Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] - enable-rotation in implant issue #289

Open
ptf569 opened this issue Jan 17, 2024 · 1 comment
Open

[BUG] - enable-rotation in implant issue #289

ptf569 opened this issue Jan 17, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@ptf569
Copy link

ptf569 commented Jan 17, 2024

Description

When trying to enable the communications rotation feature the implant returns an error.

Execution Environment:

All of this must be filled in

Data Value
Full Posh version (all the text between the === at the top of the Implant Handler) PoshC2 Zip (2a8a045 2024-01-15 13:32:27)
OS & version Ubuntu 22.04.3 LTS
Using Docker/containerisation? No

Implant Info

  • What implant does the problem occur on?: Sharp_v4_x64_Shellcode.bin
  • How was the implant created? Execution through both a custom Shellcode runner and a custom exe

Defensive Technologies

  • Is the target environment running any particular defensive products? Build in Windows Defender

To Reproduce

Steps to reproduce the behaviour:

  1. Establish beacon
  2. In Posh Console, select implant
  3. type command enable rotation
  4. when prompted for Domain or URL in array format: enter "https://domain1.com","https://domain2.com","https://domain3.com"
  5. when prompted for Domain front URL in array format: enter: "domain1.com","domain2.com","domain3.com"
  6. error returned by implant:
mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Config.Manager, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Core, Version=2.273.923.9, Culture=neutral, PublicKeyToken=null
Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a

   at Core.Common.Comms.GetDropperAssembly()
   at Core.Common.Comms.GetDropperAssembly()
   at Core.Common.Comms.GetTaskId()
   at Core.Common.Comms.Exec(String output, Byte[] outputBytes, String taskId)
   at Core.Common.Comms.DFUpdate(String commaSeperatedHostHeaders)
   --- End of inner exception stack trace ---
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Core.Program.Run(List`1 args)
   at Core.Program.Main(String[] args)'

Expected behaviour

Expect the beacon to start rotating communication via the given domains

@ptf569 ptf569 added the bug Something isn't working label Jan 17, 2024
@TheGrayFox92
Copy link

Nah

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants