To optimize penetration testing, our experts often use agents for the Mythic framework; you can read, for example, the reports about building our own Mythic agent (part 1, part 2) and our implementation of TCP transport for Xenon.
Now, we are going to present another useful tool for this framework. The goal was to solve the problem of architectural limitations when working with TCP P2P profiles of Poseidon and Apollo agents within the target network. Mythic itself has no built-in egress profile that speaks the TCP P2P protocol. If you deploy a Poseidon agent with a TCP P2P profile inside a target network, Mythic has no way to reach it: Poseidon is listening for an incoming TCP connection, but there’s nothing on Mythic’s side that can initiate one.
Our expert Oleg Senko has developed bind_tcp_agent — a virtual callback within Mythic that closes this gap. Now, with just one command link 192.168.1.100 18888, you get a channel into an isolated segment.
What bind_tcp_agent can do:
— Outbound TCP from Mythic: bind_tcp_agent connects to agents, rather than waiting for incoming calls.
— P2P chains of any depth: Mythic → bind_tcp_agent → Poseidon → Poseidon -> Apollo.
— SOCKS/HTTP proxy support: connections can route through SOCKS4, SOCKS5, or HTTP proxies.
— Three encryption modes: plaintext, AESPSK, EKE (RSA-OAEP → AES-256-CBC).
— Full relay: tasks, files, interactive shells, rpfwd, SOCKS.
— Auto-reconnect: exponential backoff + state persistence through the Mythic API.
For more details on how it works under the hood (TCP framing, encryption decision tree, reconnection handling, P2P delegates) — read the full description of bind_tcp_agent.
