whispergate/lldpC2 profile for Mythic tunneling encrypted peer-to-peer agent traffic through IEEE 802.1AB LLDP Organizationally Specific TLVs for covert Layer 2 command and control.
Mythic C2 profile for peer-to-peer communication over IEEE 802.1AB (LLDP). C2 data is carried inside Organizationally Specific TLVs (Type 127) with a configurable OUI so that frames blend with vendor-specific LLDP extensions on the wire.
LLDP is Layer 2 only. Both agents must share a broadcast domain. An egress agent (HTTP/HTTPX) bridges LLDP-linked agents back to the Mythic server, same as the SMB and TCP P2P profiles.
| Agent | Linux | Windows |
|---|---|---|
| Starburst | AF_PACKET raw sockets | Npcap (wpcap.dll) |
sudo ./mythic-cli install github https://github.com/Whispergate/lldp
If Mythic is already running:
sudo ./mythic-cli c2 start lldp
Or restart everything:
sudo ./mythic-cli restart
CAP_NET_RAW + CAP_NET_ADMIN (or root)wpcap.dll at runtime{
"exclude_payload_type": true,
"exclude_c2_profiles": false,
"exclude_documentation_payload": true,
"exclude_documentation_c2": false,
"exclude_agent_icons": true
}
| Parameter | Default | Description |
|---|
oui_profile | Cisco (00:00:0C) | Vendor OUI preset for the Org-Specific TLV |
oui_custom | - | Custom 3-byte OUI as 6 hex chars. Used when oui_profile is "Custom" |
subtype | 01 | 1-byte TLV subtype (hex). Both ends must match |
AESPSK | aes256_hmac | Encryption mode |
encrypted_exchange_check | true | Perform key exchange on link establishment |
killdate | +365 days | Agent expiry date |