search

HavocFramework / Havoc

The Havoc Framework
https://havocframework.com
GNU General Public License v3.0
6.89k stars 967 forks source link

Agent stuck after socks proxy #532

Open JBalanza opened 2 days ago

JBalanza commented 2 days ago

What happened?

Hi Team,

I was using Havoc and everything was going fine before I decided to create a socks proxy to enumerate the domain using Bloodhound.py. I did it before on testing environments and everything worked fine.

This time, while the socks proxy was up and running, I decided to change a couple of times the sleep of the demon. After that, I'm not able to contact the demon anymore with any command. Restarted the team server, and even removed client.db and teamserver.db in a desperate way to recover something (the logs showed below, are much before removing the files). But the demon is constantly posting back the backend without being able to recover or kill it.

Find below the logs that I find are more representative to find the problem.

From there, the logs constantly repeats the last 3 lines.

Any insight about to recover the agent, killing it, or preventing this to happen again?

Thanks in advance.

Did You Try With the Dev Branch?

I'm using Dev branch from June 24th.

Relevant log output

Nov 25 11:07:38 <redacted> sudo[387116]: [11:07:38] [DBUG] [agent.(*Agent).TaskDispatch:2661]: Agent: 207b49c8, Command: COMMAND_SLEEP, SleepDelay: 1, SleepJitter: 0
Nov 25 11:09:07 <redacted> sudo[387116]: [11:09:07] [DBUG] [agent.(*Agent).TaskDispatch:2661]: Agent: 207b49c8, Command: COMMAND_SLEEP, SleepDelay: 10, SleepJitter: 0
Nov 25 11:12:47 <redacted> sudo[387116]: [11:12:47] [DBUG] [agent.(*Agent).TaskDispatch:2661]: Agent: 207b49c8, Command: COMMAND_SLEEP, SleepDelay: 1, SleepJitter: 0
Nov 25 11:13:41 <redacted> sudo[387116]: [11:13:41] [DBUG] [agent.(*Agent).TaskDispatch:2661]: Agent: 207b49c8, Command: COMMAND_SLEEP, SleepDelay: 0, SleepJitter: 0
Nov 25 11:14:07 <redacted> sudo[387116]: [11:14:07] [DBUG] [agent.(*Agent).TaskDispatch:6018]: Agent: 207b49c8, Command: COMMAND_SOCKET - SOCKET_COMMAND_CONNECT, Id: e25c50e1, Type: 2, Success: 0, ErrorCode: 10060
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [handlers.handleDemonAgent:84]: Agent: 207b49c8, Command: DEMON_INIT
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [packer.(*Packer).Build:87]: No Aes Key specified
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [handlers.handleDemonAgent:95]: reconnected 2d5b834f
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [handlers.handleDemonAgent:84]: Agent: 207b49c8, Command: DEMON_INIT
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [packer.(*Packer).Build:87]: No Aes Key specified
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [handlers.handleDemonAgent:95]: reconnected 2d5b834f

Did You Read Over Your Issue First?