BC-SECURITY / Empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
https://bc-security.gitbook.io/empire-wiki/
BSD 3-Clause "New" or "Revised" License
4.21k stars 575 forks source link

[BUG] Python Key Logger Issue #687

Open Degaria opened 1 year ago

Degaria commented 1 year ago

Problems with python_collection_linux modules

Empire Version

OS Information (Linux flavor, Python version)

Describe the bug

A Python agent was successfully brought to a second Kali Linux machine. Communication between client and agent was possible. The problem is that the available Python modules (e.g. python_collection_linux_keylogger) are passed to the agent as a task, but have no effect. In the agent's job list, these tasks disappear as quickly as they were assigned and nothing happened. In the case of python_collection_linux_keylogger, the file in which the logged input should be stored was also empty. There was also no error message.

To Reproduce

Steps to reproduce the behavior:

(All actions took place via the command line)

  1. Create a new http listener
  2. Create a new stager (_multilauncher with Language set to python and listener to the created http listener)
  3. Deploy the stager on the target system and run it
  4. After the connection to the agent has been established go back to client
  5. Then usemodule python_collection_linux_keylogger (Agent = agent on target system , LogFile = a file on target system)
  6. Execute the module
  7. got to target system and type something
  8. check jobs for the specific agent (in my case the task was not listed)
  9. check file on target (in my case it was empty)
  10. file was also not downloaded from target system

Expected behavior

I expected keystrokes made to be captured on the target system and then written to the file. Once the task has finished, the file should then be delivered to the client for viewing.

Screenshots

Additional context

Other modules from this python_collection_linux also seemed to show problems. (Or it was human error and I did something wrong ;) )

@Cx01N