Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Unable to perform http POST request using exe stager #149

Open
w1ld3r opened this issue Apr 22, 2020 · 5 comments
Open

[BUG] Unable to perform http POST request using exe stager #149

w1ld3r opened this issue Apr 22, 2020 · 5 comments
Assignees
Labels
bug Something isn't working

Comments

@w1ld3r
Copy link

w1ld3r commented Apr 22, 2020

Issue Template

Context

Please provide any relevant information about your setup. This is important in case the issue is not reproducible except for under certain conditions.

  • SILENTTRINITY Version: Master
  • OS running the Client: Debien 10 sid (Linux debian 5.5.0-2-amd64 print() is a function in Python 3 #1 SMP Debian 5.5.17-1 (2020-04-15) x86_64 GNU/Linux)
  • Python Version Running the Client: Python 3.8.2
  • OS running the TeamServer: Debien 10 sid (Linux debian 5.5.0-2-amd64 print() is a function in Python 3 #1 SMP Debian 5.5.17-1 (2020-04-15) x86_64 GNU/Linux)
  • Python version running the Teamserver: Python 3.8.2

Expected Behavior

Is it normal, the exe stager require parameters ?

Current Behavior

When executing the exe with parameters needed, I get errors.
The stager is sending stage in infinite boucle to the client server.

Failure Information

image

image

Steps to Reproduce

I generate an exe by typing:

  1. stagers
  2. use exe
  3. generate http
  4. Download the exe on Windows 10 updated
  5. Execute the exe (stager.exe guid psk http://ip:80)

Failure Logs

Please look at screen-shots above

@w1ld3r w1ld3r added the bug Something isn't working label Apr 22, 2020
@w1ld3r
Copy link
Author

w1ld3r commented Apr 22, 2020

It seem WIndows Defender is blocking HTTP POST requests, but without it, the exe is in infinite loop attenting HTTP POST request like shown in the screen shot above

@w1ld3r
Copy link
Author

w1ld3r commented Apr 22, 2020

I've used guid and psk generated y powershell stager because I don't know how can I find those for the exe stager

@w1ld3r w1ld3r changed the title [BUG] [BUG] Unable to perform http POST request using exe stager Apr 22, 2020
@w1ld3r
Copy link
Author

w1ld3r commented Apr 22, 2020

I get the same issue executing the compiled csharp stager

@d-sec-net
Copy link

d-sec-net commented Apr 22, 2020

This issue is fixed with the resolution of this issue:

#147

However this will create a new issue. The fix will allow the stager to run you will however now probably encounter further issues with the icompiler when running modules.

This has been highlighted in the following bug in the naga repo.

byt3bl33d3r/Naga#3

This newer issue can be remedied by compiling an earlier version of the naga exe and dll prior to the compiler changes.

This will allow the stager and the larger majority of modules to run. However you will then encounter the boo.lang list error in some of the modules (I think I saw the list issue again on the impersonate modules and a few others). byt3bl33d3r said he was aware of the issue and it may be down to an internal way in which boo.lang handles the loading within the compiler. Hope that helped, to get you up and runningish in the mean time.

@w1ld3r
Copy link
Author

w1ld3r commented May 14, 2020

Thanks for your reply @d-sec-net.
I've compile earlier version of the naga exe and dll and have modified the two .boo like sayed in this issue:
#147 (comment)

I'm getting the stager compiled on the windows 10 but unable to run a whoami:
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants