search

MythicAgents / sliver

Sliver agents for Mythic
33 stars 3 forks source link

can't get into a session with "use" #3

Closed shortcutmaniac closed 3 months ago

shortcutmaniac commented 6 months ago

When looking at sessions i can see one session alive:

ID Transport Remote Address Hostname Username Operating System Health

0019fdeb-33f0-4bae-9f56-3183e2911b2c http(s) 192.168.100.33:56243 student33 US\studentuser windows [DEAD] 36dfd761-44b9-4a66-92d3-a5a2bdae1bc2 http(s) 192.168.100.33:49965 student33 US\studentuser windows [ALIVE]

trying to interact with it:

error: creating task - check task stdout/stderr

use {"id":"36dfd761-44b9-4a66-92d3-a5a2bdae1bc2"}

same with beacons, in sliver it is working. Cloned Mythic, Sliver-Mythic Agent and Sliver today so everything is up-to-date

spenceradolph commented 6 months ago

This agent is still very unstable as I'm adding all of the functionality, and also I should probably also be testing against windows implants as well.

What does the stdout/stderr say in the task? There should be a way to view that information after clicking the settings wheel icon at the right of the task.

spenceradolph commented 6 months ago

This area of the code is likely at fault. https://github.com/MythicAgents/sliver/blob/b8c0fb2e2a090740095cee335524b998d724d891/Payload_Type/sliverapi/sliverapi/agent_functions/use.py#L108

spenceradolph commented 6 months ago

@shortcutmaniac With the latest push (tagged v0.0.0.16), I am able to use windows implants. Also, if you already have sliverapi hooked up, it will now automatically show available sessions as they connect in Mythic, so no more need to 'use'. When a disconnection happens, that will also auto show in the description.

I'll also be working to get that auto-callback working for beacons, but I've also tested and they still work with 'use' like normal.

windows_working