
commented
1 month ago It seems to work fine :) Thanks @its-a-feature
regarding the errors while running ps command in poseidon, should it bother me? do I need to do something about it?
2024-08-27 02:24:15.607 pos[2753:32509] CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.
2024-08-27 02:24:15.621 pos[2753:32509] CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.
2024-08-27 02:24:15.634 pos[2753:32509] CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary on line 3. Parsing will be abandoned. Break on _CFPropertyListMissingSemicolon to debug.Nah, you don't need to worry about them. The poseidon agent when doing ps used to try to do some parsing for the backing plist files for the processes, but macOS keeps changing things and has its own invalid data, so the parsing would throw errors. That's all been adjusted in the latest poseidon code
its-a-feature
commented
1 month ago I think we have all of these addressed now, so I'm going to close this issue. If you have other issues please continue to open up issues so I can get them resolved :)
Hi there, in “console view” there is no auto-scroll to see the output, so after pressing
enterto send a command you have to move the hand and scroll to see the output every time.One more “bug” I noticed - when you are doing
ls, at first you get the raw output (without browser script - first screenshot), so if you want to get the “rendered” view (2nd screenshot) you need to click on another task and then click back on thelstask to see the formatted view. when you navigate in the filesystem of a victim and look for interesting files, it isn't very pleasant to do so every time (everyls)raw output:
after click on another task and coming back to the task, the result is fine:
in both cases, this was checked on macOS Sonoma 14.5 (m2), with poseidon agent.