Hacking Tools

Xenon : A New Tool In The Mythic Framework

Xenon is a Windows agent designed for the Mythic framework, inspired by tools like Cobalt Strike.

It is currently in an early stage of development and is not considered operationally secure (OPSEC safe), meaning it may contain memory leaks and other issues that could lead to crashes.

Despite these limitations, Xenon offers several features that make it useful for testing and educational purposes.

Key Features Of Xenon

  1. Modular Command Inclusion: Xenon allows users to include commands in a modular fashion, making it easier to extend its functionality.
  2. Malleable C2 Profiles with HTTPX: Xenon supports malleable command and control (C2) profiles using the HTTPX framework. This allows operators to configure how the agent communicates with its server, including features like domain rotation, callback jitter, and message transforms.
  3. Compatibility with Cobalt Strike BOFs: Xenon can execute Beacon Object Files (BOFs) from Cobalt Strike, providing additional situational awareness capabilities.

Xenon includes a range of basic commands for file management and process interaction:

  • pwd: Displays the current working directory.
  • ls: Lists directory contents.
  • cd: Changes the working directory.
  • cp: Copies files.
  • rm: Removes files or directories.
  • mkdir: Creates new directories.
  • getuid: Retrieves the current user ID.
  • make_token and steal_token: Create and impersonate tokens for identity manipulation.
  • ps: Lists running processes.
  • shell: Executes shell commands.
  • sleep: Adjusts the sleep timer and jitter for evasion.

Xenon also includes several situational awareness commands, such as:

  • sa_adcs_enum: Enumerates Certificate Authorities and templates in Active Directory.
  • sa_arp: Lists the ARP table.
  • sa_driversigs: Checks service image paths for AV/EDR vendor signatures.
  • sa_get_password_policy: Retrieves password policies for a server or domain.
  • sa_ipconfig: Displays IPv4 addresses, hostnames, and DNS servers.

The roadmap for Xenon includes addressing memory issues, implementing new commands for assembly execution and lateral movement, and integrating PowerShell support.

Despite its early stage, Xenon offers a promising platform for learning and experimentation with Windows internals and C programming.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

3 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

3 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

3 days ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

3 days ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

3 days ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

4 days ago