Mística

Mística Logo by JoelGMSec

Mística is a tool that allows to embed data into application layer protocol fields, with the goal of establishing a bi-directional channel for arbitrary communications. Currently, encapsulation into HTTP, HTTPS, DNS and ICMP protocols has been implemented, but more protocols are expected to be introduced in the near future.

Mística has a modular design, built around a custom transport protocol, called SOTP: Simple Overlay Transport Protocol. Data is encrypted, chunked and put into SOTP packets. SOTP packets are encoded and embedded into the desired field of the application protocol, and sent to the other end.

The goal of the SOTP layer is to offer a generic binary transport protocol, with minimal overhead. SOTP packets can be easily hidden or embeddeded into legitimate application protocols. Also SOTP makes sure that packets are received by the other end, encrypts the data using RC4 (this may change in the future), and makes sure that information can flow in both ways transparently, by using a polling mechanism.

Modules interact with the SOTP layer for different purposes:

• Wrap modules or Wrappers: These modules encode / decode SOTP packets from / into application layer protocols
• Overlay modules: These Modules ccommunicate over the SOTP channel. Examples are: io redirection (like netcat), shell (command execution), port forwarding…

Wrapper and overlay modules work together in order to build custom applications, e.g input redirection over DNS or remote port forwarding over HTTP.

Mística’s modular design allows for easy development of new modules. Also, the user can easily fork current modules in order to use some custom field or encoding or modify the behavior of an overlay module.

There are two main pieces of sofware:

• Mística server (ms.py): Uses modules that act as the server of the desired application layer protocol (HTTP, HTTPS, DNS, ICMP...). It is also designed in a way that will allow for multiple servers, wrappers and overlays to be run at the same time, with just one instance of ms.py, although this feature is not fully implemented yet.
• Mística client (mc.py): Uses modules that act as the client of the desired applicarion layer protocol (HTTP, HTTPS, DNS, ICMP...). It can only use one overlay and one wrapper at the same time.

Demos

You can see some Mística demos in the following playlist

Dependencies

The project has very few dependencies. Currently:

• Mística Client needs at least Python 3.7
• Mística Server needs at least Python 3.7 and dnslib.

python3.7 -m pip install pip --user
pip3.7 install dnslib --user

If you don't want to install python on your system, you can use one of the following portable versions:

• https://www.anaconda.com/distribution/#download-section (for Windows, Linux and macOS)
• https://github.com/winpython/winpython/releases/tag/2.1.20190928 (only for Windows)

Current modules

Overlay modules:

• io: Reads from stdin, sends through SOTP connection. Reads from SOTP connection, prints to stdout
• shell: Executes commands recieved through the SOTP connection and returns the output. Compatible with io module.
• tcpconnect: Connects to TCP port. Reads from socket, sends through SOTP connection. Reads from SOTP connection, sends through socket.
• tcplisten: Binds to TCP port. Reads from socket, sends through SOTP connection. Reads from SOTP connection, sends through socket.

Wrap modules:

• dns: Encodes/Decodes data in DNS queries/responses using different methods
• http: Encodes/Decodes data in HTTP or HTTPS requests/responses using different methods
• icmp: Encodes/Decodes data in ICMP echo requests/responses on data section

Usage

ms.py: Mística Server

Here's how the help message looks like:

usage: ms.py [-h] [-k KEY] [-l LIST] [-m MODULES] [-w WRAPPER_ARGS]
             [-o OVERLAY_ARGS] [-s WRAP_SERVER_ARGS]

Mistica server. Anything is a tunnel if you're brave enough. Run without
parameters to launch multi-handler mode.

optional arguments:
  -h, --help            show this help message and exit
  -k KEY, --key KEY     RC4 key used to encrypt the comunications
  -l LIST, --list LIST  Lists modules or parameters. Options are: all,
                        overlays, wrappers, <overlay name>, <wrapper name>
  -m MODULES, --modules MODULES
                        Module pair in single-handler mode. format:
                        'overlay:wrapper'
  -w WRAPPER_ARGS, --wrapper-args WRAPPER_ARGS
                        args for the selected overlay module (Single-handler
                        mode)
  -o OVERLAY_ARGS, --overlay-args OVERLAY_ARGS
                        args for the selected wrapper module (Single-handler
                        mode)
  -s WRAP_SERVER_ARGS, --wrap-server-args WRAP_SERVER_ARGS
                        args for the selected wrap server (Single-handler
                        mode)
  -v, --verbose         Level of verbosity in logger (no -v None, -v Low, -vv
                        Medium, -vvv High)

There are two main modes in Mística Server:

• Single Handler Mode: When ms.py is launched with parameters, it allows a single overlay modoule interacting with a single wrapper module.
• Multi-handler Mode: (Not published yet) When ms.py is run without parameters, the user enters an interactive console, where multiple overlay and wrapper modules may be launched. These modules will be able to interact with each other, with few restrictions.

mc.py: Mística client

Here's how the help message looks like:

usage: mc.py [-h] [-k KEY] [-l LIST] [-m MODULES] [-w WRAPPER_ARGS]
             [-o OVERLAY_ARGS]

Mistica client.

optional arguments:
  -h, --help            show this help message and exit
  -k KEY, --key KEY     RC4 key used to encrypt the comunications
  -l LIST, --list LIST  Lists modules or parameters. Options are: all,
                        overlays, wrappers, <overlay name>, <wrapper name>
  -m MODULES, --modules MODULES
                        Module pair. Format: 'overlay:wrapper'
  -w WRAPPER_ARGS, --wrapper-args WRAPPER_ARGS
                        args for the selected overlay module
  -o OVERLAY_ARGS, --overlay-args OVERLAY_ARGS
                        args for the selected wrapper module
  -v, --verbose         Level of verbosity in logger (no -v None, -v Low, -vv
                        Medium, -vvv High)

Parameters

• -l, --list is used to either list all modules, only list one type: (overlays or wrappers) or list the parameters that a certain module can accept through -o, -w or -s.
• -k, --key is used to specify the key that will be used to encrypt the overlay communication. This must be the same in client and server and is currently mandatory. This may change in the future if secret-sharing schemes are implemented.
• -m, --modules is used to specify which module pair do you want to use. You must use the following format: overlay_module + : + wrap_module. This parameter is also mandatory.
• -w, --wrapper-args allows you to specify a particular configuration for the wrap module.
• -o, --overlay-args allows you to specify a particular configuration for the overlay module.
• -s, --wrap-server-args is only present on ms.py. It allows you to specify a particular configuration for the wrap server. Each wrap module has a dependency on a wrap server, and both configurations can be tuned

Examples and Advanced use

Remember that you can see all of the accepted parameters of a module by typing -l <module_name> (e.g ./ms.py -l dns). Also remember to use a long and complex key to protect your communications!