lldp

Mythic C2 profile for peer-to-peer communication over IEEE 802.1AB (LLDP). C2 data is carried inside Organizationally Specific TLVs (Type 127) with a configurable OUI so that frames blend with vendor-specific LLDP extensions on the wire.

LLDP is Layer 2 only. Both agents must share a broadcast domain. An egress agent (HTTP/HTTPX) bridges LLDP-linked agents back to the Mythic server, same as the SMB and TCP P2P profiles.

Supported agents

Agent	Linux	Windows
Starburst	AF_PACKET raw sockets	Npcap (wpcap.dll)

Installation

sudo ./mythic-cli install github https://github.com/Whispergate/lldp

If Mythic is already running:

sudo ./mythic-cli c2 start lldp

Or restart everything:

sudo ./mythic-cli restart

Configuration

Parameter	Default	Description
oui_profile	Cisco (00:00:0C)	Vendor OUI preset for the Org-Specific TLV
oui_custom	-	Custom 3-byte OUI as 6 hex chars. Used when oui_profile is "Custom"
subtype	01	1-byte TLV subtype (hex). Both ends must match
AESPSK	aes256_hmac	Encryption mode
encrypted_exchange_check	true	Perform key exchange on link establishment
killdate	+365 days	Agent expiry date

Requirements

• Linux: CAP_NET_RAW + CAP_NET_ADMIN (or root)
• Windows: Npcap installed. The agent resolves wpcap.dll at runtime

config.json

{
  "exclude_payload_type": true,
  "exclude_c2_profiles": false,
  "exclude_documentation_payload": true,
  "exclude_documentation_c2": false,
  "exclude_agent_icons": true
}

Authors

• @Lavender-exe
• @Mymaqn - initial idea

References

• IEEE Std 802.1AB LLDP for IETF LSVR Neighbor Discovery and Configuration
• Hilscher - Link Layer Discovery Protocol (LLDP)
• Wikipedia - Link Layer Discovery Protocol