MythicC2Profiles / http

Simple HTTP async comms using standard GET/POST requests
29 stars 15 forks source link

Agent doesnt execute without AES #18

Closed A-Lazar-A closed 2 months ago

A-Lazar-A commented 2 months ago

Hello, I want to see plaintext checkin and exucute commands with Merlin Agent but had this issue

[DEBUG]Entering agent.New() function
[i]Host Information:                                                                                    
[i]     Agent UUID: 6c354f7a-e923-4835-8543-88417e9ce33c                                                
[i]     Hostname: kali                                                                                  
[i]     Platform: linux                                                                                 
[i]     Architecture: amd64                                                                             
[i]     PID: 58524                                                                                      
[i]     Process: /home/kali/mythic_agents/merlin_http                                                   
[i]     User Name: root                                                                                 
[i]     User GUID: 0                                                                                    
[i]     Integrity Level: 4                                                                              
[i]     IPs: [127.0.0.1/8 ::1/128 192.168.0.194/24 fe80::3ec7:b883:7a3c:da23/64 172.17.0.1/16]          
[DEBUG]Leaving agent.New function                                                                       
[DEBUG]Entering into clients.mythic.New()...                                                            
[DEBUG]Config: {AgentID:6c354f7a-e923-4835-8543-88417e9ce33c AuthPackage:rsa PayloadID:6c4ec365-70b7-4fe9-8f43-36539add67e8 Protocol:http Headers: Host: URL:http://192.168.0.134:80/data Proxy: UserAgent:Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko PSK:%!s(<nil>) JA3: Parrot: Padding:4096 InsecureTLS:true Transformers:mythic,aes ClientType:go}                                                       
there was an error Base64 decoding the PSK:                                                             
illegal base64 data at input byte 0  

Here some info from config

"c2_profile_parameters": {
                "AESPSK": {
                    "dec_key": null,
                    "enc_key": null,
                    "value": "none"
                },

With AES it works fine btw

A-Lazar-A commented 2 months ago

I dont use parrot as Merlin says

"build_parameters": [
        {
            "name": "verbose",
            "value": true
        },
        {
            "name": "debug",
            "value": true
        },
        {
            "name": "arch",
            "value": "amd64"
        },
        {
            "name": "maxretry",
            "value": "7"
        },
        {
            "name": "padding",
            "value": "4096"
        },
        {
            "name": "ja3",
            "value": ""
        },
        {
            "name": "garble",
            "value": false
        },
        {
            "name": "buildmode",
            "value": "default"
        },
        {
            "name": "httpClient",
            "value": "go"
        },
        {
            "name": "parrot",
            "value": ""
        }
Ne0nd0g commented 2 months ago

@A-Lazar-A When using Merlin w/ Mythic, there isn't currently a way to not use AES encryption. However, I can help you see plaintext information, depending on what exactly you want to see.

The issue you are describing is with Merlin itself, not with this http C2 Profile.

I've transferred this issue to the Merlin repo for further discussion and tracking. https://github.com/MythicAgents/merlin/issues/20