Profiles - Mugen

Teamserver configuration using the Yaotl profile format.

Mugen uses profile files written in Yaotl (a dialect of HCL) to configure the teamserver, operators, listeners, and agent behavior.

./mugen server --profile myops.yaotl

bash

Full example

Teamserver {
    Host = "0.0.0.0"
    Port = 40056
 
    Build {
        Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
        Compiler86 = "/usr/bin/i686-w64-mingw32-gcc"
        Nasm       = "/usr/bin/nasm"
    }
}
 
Operators {
    operator "alice" {
        Password = "changeme"
    }
    operator "bob" {
        Password = "changeme2"
    }
}
 
Listeners {
    Http {
        Name         = "http-main"
        Hosts        = ["192.168.1.10:80"]
        HostBind     = "0.0.0.0"
        PortBind     = "80"
        PortConn     = "80"
        Secure       = false
        UserAgent    = "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
        Uris         = ["/updates", "/cdn/static", "/api/v1/ping"]
        Headers      = ["X-Forwarded-For: 1.2.3.4", "Cache-Control: no-cache"]
    }
}
 
Demon {
    Sleep   = 5
    Jitter  = 20
 
    TrustXForwardedFor = false
 
    Injection {
        Spawn64 = "C:\\Windows\\System32\\notepad.exe"
        Spawn86 = "C:\\Windows\\SysWOW64\\notepad.exe"
    }
}
 
Service {
    Endpoint = "service-ws"
    Password = "service-password"
}
 
WebHook {
    Discord {
        Url = "https://discord.com/api/webhooks/..."
    }
}

hcl

Blocks

Teamserver

Field	Type	Description
`Host`	string	Bind address for the client WebSocket
`Port`	int	Port for client connections
`Build.Compiler64`	string	Path to 64-bit MinGW (`data/x86_64-w64-mingw32-cross/...` after `make`, or `/usr/bin/x86_64-w64-mingw32-gcc`)
`Build.Compiler86`	string	Path to 32-bit MinGW (`data/i686-w64-mingw32-cross/...` after `make`, or `/usr/bin/i686-w64-mingw32-gcc`)
`Build.Nasm`	string	Path to nasm assembler

The default profiles/mugen.yaotl uses the compilers in data/. Those are not reinstalled by make rebuild. See Installation if you wiped data/.

Operators

Each operator gets a named block with a Password field.

Operators {
    operator "username" {
        Password = "password"
    }
}

hcl

Listeners

Listeners defined in the profile are started automatically on server boot.

HTTP/HTTPS fields:

Field	Type	Description
`Name`	string	Listener identifier
`Hosts`	list	Host rotation list (`"host:port"` format)
`HostBind`	string	Interface to bind on
`PortBind`	string	Listening port
`PortConn`	string	Port agents connect to (if different from bind)
`Secure`	bool	Enable TLS (HTTPS)
`UserAgent`	string	Agent User-Agent (Tengu: embedded in payload; Demon: used as filter)
`Uris`	list	URI list (Tengu: agent rotates through them per beacon; Demon: used as filter)
`Headers`	list	Tengu only: HTTP request headers embedded in payload and sent on every check-in
`Response.Headers`	list	Extra headers added to server HTTP responses
`Cert`	string	Path to TLS certificate (HTTPS only)
`Key`	string	Path to TLS private key (HTTPS only)

DNS fields:

Listeners {
    Dns {
        Name     = "dns-main"
        Domains  = ["c2.example.com"]
        HostBind = "0.0.0.0"
        PortBind = "53"
    }
}

hcl

DoH fields:

Listeners {
    Doh {
        Name     = "doh-main"
        Domains  = ["c2.example.com"]
        HostBind = "0.0.0.0"
        PortBind = "443"
        Cert     = "/path/to/cert.pem"
        Key      = "/path/to/key.pem"
    }
}

hcl

TCP fields:

Listeners {
    Tcp {
        Name     = "tcp-pivot"
        HostBind = "0.0.0.0"
        PortBind = "4444"
    }
}

hcl

Tengu HTTP payload fields

Three listener fields are embedded in the Tengu binary at build time and control how the agent behaves at runtime. Rebuild the payload after changing them.

Field	Effect
`UserAgent`	Overrides the default `Mozilla/5.0` string sent on every request
`Uris`	Agent cycles through the list per beacon (round-robin). Falls back to `/` if empty
`Headers`	Each string is appended as an HTTP request header on every check-in. Format: `"Name: Value"`

:::note Headers on a Tengu listener are request headers sent by the agent. For Demon, the same field controls server response headers - the semantics differ between agent types. :::

Demon

Field	Type	Description
`Sleep`	int	Default sleep in seconds
`Jitter`	int	Sleep jitter percentage
`TrustXForwardedFor`	bool	Log `X-Forwarded-For` as agent IP
`Injection.Spawn64`	string	Default 64-bit spawn-to process
`Injection.Spawn86`	string	Default 32-bit spawn-to process

Service

Enables the Service API WebSocket endpoint for external agents and ExternalC2.

Field	Type	Description
`Endpoint`	string	URL path (e.g. `"service-ws"` -> `/service-ws`)
`Password`	string	Authentication password

WebHook

Posts agent check-in metadata to a Discord webhook. The block name is WebHook (capital H) - the parser is case-sensitive.

WebHook {
    Discord {
        Url       = "https://discord.com/api/webhooks/ID/TOKEN"
        AvatarUrl = "https://..."   # optional
        User      = "Mugen"         # optional - bot display name
    }
}

hcl

Field	Required	Description
`Url`	yes	Full Discord webhook URL
`AvatarUrl`	no	Bot avatar image URL
`User`	no	Bot display name