refactor: rename ApolloInterop to AresInterop and update build process

Update project references across multiple agent modules to use AresInterop instead of ApolloInterop
Add System.IO import in Program.cs and remove unused Tasks import in WebshellPeer
Fix environmental keying configuration parsing in Config.cs to properly handle string values
Simplify build command in builder.py to target Ares.csproj directly instead of Ares.sln
Update nullable context and suppress warnings in AresInterop.csproj
This commit is contained in:
Aryma
2026-04-15 02:54:15 +07:00
parent afac72ad49
commit 3ba28c3197
28 changed files with 110 additions and 108 deletions

View File

@@ -1,43 +1,43 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net451</TargetFramework>
<OutputType>Exe</OutputType>
<LangVersion>12</LangVersion>
<Nullable>enable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
<SpecificVersion>False</SpecificVersion>
<HintPath>..\..\..\..\..\..\..\..\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll</HintPath>
</Reference>
<Reference Include="System.Security" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\DInvokeResolver\DInvokeResolver.csproj" />
<ProjectReference Include="..\EncryptedFileStore\EncryptedFileStore.csproj" />
<ProjectReference Include="..\HttpProfile\HttpProfile.csproj" />
<ProjectReference Include="..\HttpxProfile\HttpxProfile.csproj" />
<ProjectReference Include="..\HttpxTransform\HttpxTransform.csproj" />
<ProjectReference Include="..\Injection\Injection.csproj" />
<ProjectReference Include="..\KerberosTickets\KerberosTickets.csproj" />
<ProjectReference Include="..\NamedPipeProfile\NamedPipeProfile.csproj" />
<ProjectReference Include="..\PlaintextCrypto\PlaintextCryptography.csproj" />
<ProjectReference Include="..\Process\Process.csproj" />
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" />
<ProjectReference Include="..\SimpleResolver\SimpleResolver.csproj" />
<ProjectReference Include="..\Tasks\Tasks.csproj" />
<ProjectReference Include="..\TcpProfile\TcpProfile.csproj" />
<ProjectReference Include="..\WebsocketProfile\WebsocketProfile.csproj" />
<ProjectReference Include="..\AzureBlobProfile\AzureBlobProfile.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
<PackageReference Include="PolySharp" Version="1.14.1" />
<PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
</ItemGroup>
</Project>
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net451</TargetFramework>
<OutputType>Exe</OutputType>
<LangVersion>12</LangVersion>
<Nullable>enable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<Reference Include="System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
<SpecificVersion>False</SpecificVersion>
<HintPath>..\..\..\..\..\..\..\..\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll</HintPath>
</Reference>
<Reference Include="System.Security" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
<ProjectReference Include="..\DInvokeResolver\DInvokeResolver.csproj" />
<ProjectReference Include="..\EncryptedFileStore\EncryptedFileStore.csproj" />
<ProjectReference Include="..\HttpProfile\HttpProfile.csproj" />
<ProjectReference Include="..\HttpxProfile\HttpxProfile.csproj" />
<ProjectReference Include="..\HttpxTransform\HttpxTransform.csproj" />
<ProjectReference Include="..\Injection\Injection.csproj" />
<ProjectReference Include="..\KerberosTickets\KerberosTickets.csproj" />
<ProjectReference Include="..\NamedPipeProfile\NamedPipeProfile.csproj" />
<ProjectReference Include="..\PlaintextCrypto\PlaintextCryptography.csproj" />
<ProjectReference Include="..\Process\Process.csproj" />
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" />
<ProjectReference Include="..\SimpleResolver\SimpleResolver.csproj" />
<ProjectReference Include="..\Tasks\Tasks.csproj" />
<ProjectReference Include="..\TcpProfile\TcpProfile.csproj" />
<ProjectReference Include="..\WebsocketProfile\WebsocketProfile.csproj" />
<ProjectReference Include="..\AzureBlobProfile\AzureBlobProfile.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
<PackageReference Include="PolySharp" Version="1.14.1" />
<PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
</ItemGroup>
</Project>

View File

@@ -1,4 +1,4 @@
#define C2PROFILE_NAME_UPPER
#define C2PROFILE_NAME_UPPER
//#define LOCAL_BUILD
@@ -280,14 +280,14 @@ namespace Apollo
public static int RegistryComparison = 1; // 1=Matches, 2=Contains
#else
// Environmental Keying Configuration
public static bool KeyingEnabled = keying_enabled_here;
public static int KeyingMethod = keying_method_here; // 1=Hostname, 2=Domain, 3=Registry
public static bool KeyingEnabled = "keying_enabled_here" == "true";
public static int KeyingMethod = int.Parse("keying_method_here"); // 1=Hostname, 2=Domain, 3=Registry
public static string KeyingValueHash = "keying_value_hash_here";
// Registry Keying Configuration
public static string RegistryPath = "registry_path_here";
public static string RegistryValue = "registry_value_here";
public static int RegistryComparison = registry_comparison_here; // 1=Matches, 2=Contains
public static int RegistryComparison = int.Parse("registry_comparison_here"); // 1=Matches, 2=Contains
#endif
}

View File

@@ -10,7 +10,6 @@ using AS = ApolloInterop.Structs.ApolloStructs;
using TTasks = System.Threading.Tasks;
using ApolloInterop.Classes.Core;
using ApolloInterop.Structs.ApolloStructs;
using Tasks;
using ApolloInterop.Utils;
using System.Net;
using System.IO;

View File

@@ -12,6 +12,7 @@ using System.Collections.Concurrent;
using ApolloInterop.Classes.Core;
using ApolloInterop.Classes.Events;
using ApolloInterop.Enums.ApolloEnums;
using System.IO;
using System.Runtime.InteropServices;
using ApolloInterop.Utils;
using System.Security.Cryptography;

View File

@@ -3,9 +3,10 @@
<TargetFramework>net451</TargetFramework>
<OutputType>Library</OutputType>
<LangVersion>12</LangVersion>
<Nullable>enable</Nullable>
<Nullable>disable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<Platforms>AnyCPU;x64;x86</Platforms>
<NoWarn>$(NoWarn);0168;0169;0659;0660;0661;8632</NoWarn>
</PropertyGroup>
<ItemGroup>
<Reference Include="System.Security" />
@@ -23,4 +24,4 @@
<Compile Remove="Serializers\ApolloSerializationBinder.cs" />
<Compile Remove="Serializers\EncryptedSMBSerializer.cs" />
</ItemGroup>
</Project>
</Project>

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -7,7 +7,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="PolySharp" Version="1.14.1" />

View File

@@ -44,9 +44,9 @@
<Compile Include="Properties\AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj">
<ProjectReference Include="..\AresInterop\AresInterop.csproj">
<Project>{5b5bd587-7dca-4306-b1c3-83a70d755f37}</Project>
<Name>ApolloInterop</Name>
<Name>AresInterop</Name>
</ProjectReference>
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj">
<Project>{c8fc8d87-30db-4fc5-880a-9cd7d156127a}</Project>

View File

@@ -11,7 +11,7 @@
<Reference Include="System.Security" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />

View File

@@ -10,7 +10,7 @@
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
<ProjectReference Include="..\ExecutePE\ExecutePE.csproj" />
</ItemGroup>
</Project>

View File

@@ -9,7 +9,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<Content Include="FodyWeavers.xml" />

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -9,7 +9,7 @@
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
<ProjectReference Include="..\HttpxTransform\HttpxTransform.csproj" />
<ProjectReference Include="..\PSKCrypto\PSKCryptography.csproj" />
</ItemGroup>

View File

@@ -9,7 +9,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -8,6 +8,6 @@
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
</Project>

View File

@@ -10,7 +10,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<Content Include="FodyWeavers.xml" />

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -10,7 +10,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<Content Include="FodyWeavers.xml" />

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="PolySharp" Version="1.14.1" />

View File

@@ -1,30 +1,30 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net451</TargetFramework>
<OutputType>Library</OutputType>
<LangVersion>12</LangVersion>
<Nullable>enable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<UseWindowsForms>true</UseWindowsForms>
<ImportWindowsDesktopTargets>true</ImportWindowsDesktopTargets>
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<Reference Include="System.Management.Automation">
<HintPath>..\packages\System.Management.Automation6.1.7\System.Management.Automation.dll</HintPath>
</Reference>
<Reference Include="System.ServiceProcess" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
<PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
<PackageReference Include="System.ValueTuple" Version="4.5.0" />
<PackageReference Include="PolySharp" Version="1.14.1" />
<PackageReference Include="System.DirectoryServices" Version="4.5.0" />
<PackageReference Include="System.Management" Version="4.5.0" />
</ItemGroup>
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net451</TargetFramework>
<OutputType>Library</OutputType>
<LangVersion>12</LangVersion>
<Nullable>enable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<UseWindowsForms>true</UseWindowsForms>
<ImportWindowsDesktopTargets>true</ImportWindowsDesktopTargets>
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<Reference Include="System.Management.Automation">
<HintPath>..\packages\System.Management.Automation6.1.7\System.Management.Automation.dll</HintPath>
</Reference>
<Reference Include="System.ServiceProcess" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" PrivateAssets="All" />
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
<PackageReference Include="System.Data.DataSetExtensions" Version="4.5.0" />
<PackageReference Include="System.ValueTuple" Version="4.5.0" />
<PackageReference Include="PolySharp" Version="1.14.1" />
<PackageReference Include="System.DirectoryServices" Version="4.5.0" />
<PackageReference Include="System.Management" Version="4.5.0" />
</ItemGroup>
</Project>

View File

@@ -8,7 +8,7 @@
<Platforms>AnyCPU;x64;x86</Platforms>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -10,7 +10,7 @@
<AssemblyName>WebsocketProfile</AssemblyName>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\ApolloInterop\ApolloInterop.csproj" />
<ProjectReference Include="..\AresInterop\AresInterop.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />

View File

@@ -135,19 +135,21 @@ def validate_httpx_config(config_data):
class Ares(PayloadType):
name = "ares"
file_extension = "exe"
author = "@djhohnstein, @its_a_feature_"
author = "Aryma-f4"
mythic_encrypts = True
supported_os = [
SupportedOS.Windows
]
semver = "2.4.12"
description = "Ares Windows payload type for Mythic."
wrapper = False
wrapped_payloads = ["scarecrow_wrapper", "service_wrapper"]
c2_profiles = ["http", "httpx", "smb", "tcp", "websocket", "azure_blob"]
note = """
A fully featured .NET 4.0 compatible training agent. Version: {}.
NOTE: P2P Not compatible with v2.2 agents!
NOTE: v2.3.2+ has a different bof loader than 2.3.1 and are incompatible since their arguments are different
Ares Windows payload type for Mythic. Version: {}.
Supports WinExe, shellcode, source, and service builds.
NOTE: P2P is not compatible with v2.2 agents.
NOTE: v2.3.2+ uses a different BOF loader than v2.3.1 and they are not compatible.
""".format(semver)
supports_dynamic_loading = True
shellcode_format_options = ["Binary", "Base64", "C", "Ruby", "Python", "Powershell", "C#", "Hex"]
@@ -607,9 +609,9 @@ NOTE: v2.3.2+ has a different bof loader than 2.3.1 and are incompatible since t
# Build command with conditional embedding
if self.get_parameter('debug'):
command = f"dotnet build Ares.sln -c {compileType} -p:Platform=\"Any CPU\" -p:EmbedDefaultConfig={str(embed_default_config).lower()} -o {agent_build_path.name}/{buildPath}/ --verbosity quiet"
command = f"dotnet build Ares/Ares.csproj -c {compileType} -p:Platform=\"Any CPU\" -p:EmbedDefaultConfig={str(embed_default_config).lower()} -o {agent_build_path.name}/{buildPath}/ --verbosity quiet"
else:
command = f"dotnet build Ares.sln -c {compileType} -p:DebugType=None -p:DebugSymbols=false -p:DefineConstants=\"\" -p:Platform=\"Any CPU\" -p:EmbedDefaultConfig={str(embed_default_config).lower()} -o {agent_build_path.name}/{buildPath}/ --verbosity quiet"
command = f"dotnet build Ares/Ares.csproj -c {compileType} -p:DebugType=None -p:DebugSymbols=false -p:DefineConstants=\"\" -p:Platform=\"Any CPU\" -p:EmbedDefaultConfig={str(embed_default_config).lower()} -o {agent_build_path.name}/{buildPath}/ --verbosity quiet"
await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage(
PayloadUUID=self.uuid,
StepName="Gathering Files",
@@ -1011,4 +1013,3 @@ def adjust_file_name(filename, shellcode_format, output_type, adjust_filename):
return original_filename + ".txt"
else:
return filename