Mythic eventing container that bridges Mythic C2 and CI/CD build pipelines.
Daedalus lets operators trigger builds, poll for completion, download artifacts, and tag payloads with build results from the Mythic UI. It supports five CI/CD providers:
- Jenkins: REST API (build with parameters, console log, artifact download)
- Forgejo Actions: Workflow dispatch API
- GitHub Actions: Workflow dispatch API (supports GitHub Enterprise via custom API base)
- GitLab CI/CD: Pipeline API (trigger, status, job artifacts, trace logs)
- Gitea Actions: Workflow dispatch API (Gitea Acts runner)
Daedalus also includes a Command Augment (CA) container that injects CI/CD commands directly into supported agent callbacks (Apollo, Athena, Merlin, Starburst):
- daedalus_fetch_execute: Fetch a CI/CD artifact and execute it in-memory (BOF or .NET assembly)
- daedalus_register_tool: Fetch a CI/CD artifact and register it as a Mythic file
- daedalus_obfuscate_build: Pull source from any Git repo, run it through a CI/CD obfuscation pipeline, then execute or register
# Install into Mythic
sudo ./mythic-cli install github https://github.com/Whispergate/Daedalus
# Or from a local path
sudo ./mythic-cli install folder /path/to/DaedalusSet your CI/CD credentials via environment variables or per-workflow in the Mythic Eventing UI. See documentation-payload/daedalus/installation.md for details.
| Workflow | Trigger | Description |
|---|---|---|
| Daedalus Manual Build | manual |
On-demand build trigger |
| Daedalus Auto Build | payload_build_finish |
Auto build, upload artifact, and scan on new payload |
| Daedalus Check Build Status | manual |
Query a running build |
| Daedalus Download Artifact | manual |
Pull artifact into Mythic |
| Daedalus Build and Scan | manual |
Unified: build, download artifact, upload to Mythic, scan via LitterBox |
| Daedalus Scan Payload | manual |
Submit payload to LitterBox |
| Daedalus Get Verdict | manual |
Retrieve Sphinx + Daedalus tags |
Daedalus works alongside Sphinx and Erebus:
Operator → Daedalus (trigger build) → CI/CD pipeline → artifact
│
Erebus (package payload) ←──────────────────────┘
│
Sphinx (scan payload) ←──────────────────────┘
│
└── LitterBox verdict → Mythic tag
Daedalus workflows that include scanning call Sphinx's execute_script function directly as a workflow step. Mythic routes the call to Sphinx over RabbitMQ - the same mechanism Sphinx's own workflows use. No GraphQL proxy is needed.
When Sphinx is not installed, Daedalus's scan_payload custom function can call the LitterBox API directly as a fallback.
The Build and Scan workflow triggers a CI/CD build, waits for completion, then hands the payload to Sphinx for scanning. Get Verdict retrieves the combined Sphinx scan and Daedalus build tags for a payload.
The pipelines/ directory contains ready-to-use CI/CD configs for each provider. Copy the one matching your CI system into your build repository and fill in the build commands for your toolchain.
| Provider | File | Place in |
|---|---|---|
| Jenkins | pipelines/jenkins/Jenkinsfile |
Pipeline SCM config or repo root |
| GitHub Actions | pipelines/github/build.yml |
.github/workflows/build.yml |
| GitLab CI/CD | pipelines/gitlab/.gitlab-ci.yml |
Repo root as .gitlab-ci.yml |
| Forgejo Actions | pipelines/forgejo/build.yml |
.forgejo/workflows/build.yml |
| Gitea Actions | pipelines/gitea/build.yml |
.gitea/workflows/build.yml |
Each pipeline fetches shellcode from Mythic when SHELLCODE_SOURCE is provided, runs your build, and uploads the raw output as a CI artifact. Artifacts are not archived so Sphinx/LitterBox can scan them directly.
See documentation-payload/daedalus/ for full docs:
_index.md: Overview, supported agents, credential resolution, eventing functionsinstallation.md: Setup, Mythic Secrets, environment variablesarchitecture.md: Design overview, CA vs eventing, provider abstractioncommands/: Individual command reference (daedalus_fetch_execute, daedalus_register_tool, daedalus_obfuscate_build)