Fawkes is an entirely vibe-coded Mythic C2 agent. It started as an "I wonder" and has turned into a goal. My goal is to not write a single line of code for this agent, instead, exclusively producing it at a prompt.

I originally attempted to write the agent myself, but after cloning the example container, reading through mythic docs, watching the dev series youtube videos, and copying code from other agents like Merlin or Freyja, I decided I just didn't have time to develop my own agent. A prompt though, that I have time for.

Fawkes is a golang based agent with cross-platform capabilities. It supports Windows (EXE, DLL, and shellcode payloads), Linux (ELF binaries and shared libraries), and macOS (Mach-O binaries for Intel and Apple Silicon). 212 commands total: 112 cross-platform, 82 Windows-only, 21 Unix-only, 11 Linux-only, and 6 macOS-only (some commands have platform-specific implementations sharing one user-facing name, e.g. screenshot). Supports HTTP egress and TCP peer-to-peer (P2P) linking for internal pivoting.

To install Fawkes, you'll need Mythic installed on a remote computer. You can find installation instructions for Mythic at the Mythic project page.

From the Mythic install directory:

./mythic-cli install github https://github.com/galoryber/fawkes

For detailed variant descriptions, see Injection Technique Details.

Fawkes supports optional binary inflation at build time. This embeds a block of repeated bytes into the compiled agent, which can be used to increase file size or lower entropy scores.

Two build parameters control this:

• inflate_bytes - Hex bytes to embed (e.g. 0x90 or 0x41,0x42)
• inflate_count - Number of times to repeat the byte pattern

The byte pattern is repeated inflate_count times, so the total added size is length(byte_pattern) * inflate_count.

Quick reference for sizing:

When inflation is not configured, only 1 byte of overhead is added to the binary.

Fawkes automatically registers artifacts with Mythic for opsec-relevant commands. Artifacts appear in the Mythic UI under the Artifacts tab, giving operators a clear picture of all forensic indicators generated during an engagement.

Tracked artifact types:

Read-only commands (ls, ps, cat, env, etc.) do not generate artifacts.

Credential-harvesting commands automatically report discoveries to Mythic's Credentials store, making them searchable and exportable from the Mythic UI.

The keylog command integrates with Mythic's Keylogs feature. When keystrokes are returned via stop or dump, they are automatically parsed by window title and sent to Mythic's keylog tracker with user attribution. Keylogs are searchable in the Mythic UI by window title, user, or keystroke content.

The make-token and steal-token commands register tokens with Mythic's Callback Tokens tracker. This provides visibility into which tokens are associated with each callback, including the impersonated user identity and source process. The rev2self command automatically removes tracked tokens when impersonation is dropped.

Control how the agent validates HTTPS certificates when communicating with the C2 server. Configured at build time via the tls_verify parameter:

Certificate pinning prevents MITM interception of agent traffic even if an attacker controls a trusted CA.

Go's standard TLS stack produces a distinctive JA3 hash that network security tools can identify as non-browser traffic. The tls_fingerprint build parameter uses uTLS to spoof the TLS ClientHello, producing a browser-matching JA3 fingerprint.

Multiple C2 callback URLs with automatic failover. If the primary callback host is unreachable, the agent transparently cycles through fallback URLs before applying backoff.

Same port and encryption as primary. Remembers last successful URL. Works with config vault and XOR obfuscation.

Prevent the agent from executing on unauthorized systems. Configured at build time — the agent silently exits before making any network contact if checks fail. No logging, no artifacts, no C2 traffic.

All patterns are case-insensitive and anchored to match the full value. Multiple keys can be combined — all must pass. Invalid regex patterns fail closed (agent exits). Leave empty to skip a check.

Enable the obfuscate_strings build parameter to XOR-encode all C2 config strings (callback host, URIs, user agent, encryption key, UUID) at build time with a per-build random 32-byte key. Prevents trivial IOC extraction via strings on the binary. Decoded at runtime. Cross-platform.

Enable the block_dlls build parameter to apply PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON to all child processes spawned by the agent (run, powershell commands). Prevents EDR from injecting monitoring DLLs into spawned processes. Uses STARTUPINFOEX with UpdateProcThreadAttribute. Windows only.

Set config -action set -key default_ppid -value <PID> at runtime to make all child processes (run, powershell) appear as children of a legitimate process (e.g., explorer.exe). Defeats parent-child process relationship detection by EDR. Combines with BlockDLLs when both are active. Uses UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PARENT_PROCESS). Disable with config -action set -key default_ppid -value 0. Windows only (T1134.004).

Enable the auto_patch build parameter to automatically patch EtwEventWrite and AmsiScanBuffer at agent startup. This prevents ETW-based detection and AMSI scanning before any agent activity occurs — no manual command required. Windows only (no-op on Linux/macOS).

Enable automatic binary deletion at startup via the self_delete build parameter. Once the agent starts running, it removes its own file from disk — eliminating the primary forensic artifact.

• Linux/macOS: Uses os.Remove() — the running process continues via the in-memory inode mapping. The file disappears from disk immediately.
• Windows: Uses the NTFS stream rename technique — renames the default :$DATA stream then deletes the file entry. No child process spawned.

The binary is deleted after environment key checks pass but before network activity begins.

Set the masquerade_name build parameter to change the agent's process name on Linux. Uses prctl(PR_SET_NAME) to modify /proc/self/comm, which is displayed by ps, top, and htop. Max 15 characters.

Useful names: [kworker/0:1], [migration/0], sshd, apache2, [rcu_preempt]

Combined with self-delete, the agent appears as a legitimate kernel thread or service with no file on disk.

All headers defined in the Mythic HTTP C2 profile configuration are applied to every request. Beyond User-Agent (always supported), operators can add headers like Accept-Language, Referer, Cookie, or X-Forwarded-For to blend C2 traffic with legitimate web traffic patterns.

Set the host_header build parameter to override the HTTP Host header. This enables domain fronting: route traffic through a CDN (e.g., CloudFront, Azure CDN) while the Host header targets your actual C2 domain. To network defenders, the traffic appears to go to the CDN's IP address.

Set the proxy_url build parameter to route agent traffic through an HTTP or SOCKS proxy. Useful for operating in corporate networks with mandatory proxy servers.

Examples: http://proxy.corp.local:8080, socks5://127.0.0.1:1080

All builds use Go's -trimpath flag to strip local filesystem paths from the compiled binary. Without this, paths like /home/user/project/... and /go/pkg/mod/... leak into the binary through panic traces and runtime metadata. Combined with -s -w (symbol stripping) and empty -buildid, this minimizes forensic information in the binary. Garble builds already handle this; -trimpath covers non-garble builds.

After compilation, the built payload is automatically scanned against a set of YARA rules that model common defender detection patterns. Results are shown in the Mythic build output as an informational step — the scan never fails the build.

Detection categories scanned:

• Go binary identification and symbol leaks
• Leaked build/development paths
• Mythic/C2 framework string indicators
• Windows injection API names
• Credential access API names
• Defense evasion API patterns
• Persistence mechanism strings
• Plaintext C2 configuration

This helps operators understand detection risk and choose appropriate opsec options (garble, obfuscate_strings, etc.) before deploying.

The HTTP profile calls back to the Mythic server over the basic, non-dynamic profile. This is the default egress profile — the agent polls Mythic for tasking over HTTP/HTTPS.

The TCP profile enables peer-to-peer (P2P) agent linking for internal pivoting. A TCP child agent listens on a port and waits for a parent agent to connect via the link command. All tasking and responses are routed through the parent's egress channel (HTTP), so the child never contacts Mythic directly.

Architecture:

Mythic Server ←──HTTP──→ Egress Agent (HTTP profile)
                              │
                              ├──TCP──→ Child Agent A (TCP profile, port 7777)
                              └──TCP──→ Child Agent B (TCP profile, port 8888)

Build parameters:

When tcp_bind_address is set, the agent starts in TCP listener mode instead of HTTP egress mode. The TCP C2 profile parameters (port, AESPSK, killdate) configure the listener.

Usage workflow:

1. Build a child agent with the TCP C2 profile and tcp_bind_address set (e.g., 0.0.0.0:7777)
2. Deploy the child to an internal host (no internet access required)
3. From an egress agent (HTTP profile), run: link -host <child_ip> -port 7777
4. Mythic creates a new callback for the child — all tasking flows through the egress agent
5. To disconnect: unlink -connection_id <uuid>

Encryption: AES-256-CBC with HMAC-SHA256 (same as HTTP profile). Wire protocol uses 4-byte length-prefixed framing.

Relink support: If a parent disconnects (e.g., via unlink or parent agent dies), the child agent caches its checkin data and waits for a new parent connection. When a new egress agent runs link, the child automatically re-registers with Mythic as a new callback. No manual intervention needed.

Multiple children: An egress agent can link to multiple TCP children simultaneously. Each child operates independently with its own callback.

Everything I know about Mythic Agents came from Mythic Docs or stealing code and ideas from the Merlin and Freyja agents.

After that, it's been exclusively feeding Claude PoC links and asking for cool stuff. Crazy right?

• Threadless Injection - CCob's ThreadlessInject (original C# implementation) and dreamkinn's go-ThreadlessInject (Go port)
• sRDI (Shellcode Reflective DLL Injection) - Merlin's Go-based sRDI implementation, originally based on Nick Landers' (monoxgas) sRDI
• PoolParty Injection - SafeBreach Labs PoolParty research (original C++ PoC) - Variant details
• Opus Injection - Callback-based injection techniques - Variant details
• Phoenix icon from OpenClipart