search

BC-SECURITY / Empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
https://bc-security.gitbook.io/empire-wiki/
BSD 3-Clause "New" or "Revised" License
4.25k stars 576 forks source link

[BUG] Malleable C2 / incorrect URIs #392

Closed SaltyWafffles closed 3 years ago

SaltyWafffles commented 3 years ago

Note: Please fill out all sections (if applicable) and do not delete the below section headers, otherwise the bot will close the issue.

Empire Version

OS Information (Linux flavor, Python version)

Describe the bug

Generating a Malleable listener with an appropriately populated C2 profile works successfully, but any agent generated from them is not passed the correct URIs. Seems that it is defaulting to '/'.

To Reproduce

Steps to reproduce the behavior:

  1. Populate a C2 profile
  2. Create a malleable listener using that profile
  3. Generate a stager for that listener
  4. Execute an agent on target machine
  5. Monitor the HTTP comms via wireshark

Expected behavior

Generated agents should be configured to call out with the specified HTTP GET/POST URIs as specified in the supplied C2 profile.

Screenshots

image

image

Additional context

I tried putting trailing '/'s in the C2 profile, but that caused the same issue of the agent just reaching out for '/' as the GET URI.

Cx01N commented 3 years ago

I think the options clearing that we implemented in the last release messed with the malleable listener. Could you give this branch a shot and let me know if it fixes your issue? https://github.com/BC-SECURITY/Empire/pull/393

I tested the havex profile from our repo and it seems to be working. Which one were you using? Just so I can make sure it's not a broken profile (some have issues, unfortunately). https://github.com/BC-SECURITY/Malleable-C2-Profiles/tree/master/APT

image

SaltyWafffles commented 3 years ago

That branch seemed to fix the issue.

I was using the amazon.profile originally, but the havex.profile in your repository is working fine for me now.

Cx01N commented 3 years ago

I'll roll out a patch this week. Thanks for finding this!