{"id":20464785,"url":"https://github.com/ghostmanager/mythic_sync","last_synced_at":"2025-06-20T16:11:45.551Z","repository":{"id":43029777,"uuid":"366208905","full_name":"GhostManager/mythic_sync","owner":"GhostManager","description":"Automated activity logging utility for Mythic C2 v3.0+ with Ghostwriter v3.0+","archived":false,"fork":false,"pushed_at":"2025-02-12T19:33:12.000Z","size":90,"stargazers_count":18,"open_issues_count":1,"forks_count":8,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-06-20T16:11:23.723Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://docs.mythic-c2.net/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GhostManager.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-05-11T00:17:21.000Z","updated_at":"2025-05-14T14:05:41.000Z","dependencies_parsed_at":"2023-12-16T00:52:46.475Z","dependency_job_id":"0c078e57-d160-4e7b-a0dd-e10147a073bf","html_url":"https://github.com/GhostManager/mythic_sync","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/GhostManager/mythic_sync","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostManager%2Fmythic_sync","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostManager%2Fmythic_sync/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostManager%2Fmythic_sync/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostManager%2Fmythic_sync/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GhostManager","download_url":"https://codeload.github.com/GhostManager/mythic_sync/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostManager%2Fmythic_sync/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":260976920,"owners_count":23091527,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-15T13:16:28.005Z","updated_at":"2025-06-20T16:11:40.533Z","avatar_url":"https://github.com/GhostManager.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mythic_sync\n\n[![Sponsored by SpecterOps](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fspecterops%2F.github%2Fmain%2Fconfig%2Fshield.json\u0026style=flat)](https://github.com/specterops#ghostwriter)\n\n[![Python Version](https://img.shields.io/badge/Python-3.10-brightgreen.svg)](.) [![License](https://img.shields.io/badge/License-BSD3-darkred.svg)](.) ![GitHub Release (Latest by Date)](https://img.shields.io/github/v/release/GhostManager/mythic_sync?label=Latest%20Release) ![GitHub Release Date](https://img.shields.io/github/release-date/GhostManager/mythic_sync?label=Release%20Date\u0026color=blue)\n\nThe `mythic_sync` utility connects to a [Mythic](https://github.com/its-a-feature/Mythic) C2 server (\u003e=3.0.0+) to ingest events and post these events to the [Ghostwriter](https://github.com/GhostManager/Ghostwriter) (\u003e=v3.0.1) GraphQL API to create real-time activity logs.\n\nThis tool automatically logs all new agent callbacks and every operator's Mythic commands, comments, and output into Ghostwriter so operators can focus more on technical execution and less on manual and tedious logging and reporting activities.\n\nThe current version of `mythic_sync` requires Mythic \u003e=v3.0.0 and Ghostwriter \u003e=v3.0.1.\n\n## Usage\n\n### Getting Started\n\nTo authenticate to your instances of Mythic and Ghostwriter, you will need this information handy:\n\n* Ghostwriter URL\n* Ghostwriter GraphQL API token\n* Ghostwriter log ID\n* Mythic credentials\n\n#### Ghostwriter API Token \u0026 Activity Log\n\nYou can get your log's ID by opening the log's webpage and looking at the top of the page. You'll see \"Oplog ID #\" followed by a number. That's the ID number you need.\n\nTo generate an API token for your Ghostwriter instance, visit your user profile and click on the \"Create\" button in the \"API Tokens\" section.\n\nThe token must be attached to an account that has access to the project containing your target oplog. You can read more about the [authorization controls on the Ghostwriter wiki](https://www.ghostwriter.wiki/features/graphql-api/authorization).\n\n### Execute via Mythic 3.0+ and `mythic-cli`\n\nFor the easiest experience with `mythic_sync`, install it via the `mythic-cli` tool. When installed this way, the `mythic_sync` service will become part of your Mythic deployment. You can then use `mythic-cli` to manage `mythic_sync` (just like Mythic) and the service will come up and go down alongside your other Mythic services.\n\nOn your Mythic server, run: `sudo ./mythic-cli mythic_sync install github https://github.com/GhostManager/mythic_sync`\n\nFollow the prompts to configure `mythic_sync` with your Mythic and Ghostwriter server configuration.\n\nYou can get your Ghostwriter Oplog ID by visiting your log in your web browser and looking at the top of the page or the URL. A URL with `/oplog/12/entries` means your Oplog ID is `12`.\n\n```bash\nsudo ./mythic-cli mythic_sync install github https://github.com/GhostManager/mythic_sync\n[*] Creating temporary directory\n[*] Cloning https://github.com/GhostManager/mythic_sync\nCloning into '/opt/Mythic/tmp'...\nPlease enter your GhostWriter API Key: eyJ0eXAiO...\nPlease enter your GhostWriter URL: https://ghostwriter.domain.com\nPlease enter your GhostWriter OpLog ID: 12\nPlease enter your Mythic API Key (optional):\n[+] Added mythic_sync to docker-compose\n[+] Successfully installed mythic_sync!\n[+] Successfully updated configuration in .env\n```\n\n### Execute via Stand Alone Docker\n\nAlternatively, you can use Docker and `docker-compose` to run the `mythic_sync` container. Use this option if you'd prefer to run `mythic_sync` on a different server than your Mythic containers or don't want to use `mythic-cli` to manage the service.\n\nAfter cloning repository, open the `settings.env` file and fill in the variables with appropriate values. The following is an example:\n\n```text\nMYTHIC_IP=10.10.1.100\nMYTHIC_USERNAME=mythic_admin\nMYTHIC_PASSWORD=SuperSecretPassword\nGHOSTWRITER_API_KEY=eyJ0eXAiO...\nGHOSTWRITER_URL=https://ghostwriter.mydomain.com\nGHOSTWRITER_OPLOG_ID=12\n```\n\nOnce the environment variables are set up, you can launch the service by using `docker-compose`:\n\n``` bash\ndocker-compose up\n```\n\n### Verify Successful Start-Up\n\nOpen your Ghostwriter log and look for an initial entry. You should see something like the following:\n\n    \u003e Initial entry from mythic_sync at: \u003cserver_ip\u003e. If you're seeing this then oplog syncing is working for this C2 server!\n\nIf so, you're all set! Otherwise, check the logs from the docker container for error messages. Fetch the logs with:\n\n`sudo ./mythic-cli logs mythic_sync`\n\n## Troubleshooting\n\nEnsure the host where `mythic_sync` is running has network access to the Ghostwriter and Mythic servers.\n\n`mythic_sync` uses an internal Redis database to sync what events have already been sent to Ghostwriter, avoiding duplicates.\n\nIf the `mythic_sync` service goes down, it is safe to stand it back up and avoid duplicates as long as nothing has forcefully stopped Mythic's Redis container.\n\n## References\n\n- [Mythic](https://github.com/its-a-feature/Mythic) - Multi-platform C2 Framework\n- [Ghostwriter](https://github.com/GhostManager/Ghostwriter) - Engagement Management and Reporting Platform\n- [Ghostwriter's Official Documentation - Operation Logging w/ Ghostwriter](https://ghostwriter.wiki/features/operation-logs) - Guidance on operation logging setup and usage with Ghostwriter\n- [Blog - Updates to Ghostwriter: UI and Operation Logs](https://posts.specterops.io/updates-to-ghostwriter-ui-and-operation-logs-d6b3bc3d3fbd_) - Initial announcement of the operation logging features in Ghostwriter\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghostmanager%2Fmythic_sync","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fghostmanager%2Fmythic_sync","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghostmanager%2Fmythic_sync/lists"}