How baklogr/kort works
This repository is a Mythic Python container for the Kort Windows agent and its translation service. The main workflow imports both services, then starts Mythic’s service loop; Mythic can request a payload build, while the agent’s check-in constructs a binary message, sends it through C2, and the translator converts received protocol messages into Mythic actions. The tree also advertises a broader command set, but its handlers were not sampled. Some C runtime relationships are supported only by the SOURCE INDEX; transport and tasking details remain limited by the available excerpts.
Main entry points: Checkin.c Check-in · builder.py Payload Builder · main.py Service Entry · Transport.c HTTP Transport
Components 15
Mythic Container
- Service Entry
main.py - Payload Builder
agent_functions/builder.py
Kort Agent
- Agent Entry
agent_code/Entry.c - Runtime Config
agent_code/kort.c - Check-in
agent_code/Checkin.c - HTTP Transport
agent_code/Transport.c - Agent Commands
agent_code/include/config.h
Protocol Translation
- Kort Translator
translator/translator.py - Package Codec
agent_code/Package.c - Response Parser
agent_code/Parser.c
Agent Internals
- Host Utilities
agent_code/Utils.c - Lazy Importer
agent_code/include/lazy_importer.hpp
Other components
- Mythic Server
- RabbitMQ
- gRPC
Connections 20
- Service Entry → Payload Builder: imports
main.py - Service Entry → Kort Translator: imports
main.py - Service Entry → Mythic Server: starts services
main.py - Mythic Server → Payload Builder: requests builds
- Payload Builder → Runtime Config: writes config
agent_functions/builder.py - Agent Entry → Check-in: invokes
agent_code/Entry.c - Agent Entry → Runtime Config: uses config
agent_code/Entry.c - Check-in → Package Codec: builds message
agent_code/Checkin.c - Check-in → Host Utilities: collects host data
agent_code/Checkin.c - Check-in → HTTP Transport: sends package
agent_code/Checkin.c - HTTP Transport → Response Parser: parses response
- HTTP Transport → Mythic Server: communicates over HTTP
- Kort Translator → Mythic Server: translates messages
translator/translator.py - Mythic Server → gRPC: connects via
README.md - Agent Commands → Agent Entry: enables commands
- Package Codec → Lazy Importer: uses
- Response Parser → Lazy Importer: uses
agent_code/Parser.c - Host Utilities → Lazy Importer: uses
agent_code/Utils.c - Mythic Server → RabbitMQ: connects via
README.md - RabbitMQ → Payload Builder: services payloads
README.md