search

BlWasp / rs-shell

A dirty PoC for a reverse shell with cool features in Rust
GNU General Public License v3.0
165 stars 17 forks source link

Error openning file to load #2

Closed Summ1tSunshine closed 7 months ago

Summ1tSunshine commented 8 months ago

When attempting to run load and syscalls I get an error "Error openning file to load". The command looks like this. "load C:\users\dev\desktop\test.exe"

I have confirmed the exe does exist so I'm not sure what is wrong. Any ideas?

Summ1tSunshine commented 8 months ago

I have also tried load C:\\users\\dev\\desktop\\test.exe and that resulted in the same error.

BlWasp commented 8 months ago

Hi, have you tried to activate the debug logs to view what is happening on client side ? The steps are described in the readme.

And also, can you try to use the load -h command to process the loading and execution in a remote process instead on the rs-shell's client process ?

Summ1tSunshine commented 7 months ago

That's odd. When I compile with the debug option everything works fine. It's possible I had issues compiling the first time? Not sure.

Summ1tSunshine commented 7 months ago

Actually I realized the results are still the same and there is no output in the client console when I run "load C:\users\dev\desktop\test.exe". If I place the test.exe on the client in "C:\users\dev\desktop\" the command runs fine and executes the exe. Does the exe need to be on the client system before it can be executed? I thought it would pull the exe or shellcode from the server system and execute directly into memory.

BlWasp commented 7 months ago

Hi! Oh yeah, maybe the readme and the help are not clear. When you load a shellcode (with load -s or syscalls -s) the shellcode file must be set on your attacker computer and it will be loaded remotely. However, to load a PE file, it must reside on the client target. For the moment I haven't implemented a remote PE loading from the attacker machine. But the idea is good!

Summ1tSunshine commented 7 months ago

Ahhh makes sense. Ok thanks for the information.

BlWasp commented 7 months ago

No problem, with pleasure 🙂