search

BC-SECURITY / Empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
https://bc-security.gitbook.io/empire-wiki/
BSD 3-Clause "New" or "Revised" License
4.21k stars 575 forks source link

[BUG] - API doesnt provide a token #656

Closed webhead404 closed 1 year ago

webhead404 commented 1 year ago

Hello, using Kali rolling and Empire 5.0.4 I see that behaviors have changed slightly but I think I have accounted for it and found a bug. I'm using curl for the below example.

Empire Version

OS Information (Linux flavor, Python version)

Describe the bug

When running a POST to /token with JSON formatted data it displays a message from uvicorn stating that the username and password fields are required.

To Reproduce

Steps to reproduce the behavior:

  1. install powershell-empire via the docs for Kali
  2. Run powershell-empire server
  3. Run curl localhost:1337/token -X POST -H "Content-Type: application/json -d '{"username":"empireadmin","password":"password123"}
  4. See error

Expected behavior

Should display a JWT token for future requests.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

This cropped up via an automated script that stages Empire, however with this bug that failed.

vinnybod commented 1 year ago

This isn't quite a bug. The login POST request should be sent as a form.

You can see an example of the request by using the devtools network tab in your browser while logging in with Starkiller or when logging in via Swagger UI (http://localhost:1337/docs#/)

curl 'http://localhost:1337/token' -X POST -H 'Accept: application/json, text/plain, */*' -H 'Content-Type: application/x-www-form-urlencoded' --data-raw 'grant_type=password&username=empireadmin&password=password123'