Ne0nd0g / merlin

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
GNU General Public License v3.0
5.06k stars 801 forks source link

arm5 merlin agent cross compile throws error 404 when registering to Merlin server. #110

Closed h00die-gr3y closed 11 months ago

h00die-gr3y commented 3 years ago

Hi There, Let me first share my appreciation for your work. I have been exploring C2 post exploitation frameworks and I really like Merlin and the ease of use and deployment. Great Job and continue the good work !

I have been playing around with the Merlin framework and tested out multiple agent scenarios. I am running Merlin on a raspberry PI (arm64) architecture as a binary.

So far I did not run into any issue with the agents provided (arm, mips, x64, darwin etc...), however I have one use case that throws an error that I do not understand. Let me explain. I have cross compiled a new agent to support the arm5 Linux architecture. I have a NAS box that runs this Linux version.

Linux 2.6.32.12 #3259 Wed Jun 14 10:02:56 CST 2017 armv5tel GNU/Linux

So I cross- compiled an agent with the following settings that I took from the Makefile in the merlin-agent directory.

export GOOS=linux;export GOARCH=arm;export GOARM=5;go build -trimpath -ldflags "-s -w -X main.build=70c07d5831774f1f271ca9f6420c2c0ee66d3a2c -X github.com/Ne0nd0g/merlin-agent/agent.build=70c07d5831774f1f271ca9f6420c2c0ee66d3a2c -X main.protocol=h2 -X main.url=https://192.168.201.19:443 -X main.host= -X main.psk=merlin -X main.proxy= -buildid=" -gcflags=all=-trimpath=/root/go -asmflags=all=-trimpath=/root/go -o bin/v1.0.1/70c07d5831774f1f271ca9f6420c2c0ee66d3a2c/merlinAgent-Linux-arm5 ./main.go

After running the agent on my NAS I see the following errors at the agent level:

UNIXNET_NAS> ./merlinAgent-Linux-arm5 -v -debug -url https://192.168.201.19:443 [DEBUG]Entering agent.New() function [i]Host Information: [i] Agent UUID: 25f7ae6d-9054-4528-aea1-57d51abdd6dc [i] Platform: linux [i] Architecture: arm [i] User Name: root [i] User GUID: 0 [i] Hostname: UNIXNET_NAS [i] PID: 29135 [i] IPs: [127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] [DEBUG]Leaving agent.New function [DEBUG]Entering into clients.http.New()... [DEBUG]new client PSK: merlin [DEBUG]new client Secret: f6274d9892026fe47dd5f96f708ef8983dccc7bacf5ee4a90b2400805adaea0a [DEBUG]Entering into clients.http.getClient()... [i]Client information: [i] Protocol: h2 [i] URL: https://192.168.201.19:443 [i] User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36 [i] HTTP Host Header: [i] Payload Padding Max: 4096 [i] JA3 String: [-]Agent version: 1.0.1 [-]Agent build: 70c07d5831774f1f271ca9f6420c2c0ee66d3a2c [DEBUG]Entering into agent.getAgentInfoMessage function... [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: paddingmax [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: protocol [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: ja3 [DEBUG]Returning AgentInfo message: {Version:1.0.1 Build:70c07d5831774f1f271ca9f6420c2c0ee66d3a2c WaitTime:30s PaddingMax:4096 MaxRetry:7 FailedCheckin:0 Skew:3000 Proto:h2 SysInfo:{Platform:linux Architecture:arm UserName:root UserGUID:0 HostName:UNIXNET_NAS Pid:29135 Ips:[127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] Domain:} KillDate:0 JA3:} [DEBUG]Entering clients.http.Initial function [DEBUG]Input AgentInfo: {Version:1.0.1 Build:70c07d5831774f1f271ca9f6420c2c0ee66d3a2c WaitTime:30s PaddingMax:4096 MaxRetry:7 FailedCheckin:0 Skew:3000 Proto:h2 SysInfo:{Platform:linux Architecture:arm UserName:root UserGUID:0 HostName:UNIXNET_NAS Pid:29135 Ips:[127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] Domain:} KillDate:0 JA3:} [DEBUG]Entering into clients.http.opaqueAuth()... [DEBUG]Entering into agent.opaqueRegister [-]Starting OPAQUE Registration [DEBUG]Entering into clients.http.getJWT()... [DEBUG]Entering into opaque.UserRegisterInit... [DEBUG]OPAQUE UserID: 25f7ae6d90544528aea157d51abdd6dc [DEBUG]OPAQUE Alpha: 545ad6c3067a8e569498d45fc5120159b01afa0ab9a0ce4b98828223de63c5ca [DEBUG]OPAQUE PwdU: d7e8c7d4c4d17bb36fb18d8daa36c1dc2efa84a12b3f6a1da446c0d1e6baba5d [DEBUG]Sending OPAQUE RegInit message [DEBUG]Entering into agent.sendMessage() [-]Sending OPAQUE message to https://192.168.201.19:443 [DEBUG]Sending POST request size: 6052 to: https://192.168.201.19:443 [DEBUG]HTTP Response: &{Status:404 Not Found StatusCode:404 Proto:HTTP/2.0 ProtoMajor:2 ProtoMinor:0 Header:map[Content-Length:[0] Date:[Sat, 19 Jun 2021 08:55:49 GMT]] Body:{Reader:0x8f45e0} ContentLength:0 TransferEncoding:[] Close:false Uncompressed:false Trailer:map[] Request:0x874f00 TLS:0xadc1e0} [!]there was an error performing OPAQUE User Registration: there was an error sending the OPAQUE User Registration Initialization message to the server: there was an error communicating with the server: 404 [-]1 out of 7 total failed checkins [-]Sleeping for 31.029s at 2021-06-19T09:06:35Z

On the server level, I see the following errors with verbose and debug turned on:

Merlin[listeners][Default]» [!] Received HTTP/2.0 POST connection from 192.168.201.3:34930

[DEBUG] HTTP Connection Details: Host: 192.168.201.19:443 URI: / Method: POST Protocol: HTTP/2.0 Headers: map[Accept-Encoding:[gzip] Authorization:[Bearer eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..wmAUhr9REDEtC12d.hF7NlblERsJA7OQAUZIaaxQrg_BYj3AAW2yjrp3bARrhAl4736Pw__Y9uD8DkhU7EBlBot1CMtarQJL6JCyuOXk1wnmxhRt0bN3aRVqZKHb93tb8iwHacreIgd4tJEIa8Ih5DwwtWcxrOKcuEbLiMYzDj_9wvd6B3W1nuHDzedw7GR9hhQNQAvJZFcl3MYUJi9YoebysvFTys3R615rGmxchlwWxnwPSFQWXgVdlu_2W7XUN1OZdyV4a108.grSVwwZ4k6hq5ysJ2PfaLg] Content-Length:[6052] Content-Type:[application/octet-stream; charset=utf-8] User-Agent:[Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36]] TLS Negotiated Protocol: h2 TLS Cipher Suite: 4867 TLS Server Name: Content Length: 6052 [DEBUG]Entering into jwt.ValidateJWT [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..wmAUhr9REDEtC12d.hF7NlblERsJA7OQAUZIaaxQrg_BYj3AAW2yjrp3bARrhAl4736Pw__Y9uD8DkhU7EBlBot1CMtarQJL6JCyuOXk1wnmxhRt0bN3aRVqZKHb93tb8iwHacreIgd4tJEIa8Ih5DwwtWcxrOKcuEbLiMYzDj_9wvd6B3W1nuHDzedw7GR9hhQNQAvJZFcl3MYUJi9YoebysvFTys3R615rGmxchlwWxnwPSFQWXgVdlu_2W7XUN1OZdyV4a108.grSVwwZ4k6hq5ysJ2PfaLg

[-] Checking to see if authorization JWT was signed by server's interface key...

[!] there was an error decrypting the JWT: square/go-jose: error in cryptographic primitive

[-] Authorization JWT not signed with server's interface key, trying again with PSK... [DEBUG]Entering into jwt.ValidateJWT [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..wmAUhr9REDEtC12d.hF7NlblERsJA7OQAUZIaaxQrg_BYj3AAW2yjrp3bARrhAl4736Pw__Y9uD8DkhU7EBlBot1CMtarQJL6JCyuOXk1wnmxhRt0bN3aRVqZKHb93tb8iwHacreIgd4tJEIa8Ih5DwwtWcxrOKcuEbLiMYzDj_9wvd6B3W1nuHDzedw7GR9hhQNQAvJZFcl3MYUJi9YoebysvFTys3R615rGmxchlwWxnwPSFQWXgVdlu_2W7XUN1OZdyV4a108.grSVwwZ4k6hq5ysJ2PfaLg [DEBUG]there was an error getting the agent's wait time: 25f7ae6d-9054-4528-aea1-57d51abdd6dc is not a valid agent [DEBUG]Agent wait time: [-]The returned Agent wait time was empty, using default 60s [!]The JWT claims were not valid for 25f7ae6d-9054-4528-aea1-57d51abdd6dc [-]Agent Wait Time: 60s, Time now: 2021-06-19 08:55:49.670379755 +0000 UTC m=+1715.102568524 [-]JWT Claim Expiry: 2021-06-19 09:06:16 +0000 UTC [-]JWT Claim Issued: 2021-06-19 09:06:06 +0000 UTC

[-] Authorization JWT not signed with PSK, returning 404...

As I said, all other agents so far which I cross-compiled (Darwin, Linux-x64, Linux-arm7) do not have this issue, only the arm5 agent. To ensure that the problem in not related to my NAS box, I tested the agent on another arm5 Linux target and ran into the same issue.

Prerequisite

Expected Behavior

Actual Behavior

Steps to Reproduce Behavior

Misc Information

Ne0nd0g commented 3 years ago

The problem appears to be that the time on the server and the host where the agent are running are not synchronized. The JWT was issued "in the future" from the server's perspective and therefore is invalid. The Agent issued the JWT at 09:06:06 but was evaluated on the server at 08:55:49.670379755. There is almost an 11 minute time difference.

h00die-gr3y commented 3 years ago

Hi Russel, Thanks for the feedback. Indeed the time on my NAS box was not synced. I did another run where I synced both my Linux Kali server and the NAS server with ntp to ensure that they are having the same time.

> Merlin» date
> 
> [i] Executing system command...
> 
> [+] Wed Jun 23 12:40:14 CEST 2021
UNIXNET_NAS> date
Wed Jun 23 12:40:18 CEST 2021
UNIXNET_NAS>

I did the same run again but it throws me the error 404 with the both servers have the same time synced with ntp. As I said, I have this problem only with the arm5 agent.

Merlin ARM5 Agent debug output: UNIXNET_NAS> ./merlinAgent-Linux-arm5 -v -debug -url https://192.168.201.19:443 -psk merlin [DEBUG]Entering agent.New() function [i]Host Information: [i] Agent UUID: 546d32c9-9a89-45d3-bbba-9f58bfae8632 [i] Platform: linux [i] Architecture: arm [i] User Name: root [i] User GUID: 0 [i] Hostname: UNIXNET_NAS [i] PID: 30034 [i] IPs: [127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] [DEBUG]Leaving agent.New function [DEBUG]Entering into clients.http.New()... [DEBUG]new client PSK: merlin [DEBUG]new client Secret: f6274d9892026fe47dd5f96f708ef8983dccc7bacf5ee4a90b2400805adaea0a [DEBUG]Entering into clients.http.getClient()... [i]Client information: [i] Protocol: h2 [i] URL: https://192.168.201.19:443 [i] User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36 [i] HTTP Host Header: [i] Payload Padding Max: 4096 [i] JA3 String: [-]Agent version: 1.0.1 [-]Agent build: 70c07d5831774f1f271ca9f6420c2c0ee66d3a2c [DEBUG]Entering into agent.getAgentInfoMessage function... [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: paddingmax [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: protocol [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: ja3 [DEBUG]Returning AgentInfo message: {Version:1.0.1 Build:70c07d5831774f1f271ca9f6420c2c0ee66d3a2c WaitTime:30s PaddingMax:4096 MaxRetry:7 FailedCheckin:0 Skew:3000 Proto:h2 SysInfo:{Platform:linux Architecture:arm UserName:root UserGUID:0 HostName:UNIXNET_NAS Pid:30034 Ips:[127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] Domain:} KillDate:0 JA3:} [DEBUG]Entering clients.http.Initial function [DEBUG]Input AgentInfo: {Version:1.0.1 Build:70c07d5831774f1f271ca9f6420c2c0ee66d3a2c WaitTime:30s PaddingMax:4096 MaxRetry:7 FailedCheckin:0 Skew:3000 Proto:h2 SysInfo:{Platform:linux Architecture:arm UserName:root UserGUID:0 HostName:UNIXNET_NAS Pid:30034 Ips:[127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] Domain:} KillDate:0 JA3:} [DEBUG]Entering into clients.http.opaqueAuth()... [DEBUG]Entering into agent.opaqueRegister [-]Starting OPAQUE Registration [DEBUG]Entering into clients.http.getJWT()... [DEBUG]Entering into opaque.UserRegisterInit... [DEBUG]OPAQUE UserID: 546d32c99a8945d3bbba9f58bfae8632 [DEBUG]OPAQUE Alpha: db8b63fab0c60633de8232cef8e268f9c7156f64f7562217bb8242cbc5e8c22b [DEBUG]OPAQUE PwdU: 05ba3c4b86ffabf464b3e1fcb090f5cc2974aaf01eccde87635ca2b73f8da110 [DEBUG]Sending OPAQUE RegInit message [DEBUG]Entering into agent.sendMessage() [-]Sending OPAQUE message to https://192.168.201.19:443 [DEBUG]Sending POST request size: 6052 to: https://192.168.201.19:443 [DEBUG]HTTP Response: &{Status:200 OK StatusCode:200 Proto:HTTP/2.0 ProtoMajor:2 ProtoMinor:0 Header:map[Content-Type:[application/octet-stream] Date:[Wed, 23 Jun 2021 10:35:47 GMT]] Body:{cs:0x8ee630} ContentLength:-1 TransferEncoding:[] Close:false Uncompressed:false Trailer:map[] Request:0x874f00 TLS:0xb040c0} [DEBUG]Entering into opaque.UserRegisterComplete... [-]Received OPAQUE server registration initialization message [DEBUG]OPAQUE Beta: dc7a9cb299d87c0b983d47fc725c023bff8dd61a7bec9950fdf7fd590e80cead [DEBUG]OPAQUE V: 6770de6a1472116ff26b2066e47b35567f8684013b369fab3b2ee2d3f1cffe63 [DEBUG]OPAQUE PubS: accee7e2c55d1bacdbb6498af558f26539178ca2c811c093ca005aeb8c4e175c [DEBUG]OPAQUE EnvU: a28625a4a69aa7ccaa8de076b70d7590e2e56b6d3f94fc6be8c7893db9224004752ee9c403885940751e05de4babe4a76557e8b935fa90dbc5f41f9c29f0a307e660ebadde31e6f76262f48eb47f8aae23364dbfbfc47d99810fbabbf23c5930f7a49ff5520da879d4998ea5e7dc827316088eae7ffc4fd6db3b75272b24a999 [DEBUG]OPAQUE PubU: 9d52ad112859ec6cd75f26c212143bd0ab236daa926d164e2d852e326ce8d656 [DEBUG]Sending OPAQUE RegComplete message [DEBUG]Entering into agent.sendMessage() [-]Sending OPAQUE message to https://192.168.201.19:443 [DEBUG]Sending POST request size: 6209 to: https://192.168.201.19:443 [DEBUG]HTTP Response: &{Status:404 Not Found StatusCode:404 Proto:HTTP/2.0 ProtoMajor:2 ProtoMinor:0 Header:map[Content-Length:[0] Date:[Wed, 23 Jun 2021 10:36:44 GMT]] Body:{Reader:0x8f45e0} ContentLength:0 TransferEncoding:[] Close:false Uncompressed:false Trailer:map[] Request:0x875d80 TLS:0xb045a0} [!]there was an error performing OPAQUE User Registration: there was an error sending the OPAQUE User Registration Complete message to the server: there was an error communicating with the server: 404 [-]1 out of 7 total failed checkins [-]Sleeping for 31.826s at 2021-06-23T10:36:46Z

Merlin Server Debug output: [+] Debug output enabled Merlin» Merlin» [!] Received HTTP/2.0 POST connection from 192.168.201.3:48042

[DEBUG] HTTP Connection Details: Host: 192.168.201.19:443 URI: / Method: POST Protocol: HTTP/2.0 Headers: map[Accept-Encoding:[gzip] Authorization:[Bearer eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..xLjCpym9WJeuSQYT.1TWRMbVFFWZ69KDcgqhePpDyNUS157zwJ-tIUCJHDPuxd3VaCGJT8b2JtNd1vZe0LMjwyRP6zom8EqzpeWUeOwyKq4UUjRDo_wa-r02evQ2zJEDUcRn3EsmOWM545ngmJ_uo1YzhOcaGhhWE7mwMeDLLP_54ktrEttqWuecPrsO63Rp3hB8djarRCyljPu1sLQGI0Rfse8Ueq-kew1-rCDPMHiabD4brBN5HPEcCWzkTh8BwMyLTPoJj-QY.EA1A50HGjsyvNn-l5uGRGg] Content-Length:[6052] Content-Type:[application/octet-stream; charset=utf-8] User-Agent:[Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36]] TLS Negotiated Protocol: h2 TLS Cipher Suite: 4867 TLS Server Name: Content Length: 6052 [DEBUG]Entering into jwt.ValidateJWT [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..xLjCpym9WJeuSQYT.1TWRMbVFFWZ69KDcgqhePpDyNUS157zwJ-tIUCJHDPuxd3VaCGJT8b2JtNd1vZe0LMjwyRP6zom8EqzpeWUeOwyKq4UUjRDo_wa-r02evQ2zJEDUcRn3EsmOWM545ngmJ_uo1YzhOcaGhhWE7mwMeDLLP_54ktrEttqWuecPrsO63Rp3hB8djarRCyljPu1sLQGI0Rfse8Ueq-kew1-rCDPMHiabD4brBN5HPEcCWzkTh8BwMyLTPoJj-QY.EA1A50HGjsyvNn-l5uGRGg

[-] Checking to see if authorization JWT was signed by server's interface key... [DEBUG]Entering into jwt.ValidateJWT [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..xLjCpym9WJeuSQYT.1TWRMbVFFWZ69KDcgqhePpDyNUS157zwJ-tIUCJHDPuxd3VaCGJT8b2JtNd1vZe0LMjwyRP6zom8EqzpeWUeOwyKq4UUjRDo_wa-r02evQ2zJEDUcRn3EsmOWM545ngmJ_uo1YzhOcaGhhWE7mwMeDLLP_54ktrEttqWuecPrsO63Rp3hB8djarRCyljPu1sLQGI0Rfse8Ueq-kew1-rCDPMHiabD4brBN5HPEcCWzkTh8BwMyLTPoJj-QY.EA1A50HGjsyvNn-l5uGRGg

[!] there was an error decrypting the JWT: square/go-jose: error in cryptographic primitive

[-] Authorization JWT not signed with server's interface key, trying again with PSK... [DEBUG]there was an error getting the agent's wait time: 546d32c9-9a89-45d3-bbba-9f58bfae8632 is not a valid agent [DEBUG]Agent wait time: [-]The returned Agent wait time was empty, using default 60s [DEBUG]agentID: 546d32c9-9a89-45d3-bbba-9f58bfae8632 [DEBUG]Leaving jwt.ValidateJWT without error [DEBUG]Entering into jwt.DecryptJWE function

[i] UnAuthenticated JWT [DEBUG]Input JWE String: eyJhbGciOiJQQkVTMi1IUzUxMitBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIiwicDJjIjo1MDAwMDAsInAycyI6InVKb2J0UlpRN0RPLXU3U1JmOHhURVEifQ.JfDDvh0kDOUFdOg68v-GA66_PD5vL8Px06dOivNiu_e8WhhFYATbuw.fFm90PnpeEZGtqL3.A3Kj1SvFhlszvuxACzDiReTN6svts0mUvHeMVFe32h_X8xy-UF3k6hemxCG3vNUR8rBAk47xdFRUSLVA5gzQgpuIi962Sl5IRFXWAX7L64O5IBVhW46CQPfmmkiKDuh5Ek8uGprZudz-jJ_G9aZmqn3xbE8aj2GOsig0datRHWN1wITG39-qB4anGH-P-vldn00ultv2MO0zynGqWf7oRtl9KmpiL3AeVCNCbl2eoy2b9p0aeu7aGnTKUXNagUqU0CL56FI-vXX1eQjIbkKRrvBQa4pow0dPgn54fjR4AmzVSVQqeP-EG3SKFMY36N57D_MIFPNwa4UdtK2RiA1sKuzXqkVUIGcrhMyS1NFM5WB7kJ0TMoW2l9AD8iNzERHam_vPDC0kvTcnF4SSDNo60oUJ1lOyFf7HtzSw2lMUwa04cYhCoR3biarJFT0AbwBHUWfNvh92Qq1LI7s12z35v-3tlPuTPcd6CKBMyRwaXdu3gnvJAgc6KcsEXAR0qNgvS9bqn12n4a3a3pAbk_cwBeGlPbzJAEVWmjNHU4QBQ9XmZ7xMHmihmjFxMcVzN0tHN44r-K0-AQyUUeLFi6tjqTin-vm19USUOs3NTpc4EyX1w_APv3vCX8vuNacYN_a_4dwTPP8phrZSAAGzz3Ff2w96AaU3d9oUUEnJBvfkN4qG9cRTr3T8K4EjDrYQh2Qq2q1gPWOmRQUH-dRPYJJE6B_BY86uq64F-SyuWBfh-KN8-PwTreMbDCqEIQMscdlEZA1pY1OJ6xnhJLOBryhcet4INDF_1NJwez4HiGuKU_yGt1OvZJslfkSGDjfVZ3yHdR9Pq2RPH1utpdkG2mPpo0AdCrasKsyCI_9qV15JVr-F7IhulPfajBNfvXxbYhEmkT-SJ0G9FB_cqoWSyBL2GxruWYovpbSkiW4xzAQ-4mlxdVTz9kB6ZMf_E_eaeG8lKn9NMIEI50U5tjGU_peUaLh7lfqdRfzsznHIfXoxZWbb52mq75nG3UIR1uwXCimYUe09jAK1WKuYUk1dYfWldxob1zCzvrRqaqVJllRDNrY-IzsVqMKSNHCA-yK0AnJV_tU2PP4ivHsDMGeVr7rIXIWNCjXKaxoEB6LLDZlfKpP-cNgPtlEy5as0jEVtXEmZO5Ae1jv6EGbcjZ9ZUdYOYOVAZnL_eFexLn2TE8jMHZnm1jVZG10yRdLfVWcpex_mevWilc7TvwTWk_KR0fDGlS5_phKcjfaSlxm5Lxc7DKL3f6czpt86S1mTKKrsBgW3DVH82x1Pl5It4c4RKQ8odgyxlCfaLBYLJTFD6aB273UdDFkW4ewa1U-cQzHTO2XeoTbl4Vx-9lvuIZOUWJIAKodp5i9z41z7kHlYDbW817KADrSmZ8CBHpLmIuD2wLTq_HdkiSxtCiN9EkY4ZQw-VHeWRCqRrME_PGU4p2qoNC80qKwGENT9lLFr-6fuez64gjf8WFTacCBB8MOZUw_aEv_YLcXG9p52Vvolftc54tP5UtJtY9XqCZuFHteKHIIs8Ln7Bvrw6ZMDhM8eXHN6zZwE126dVatdm_yLBrawgN_l58h6XGQ0UGN1hxTMGUIVTh_NPLCHhWpgqSLhcYXsOF8XCdtx0exz4IWHgwQtO3Xf84saBRQZVwJ0OyMad7IaJud74rUNJRMhyGkKJf0qqug8eohiQ5zt0AfSm8CwS9PKSBhi6YpLRjdQcgkcGb3iuBfExcotzddyIAx3jON-oyr7VvZupXQfsuBR6EV4JTekTEHw53aaFrF53M-VEpDKvDKC5NQ7aZCl4fId73t-J4A1jxxYuUR84zWdELdAfLSspvmopiYmFc8di-2OWb5dr3akL4fJTTdg6CgdYnx-o4-yAEosincuP3TMyD9mhNJWLG7kQOrsJ8KJxDi4EI3RTuly8LiGJc7O9X1UQlKkTGkZjs0c2CE6_jIJS2a0CdxIitUtdiL6SOlbRFcTXrG1mHhyhmHweVXhqOul3LB5cZtURcw25wBqIId1_mb2mOkjjbOEjDgIhNSpFtbLt2K0dwEjAOCTSiGF8OylW4sX9f0__d1Seu3goNrW8x9euQAEY2Wm_7HvZceeEr87PddeSeMFE15V3az4qF9-CTgoJqmx2etIWbfxp06XB9zBp7495CzlZgS2ff94kVIOVZYz2U52jfF91BM-qb2g5RyFakIzbmBapEHXOOfQhIbUMu-iTMoV-wnoxmO1wkdNhVgVpJve12aTgmOcWaLZEj5yMqGLoap4RG4FMm6ewXcW4RCX3Ka8Wz0UvHRT97KNpjVdWdY_vAY-CpPu461XOpcL50cRsQT2MyhshRzMlz9RQNN8suzWiA1TiLlRJqZNV9FW94_h8ah_Ud_uZ0GbuiZGQZ7HTu_S_MG68lF81uwoL5KHovabsCVSzM0pc5EZKQbUiMMcmelOwqvLtAaFI67DLNlu7X5nyd_Wvis4t3d3Zt7O5zlw_v9QYU9kIrhLUySfG1T1_1TmB88cvac7jOCjhqvYAHbjqJr2oEkhAOXQH3-jRikk_e073QeFs4NzzJnaghMcsxeGxtgCcQAMCygs4eXfsU1J_ZvgauW9aCUKt490BRza6uIxkJERZqW6KYQSQek8SjPd5917KtiSECOwO_KYMHSLcZlJRKAHms4tgaVjt0RulCAtshVQ6xCvhTzbmJvmvMbr52UqWCiL8lsi26Xm9MisN5DTT1wj9fWWSmZ9LlrYbusoJaePvKDGQi48ZyrbV3wGYj8D22vbG5sLq72hqdNBQdbjQlswj7MkzdkrnNJWmhvrbqKGAy2nhY1BLQnk_oDeSs_ki-bnupmeDhx96ID5VGd0nOwM_UAImXgaxZqVwD732YwPUyfFy5u6FezJH2jP4xmB54H7OpKCuQFpW--8WjUnUQYCMSBqopeccIGclRnHJbXTXel2nXdifYQLQ9hfTAe7NvgxSdxk0iYcRPB8L-IAVUK9h4F8YlktNg68OEtzBjH4f6FmKQcnE9L_UwklN4HEIzF_1l4K5Y-oEY6krpMFZeR6fcudokYTIPrN2ytWwg9pYyl9rMEQ2YCodZEh87lojvWgCXxndVG8d1RRJ-68rI84RGsRXm6E-mJW_3DynuFpuOWR9h6V7h6O9YgHv1eFHMkZU0fZO76kEzok3CfjLUrebjuGOejIQfQ1a3ta79gG1yF-uUZ8BZOo6h_PPRG-OIrD8CypnZoiHjarHSy0I6GO3g6EcV7x0rqvhCzW-5CarItYq9onJrRZrfKL-izRuDLPJbJoiHfQTC84LNsd5ZCheAlX5G3S954Ge3zqj9Uma6yneDxZYYARIgdj8IQDmgb-5cwB0Fbn-rWvGibNeOqIbuVsXtTBdAjt-k0G_h56qWDO9juU42RP9_cE5XE_w_aYL4C2TnG5hWNtxFI8dNrhBNPAHE5ySbeR-VLXEmelIH0kEMGxARqISkkHS0sllpi9h_aQTfIePh8OFAF9POB36EpYPQE17mlhgYMEPpAENYsH9c9CRkT9dMqJF0nuaEDb99sCb6RSq71KNqMLCTD43y2dZrbu7_uMd0ZW-tfgYwxN6ct7u14UokpwzyPdP8ievm9TC9MM06p7hlHqE-OBeTKx6l3VZ1-H1njxZErewInVu16GxOyc-SYcDQRLhyzERCXNPKSbxeNaDVroZHSv30C-uYQc5VbT2nVYewPrOh-4qr75E6fthGN8wYT9gOSnRXi3RbywEyQaB_Sxzgi7JgEaw8_xRqXnvvVjqlVOSshPmQo8l-tf_2stNE0PSii545X7EzKNAhjbBbO8Wwoo4mom0Dlq9Gt6Mrt-vX-8vyGoL4QoB4Z8F-QCzNMfoL-euLcjRZhmXFPJsCx-ZHEMpqG_iogTPceogZrSjTFne8Dw6Le4p74RMt-Y83FHEQUm9ZHLsYWiYHtTAw5wzneGYk7AMaaduYI36tw2-YShk2fDilp-dbx9paPErAKkIyHQH0om-qE7OF3T95q71nt7IXinPquzUwAJNqk5zL26E3gquMskxf2popLKXOmABHBs188CZ8g23t0Kdm1krG5BXTtdG-YWPE2M3sjz3mkCFfK9msebXMPh4iVyfccknpnsYPgjstmZjwqrGsL4xP-MXQ9Afz8CnzF0pOfOvflsl28A3mm0hFg_bNvZZ8ta23F_CfCE3Dl93hcs8_0NDn-VzRSkh6wI2joKZczwllfKyz93j4GWukgGysTCiezfrdUt4_YRVSJ8WR5lmTzwKgm28v3yxFya5nYdkYKnM6zrQB0av2oJeKRpyNA1ASIzb41IVOhULmnCks960vS-N5cN5d3Rw9PQJ5NlOE_rxXNPEVEawuyJeIFSuZGlzn1xS2LNBNPmFASmUa8XnYsukHhOLTpXWH_NapSn1YH7TG0vqvpXjA5FSVpKj6RLOJrJ21n5YDc3IORD-YQF61VmPFuk5zv9sSr5ObxWFmdAxAN676BQFEEIvHRo2PaxjO4cLk7ZdWFFKGhEeJ1Q4Xll7YB7DcIea3jmB3GOgfTRJUoHm6J3okj9jPTTpDa62W9u-Qtqrb9vAcJdYBqCHKtUPeH25BySxkhOvPNEKsuNJDEHqufPpB9I40kl0KnIApTkrWc5oNcb0H8jRG2pkWSfo0NcDygc4WLzN5Cp9JOkrhEKeoukjPUQMbCclxE34BUQYOlCoF5PVdwnE3huBIHLnlJYdleesOQXmZoswwpzjR3obisfboIJ5KIr9vXgP2MnHsKmqBuzDuHl-Gcabjcn1YB1gzMhTPpSADPt_GfniqfwCXGg7Tzx09SOSeUisbDEdu79uhz0M-vQDn4xyzeGs6-nJolJWBOXvBhtpbG5Fy5qp4fJyUC01hh3m_aO-2bB-uOMbAFYAAtLc3CwxqlTBeAP7iILWOsd9nFvr9aAaz8dl3WDUv0_bhCNxbA8CUdBCXls4kn2tXprZ4iggTOqxrLviVZ1zyLZd0hch41zG-QOyZG7l9hEYNfEGkJh2nWlSOzxgch-HgjjPPcOLs0PWjH50qBj-oJQGXcfSPD_v914SwHcGotai2eSN-UUql2MRcH4jeOGRLJVtfgQT0ItR4G4o-FJ-EyGxfhK1W0itH-C9r-r_k87VZxAfquz6RP9YnoxQRDPGbAnQKHFyShwIi6daAhz5yHPA3FSpl4NKGkhIW3COGyvypyFDPl3saUcQHLgb03VCFahggi31f6xIC7WA-S2Vy8v4LrjbujOue3J4ColtugkQ2Rh9939orXywJoypeF0dQPSzWNT-8su0WgDexUIDSz0hAHKL5OZWxEpJC_4J0Gk9GDPpmDWOwaXBzldzzdLP7cwtdSRRZGtn_kzJqkt9QRFCt-SFFQg-Xj5-X6NMxiv9h2v-drfThJ24J8z3dEIxDEVTVF96ZfrGKyoVwCzMo57yhiI5jRaR3G3OuAAkRatSypvhP7a7Jw4IAAXpwljMpNsvpEmGCKQ8RK8Qskv7excyf6Wu50vfJPoGF4PRPZ72h-Ie2D6iyvRQKINu4Z1X4Pre7u62eKfSo2R6iskNDG_ETvXogjEkwh5W-ibcGgAvvL-AQvF4uC9-lXsPQmuPdvwSbKR4zCH0V_G6oted1tfSw2K97lohPV4L2-n6BVyE-kn6Ao57W1jTFKS-__wapGHg0lyFA-Z50xhnrZmIXdEFuUuCs9D-pt9_vx67-tlxNJz2855a5KyPfVZVuStCNVtSlZsZ2NiKo5c_U5wgJQfVqBwbgLyY0Grfssy17Lj7OWnPHzXL0rljiSILdVlBdrTzkHxpewS9h9d1lPi5NXEOJRnH928XxEQVdqFZShhNJCA.ejQJYzXsB2lts1WV0ML3lA [DEBUG]Parsed JWE: &{Header:{KeyID: JSONWebKey: Algorithm:PBES2-HS512+A256KW Nonce: certificates:[] ExtraHeaders:map[enc:A256GCM p2c:500000 p2s:uJobtRZQ7DO-u7SRf8xTEQ]} protected:0x40001ce010 unprotected: recipients:[{header: encryptedKey:[37 240 195 190 29 36 12 229 5 116 232 58 242 255 134 3 174 191 60 62 111 47 195 241 211 167 78 138 243 98 187 247 188 90 24 69 96 4 219 187]}] aad:[] iv:[124 89 189 208 249 233 120 70 70 182 162 247] ciphertext:[3 114 163 213 43 197 134 91 51 190 236 64 11 48 226 69 228 205 234 203 237 179 73 148 188 119 140 84 87 183 218 31 215 243 28 190 80 93 228 234 23 166 196 33 183 188 213 17 242 176 64 147 142 241 116 84 84 72 181 64 230 12 208 130 155 136 139 222 182 74 94 72 68 85 214 1 126 203 235 131 185 32 21 97 91 142 130 64 247 230 154 72 138 14 232 121 18 79 46 26 154 217 185 220 254 140 159 198 245 166 102 170 125 241 108 79 26 143 97 142 178 40 52 117 171 81 29 99 117 192 132 198 223 223 170 7 134 167 24 127 143 250 249 93 159 77 46 150 219 246 48 237 51 202 113 170 89 254 232 70 217 125 42 106 98 47 112 30 84 35 66 110 93 158 163 45 155 246 157 26 122 238 218 26 116 202 81 115 90 129 74 148 208 34 249 232 82 62 189 117 245 121 8 200 110 66 145 174 240 80 107 138 104 195 71 79 130 126 120 126 52 120 2 108 213 73 84 42 120 255 132 27 116 138 20 198 55 232 222 123 15 243 8 20 243 112 107 133 29 180 173 145 136 13 108 42 236 215 170 69 84 32 103 43 132 204 146 212 209 76 229 96 123 144 157 19 50 133 182 151 208 3 242 35 115 17 17 218 155 251 207 12 45 36 189 55 39 23 132 146 12 218 58 210 133 9 214 83 178 21 254 199 183 52 176 218 83 20 193 173 56 113 136 66 161 29 219 137 170 201 21 61 0 111 0 71 81 103 205 190 31 118 66 173 75 35 187 53 219 61 249 191 237 237 148 251 147 61 199 122 8 160 76 201 28 26 93 219 183 130 123 201 2 7 58 41 203 4 92 4 116 168 216 47 75 214 234 159 93 167 225 173 218 222 144 27 147 247 48 5 225 165 61 188 201 0 69 86 154 51 71 83 132 1 67 213 230 103 188 76 30 104 161 154 49 113 49 197 115 55 75 71 55 142 43 248 173 62 1 12 148 81 226 197 139 171 99 169 56 167 250 249 181 245 68 148 58 205 205 78 151 56 19 37 245 195 240 15 191 123 194 95 203 238 53 167 24 55 246 191 225 220 19 60 255 41 134 182 82 0 1 179 207 113 95 219 15 122 1 165 55 119 218 20 80 73 201 6 247 228 55 138 134 245 196 83 175 116 252 43 129 35 14 182 16 135 100 42 218 173 96 61 99 166 69 5 7 249 212 79 96 146 68 232 31 193 99 206 174 171 174 5 249 44 174 88 23 225 248 163 124 248 252 19 173 227 27 12 42 132 33 3 44 113 217 68 100 13 105 99 83 137 235 25 225 36 179 129 175 40 92 122 222 8 52 49 127 212 210 112 123 62 7 136 107 138 83 252 134 183 83 175 100 155 37 126 68 134 14 55 213 103 124 135 117 31 79 171 100 79 31 91 173 165 217 6 218 99 233 163 64 29 10 182 172 42 204 130 35 255 106 87 94 73 86 191 133 236 136 110 148 247 218 140 19 95 189 124 91 98 17 38 145 63 146 39 65 189 20 31 220 170 133 146 200 18 246 27 26 238 89 138 47 165 180 164 137 110 49 204 4 62 226 105 113 117 84 243 246 64 122 100 199 255 19 247 154 120 111 37 42 127 77 48 129 8 231 69 57 182 49 148 254 151 148 104 184 123 149 250 157 69 252 236 206 113 200 125 122 49 101 102 219 231 105 170 239 153 198 221 66 17 214 236 23 10 41 152 81 237 61 140 2 181 88 171 152 82 77 93 97 245 165 119 26 27 215 48 179 190 180 106 106 165 73 150 84 67 54 182 62 35 59 21 168 194 146 52 112 128 251 34 180 2 114 85 254 213 54 60 254 34 188 123 3 48 103 149 175 186 200 92 133 141 10 53 202 107 26 4 7 162 203 13 153 95 42 147 254 112 216 15 182 81 50 229 171 52 140 69 109 92 73 153 59 144 30 214 59 250 16 102 220 141 159 89 81 214 14 96 229 64 102 114 255 120 87 177 46 125 147 19 200 204 29 153 230 214 53 89 27 93 50 69 210 223 85 103 41 123 31 230 122 245 162 149 206 211 191 4 214 147 242 145 209 240 198 149 46 127 166 18 156 141 246 146 151 25 185 47 23 59 12 162 247 127 167 51 166 223 58 75 89 147 40 170 236 6 5 183 13 81 252 219 29 79 151 146 45 225 206 17 41 15 40 118 12 177 148 39 218 44 22 11 37 49 67 233 160 118 239 117 29 12 89 22 225 236 26 213 79 156 67 49 211 59 101 222 161 54 229 225 92 126 246 91 238 33 147 148 88 146 0 42 135 105 230 47 115 227 92 251 144 121 88 13 181 188 215 178 128 14 180 166 103 192 129 30 146 230 34 224 246 192 180 234 252 119 100 137 44 109 10 35 125 18 70 56 101 12 62 84 119 150 68 42 145 172 193 63 60 101 56 167 106 168 52 47 52 168 172 6 16 212 253 148 177 107 251 167 238 123 62 184 130 55 252 88 84 218 112 32 65 240 195 153 83 15 218 18 255 216 45 197 198 246 158 118 86 250 37 126 215 57 226 211 249 82 210 109 99 213 234 9 155 133 30 215 138 28 130 44 240 185 251 6 250 240 233 147 3 132 207 30 92 115 122 205 156 4 215 110 157 85 171 93 155 252 139 6 182 176 128 223 229 231 200 122 92 100 52 80 99 117 135 20 204 25 66 21 78 31 205 60 176 135 133 106 96 169 34 225 113 133 236 56 95 23 9 219 113 209 236 115 224 133 135 131 4 45 59 117 223 243 139 26 5 20 25 87 2 116 59 35 26 119 178 26 38 231 123 226 181 13 37 19 33 200 105 10 37 253 42 170 232 60 122 136 98 67 156 237 208 7 210 155 192 176 75 211 202 72 24 98 233 138 75 70 55 80 114 9 28 25 189 226 184 23 196 197 202 45 205 215 114 32 12 119 140 227 126 163 42 251 86 246 110 165 116 31 178 224 81 232 69 120 37 55 164 76 65 240 231 118 154 22 177 121 220 207 149 18 144 202 188 50 130 228 212 59 105 144 165 225 242 29 239 123 126 39 128 53 143 28 88 185 68 124 227 53 157 16 183 64 124 180 172 166 249 168 166 38 38 21 207 29 139 237 142 89 190 93 175 118 164 47 135 201 77 55 96 232 40 29 98 124 126 163 143 178 0 74 44 138 119 46 63 116 204 200 63 102 132 210 86 44 110 228 64 234 236 39 194 137 196 56 184 16 141 209 78 233 114 240 184 134 37 206 206 245 125 84 66 82 164 76 105 25 142 205 28 216 33 58 254 50 9 75 102 180 9 220 72 138 213 45 118 34 250 72 233 91 68 87 19 94 177 181 152 120 114 134 97 240 121 85 225 168 235 165 220 176 121 113 155 84 69 204 54 231 0 106 32 135 117 254 102 246 152 233 35 141 179 132 140 56 8 132 212 169 22 214 203 183 98 180 119 1 35 0 224 147 74 33 133 240 236 165 91 139 23 245 253 63 253 221 82 122 237 224 160 218 214 243 31 94 185 0 4 99 101 166 255 177 239 101 199 158 18 191 59 61 215 94 73 227 5 19 94 85 221 172 248 168 95 126 9 56 40 38 169 177 217 235 72 89 183 241 167 78 151 7 220 193 167 190 61 228 44 229 102 4 182 125 255 120 145 82 14 85 150 51 217 78 118 141 241 125 212 19 62 169 189 160 229 28 133 106 66 51 110 96 90 164 65 215 56 231 208 132 134 212 50 239 162 76 202 21 251 9 232 198 99 181 194 71 77 133 88 21 164 155 222 215 102 147 130 99 156 89 162 217 18 62 114 50 161 139 161 170 120 68 110 5 50 110 158 193 119 22 225 16 151 220 166 188 91 61 20 188 116 83 247 178 141 166 53 93 89 214 63 188 6 62 10 147 238 227 173 87 58 151 11 231 71 17 177 4 246 51 40 108 133 28 204 151 63 81 64 211 124 178 236 214 136 13 83 136 185 81 38 166 77 87 209 86 247 143 225 241 168 127 81 223 238 103 65 155 186 38 70 65 158 199 78 239 210 252 193 186 242 81 124 214 236 40 47 146 135 162 246 155 176 37 82 204 205 41 115 145 25 41 6 212 136 195 28 153 233 78 194 171 203 180 6 133 35 174 195 44 217 110 237 126 103 201 223 214 190 43 56 183 119 119 102 222 206 231 57 112 254 255 80 97 79 100 34 184 75 83 36 159 27 84 245 255 84 230 7 207 28 189 167 59 140 224 163 134 171 216 0 118 227 168 154 246 160 73 33 0 229 208 31 127 163 70 41 36 253 237 59 221 7 133 179 131 115 204 153 218 130 19 28 179 23 134 198 216 2 113 0 12 11 40 44 225 229 223 177 77 73 253 155 224 106 229 189 104 37 10 183 143 116 5 28 218 234 226 49 144 145 17 102 165 186 41 132 18 65 233 60 74 51 221 231 221 123 42 216 146 16 35 176 59 242 152 48 116 139 113 153 73 68 160 7 154 206 45 129 165 99 183 68 110 148 32 45 178 21 80 235 16 175 133 60 219 152 155 230 188 198 235 231 101 42 88 40 139 242 91 34 219 165 230 244 200 172 55 144 211 79 92 35 245 245 150 74 102 125 46 90 216 110 235 40 37 167 143 188 160 198 66 46 60 103 42 219 87 124 6 98 63 3 219 107 219 27 155 11 171 189 161 169 211 65 65 214 227 66 91 48 143 179 36 205 217 43 156 210 86 154 27 235 110 162 134 3 45 167 133 141 65 45 9 228 254 128 222 74 207 228 139 230 231 186 153 158 14 28 125 232 128 249 84 103 116 156 236 12 253 64 8 153 120 26 197 154 149 192 62 247 217 140 15 83 39 197 203 155 186 21 236 201 31 104 207 227 25 129 231 129 251 58 146 130 185 1 105 91 239 188 90 53 39 81 6 2 49 32 106 162 151 156 112 129 156 149 25 199 37 181 211 93 233 118 157 119 98 125 132 11 67 216 95 76 7 187 54 248 49 73 220 100 210 38 28 68 240 124 47 226 0 85 66 189 135 129 124 98 89 45 54 14 188 56 75 115 6 49 248 127 161 102 41 7 39 19 210 255 83 9 37 55 129 196 35 49 127 214 94 10 229 143 168 17 142 164 174 147 5 101 228 122 125 203 157 162 70 19 32 250 205 219 43 86 194 15 105 99 41 125 172 193 16 217 128 168 117 145 33 243 185 104 142 245 160 9 124 103 117 81 188 119 84 81 39 238 188 172 143 56 68 107 17 94 110 132 250 98 86 255 112 242 158 225 105 184 229 145 246 30 149 238 30 142 245 136 7 191 87 133 28 201 25 83 71 217 59 190 164 19 58 36 220 39 227 45 74 222 110 59 134 57 232 200 65 244 53 107 123 90 239 216 6 215 33 126 185 70 124 5 147 168 234 31 207 61 17 190 56 138 195 240 44 169 157 154 34 30 54 171 29 44 180 35 161 142 222 14 132 113 94 241 210 186 175 132 44 214 251 144 154 172 139 88 171 218 39 38 180 89 173 242 139 250 44 209 184 50 207 37 178 104 136 119 208 76 47 56 44 219 29 229 144 161 120 9 87 228 109 210 247 158 6 123 124 234 143 213 38 107 172 167 120 60 89 97 128 17 34 7 99 240 132 3 154 6 254 229 204 1 208 86 231 250 181 175 26 38 205 120 234 136 110 229 108 94 212 193 116 8 237 250 77 6 254 30 122 169 96 206 246 59 148 227 100 79 247 247 4 229 113 63 195 246 152 47 128 182 78 113 185 133 99 109 196 82 60 116 218 225 4 211 192 28 78 114 73 183 145 249 82 215 18 103 165 32 125 36 16 193 177 1 26 136 74 73 7 75 75 37 150 152 189 135 246 144 77 242 30 62 31 14 20 1 125 60 224 119 232 74 88 61 1 53 238 105 97 129 131 4 62 144 4 53 139 7 245 207 66 70 68 253 116 202 137 23 73 238 104 64 219 247 219 2 111 164 82 171 189 74 54 163 11 9 48 248 223 45 157 102 182 238 239 251 140 119 70 86 250 215 224 99 12 77 233 203 123 187 94 20 162 74 112 207 47 207 116 255 34 122 249 189 76 47 76 51 78 169 238 25 71 168 79 142 5 228 202 199 169 119 85 157 126 31 89 227 197 145 43 123 2 39 86 237 122 27 19 178 115 228 152 112 52 17 46 28 179 17 16 151 52 242 146 111 23 141 104 53 107 161 145 210 191 125 2 255 235 152 65 206 85 109 61 167 85 135 176 62 179 161 251 138 171 239 145 58 126 216 70 55 204 24 79 216 14 74 116 87 139 116 91 203 1 50 65 160 127 75 28 224 139 178 96 17 172 60 255 20 106 94 123 239 86 58 165 84 228 172 132 249 144 163 201 126 181 255 246 178 211 68 208 244 162 139 158 57 95 177 51 40 208 33 141 176 91 59 197 176 162 142 38 162 109 3 150 175 70 183 163 43 183 235 215 251 203 242 26 130 248 66 128 120 103 193 126 64 44 205 49 250 11 249 235 139 114 52 89 134 101 197 60 155 2 199 230 71 16 202 106 27 248 168 129 51 220 122 136 25 173 40 211 22 119 188 15 14 139 123 138 123 225 19 45 249 143 55 20 113 16 82 111 89 28 187 24 90 38 7 181 48 48 231 12 231 120 102 36 236 3 26 105 219 152 35 126 173 195 111 152 74 25 54 124 56 165 167 231 91 199 218 90 60 74 192 42 66 50 29 1 244 162 111 170 19 179 133 221 63 121 171 189 103 183 178 23 138 115 234 187 53 48 0 147 106 147 156 203 219 161 55 130 171 140 178 76 95 218 154 41 44 165 206 152 0 71 6 205 124 240 38 124 131 109 237 208 167 102 214 74 198 228 21 211 181 209 190 97 99 196 216 205 236 143 61 230 144 33 95 43 217 172 121 181 204 62 30 34 87 39 220 114 73 233 158 198 15 130 59 45 153 152 240 170 177 172 47 140 79 248 197 208 244 7 243 240 41 243 23 74 78 124 235 223 150 201 118 240 13 230 155 72 69 131 246 205 189 150 124 181 173 183 23 240 159 8 77 195 151 221 225 114 207 63 208 208 231 249 92 209 74 72 122 192 141 163 160 166 92 207 9 101 124 172 179 247 120 248 25 107 164 128 108 172 76 40 158 205 250 221 82 222 63 97 21 82 39 197 145 230 89 147 207 2 160 155 111 47 223 44 69 201 174 103 97 217 24 42 115 58 206 180 1 209 171 246 160 151 138 70 156 141 3 80 18 35 54 248 212 133 78 133 66 230 156 41 44 247 173 47 75 227 121 112 222 93 221 28 61 61 2 121 54 83 132 254 188 87 52 241 21 17 172 46 200 151 136 21 43 153 26 92 231 215 20 182 44 208 77 62 97 64 74 101 26 241 121 216 178 233 7 132 226 211 165 117 135 252 214 169 74 125 88 31 180 198 210 250 175 165 120 192 228 84 149 164 168 250 68 179 137 172 157 181 159 150 3 115 114 14 68 63 152 64 94 181 86 99 197 186 78 115 191 219 18 175 147 155 197 97 102 116 12 64 55 174 250 5 1 68 16 139 199 70 141 143 107 24 206 225 194 228 237 151 86 20 82 134 132 71 137 213 14 23 150 94 216 7 176 220 33 230 183 142 96 119 24 232 31 77 18 84 160 121 186 39 122 36 143 216 207 77 58 67 107 173 150 246 239 144 182 170 219 246 240 28 37 214 1 168 33 202 181 67 222 31 110 65 201 44 100 132 235 207 52 66 172 184 210 67 16 122 174 124 250 65 244 142 52 146 93 10 156 128 41 78 74 214 115 154 13 113 189 7 242 52 70 218 153 22 73 250 52 53 192 242 129 206 22 47 51 121 10 159 73 58 74 225 16 167 168 186 72 207 81 3 27 9 201 113 19 126 1 81 6 14 148 42 5 228 245 93 194 113 55 134 224 72 28 185 229 37 135 101 121 235 14 65 121 153 162 204 48 167 56 209 222 134 226 177 246 232 32 158 74 34 191 111 94 3 246 50 113 236 42 106 129 187 48 238 30 95 134 113 166 227 114 125 88 7 88 51 50 20 207 165 32 3 62 223 198 126 120 170 127 0 151 26 14 211 207 29 61 72 228 158 82 43 27 12 71 110 239 219 161 207 67 62 189 0 231 227 28 179 120 107 58 250 114 104 148 149 129 57 123 193 134 218 91 27 145 114 230 170 120 124 156 148 11 77 97 135 121 191 104 239 182 108 31 174 56 198 192 21 128 0 180 183 55 11 12 106 149 48 94 0 254 226 32 181 142 177 223 103 22 250 253 104 6 179 241 217 119 88 53 47 211 246 225 8 220 91 3 192 148 116 16 151 150 206 36 159 107 87 166 182 120 138 8 19 58 172 107 46 248 149 103 92 242 45 151 116 133 200 120 215 49 190 64 236 153 27 185 125 132 70 13 124 65 164 38 29 167 90 84 142 207 24 28 135 225 224 142 51 207 112 226 236 208 245 163 31 157 42 6 63 168 37 1 151 113 244 143 15 251 253 215 132 176 29 193 168 181 168 182 121 35 126 81 74 165 216 196 92 31 136 222 56 100 75 37 91 95 129 4 244 34 212 120 27 138 62 20 159 132 200 108 95 132 173 86 210 43 71 248 47 107 250 191 228 243 181 89 196 7 234 187 62 145 63 214 39 163 20 17 12 241 155 2 116 10 28 92 146 135 2 34 233 214 128 135 62 114 28 240 55 21 42 101 224 210 134 146 18 22 220 35 134 202 252 169 200 80 207 151 123 26 81 196 7 46 6 244 221 80 133 106 24 32 139 125 95 235 18 2 237 96 62 75 101 114 242 254 11 174 54 238 140 235 158 220 158 2 162 91 110 130 68 54 70 31 125 223 218 43 95 44 9 163 42 94 23 71 80 61 44 214 53 63 188 178 237 22 128 55 177 80 128 210 207 72 64 28 162 249 57 149 177 18 146 66 255 130 116 26 79 70 12 250 102 13 99 176 105 112 115 149 220 243 116 179 251 115 11 93 73 20 89 26 217 255 147 50 106 146 223 80 68 80 173 249 33 69 66 15 151 143 159 151 232 211 49 138 255 97 218 255 157 173 244 225 39 110 9 243 61 221 16 140 67 17 84 213 23 222 153 126 177 138 202 133 112 11 51 40 231 188 161 136 142 99 69 164 119 27 115 174 0 9 17 106 212 178 166 248 79 237 174 201 195 130 0 1 122 112 150 51 41 54 203 233 18 97 130 41 15 17 43 196 44 146 254 222 197 204 159 233 107 185 210 247 201 62 129 133 224 244 79 103 189 161 248 135 182 15 168 178 189 20 10 32 219 184 103 85 248 62 183 187 187 173 158 41 244 168 217 30 162 178 67 67 27 241 19 189 122 32 140 73 48 135 149 190 137 183 6 128 11 239 47 224 16 188 94 46 11 223 165 94 195 208 154 227 221 191 4 155 41 30 51 8 125 21 252 110 168 181 231 117 181 244 176 216 175 123 150 136 79 87 130 246 250 126 129 87 33 62 146 126 128 163 158 214 214 52 197 41 47 191 255 6 169 24 120 52 151 33 64 249 158 116 198 25 235 102 98 23 116 65 110 82 224 172 244 63 169 183 223 239 199 174 254 182 92 77 39 61 188 231 150 185 43 35 223 85 149 110 74 208 141 86 212 165 102 198 118 54 34 168 229 207 212 231 8 9 65 245 106 7 6 224 47 38 52 26 183 236 179 45 123 46 62 206 90 115 199 205 114 244 174 88 226 72 130 221 86 80 93 173 60 228 31 26 94 193 47 97 245 221 101 62 46 77 92 67 137 70 113 253 219 197 241 17 5 93 168 86 82 134 19 73 8] tag:[122 52 9 99 53 236 7 105 109 179 85 149 208 194 247 148] original:0x400008e420} [DEBUG]Leaving jwt.DecryptJWE function without error [DEBUG]Returning message base: {Version:0 ID:546d32c9-9a89-45d3-bbba-9f58bfae8632 Type:2 Payload:{Type:1 Payload:[0 0 0 16 84 109 50 201 154 137 69 211 187 186 159 88 191 174 134 50 219 139 99 250 176 198 6 51 222 130 50 206 248 226 104 249 199 21 111 100 247 86 34 23 187 130 66 203 197 232 194 43]} Padding:szLDGNDMiqsukSnNeAmOToTnaWOMuYRweNFoxUiXsVFifUezzetZobbnhnHXQoLWOBHtkwrTYTPGcPVZHLhwRbVMiLJtsULqgzxXGtSfqjcbbChJXRuuNAnkDCZuGTfYCYrieLPzjZlHEJVfzTlTcQsRZoeOvFgReZJNOLlLQSUfVrXMTMREmYJJxyaChROEiQuWarNIoTwmwEMQBYPOqISyvNZzhbDMaAsBYyKgClCDjQMFzSciMQJFwvpNjpsCnnabfMgkiTArIPeFoJIefDZKHQnawGFkAoBmzsfaDluuFnrEJHhxZEtmDGhbUbEATNizDvSHipeVIJzLOjToFBzWGzQUgQGEgNAvzfOuGtDJDpzMysTAVsZjhwWLVqcLHfeKZsAabzpCKzSRvAifQJhAeZHvSABXrLKikdoffNLscEmMWoeCfNOPAsOCEJgvpgtOoFnufNrpKXDsEmNgnTTUYUuLebjDiKCEyRwVTUQGegNJlagceSJLFfXNIYjajbBDNVsPtBxurzpDWEQXozxNjSBiFNeLTfXsACQMoARvSidrYUFbRieCXFcrBLoShiMHSlAPxAYTFQupCvELriUaJyLfVrJpCEIdXJHHHIwkebPkZejLANkjJwGhgvKDtgtKckqKogCDMqwqRsobGvODeZFHUIZkQTJbzRKDxzrwfOBnidtYnmoBSHwOVgZyNPYlRjjNoBhpvBShEDrjrVecAxCdcNfBHTLAqynXlMwVgqHxXGoenvimxCusBgKpipFKRiwXynqLzZRfvXQfVBjNyZMtAmZPyTYMcXvwiyKVUsesWMSYBhvnSNdDWOPyluzmidvNrrDEjkzwSvpmxzAUXXGCZLfoqrSJXZdxNfFDCUrhrWjNlKwJqjbCPnpBtGAAaEZaAVwQdwtRPXEWPTUZapyRRfmhIdBRvZgFDWnluCeVjsnMKUSgrHCRzAPfDotEmLJpMafwGWeJXcJrbnAYGOBrftSTDCcjBIuCYFIOdvxlpnMUUygHxtURJxXKLLTTOcrEXPRQjsTNhLszEpvmkgCBGrllrIRhfLAaXYrsFIEsidWPMJocHevVbXDOtoeprUzVmCCqRHbMgWiVgYGhOBBiMrWIomtReHxVcBaMGmAdINitlLmYtlxEaIztGOwsFxQvJvUlkXDUkRTWpMJoyUHfKHiHkLEiahinaNmJeIacgzAmFnFAnsxHAnjZZgKBGjwrLyVboxKUbisqcxthHJNgkFZzfEMlyzCLvHdFJjJWJydfMGFIbUDaeMNBrNJXgrapQUukDLSAWYjWYvbWNxQwZLAmKDkBNvQEVdncnOPDfcdDLkAGdKRBoyfHjPiQbrsunjIOcPOEAqvXeBDhUIglbuBTyMrRUmpdYMqidQjcczgawSzrguXIaOrjxuQvPnsnPQLPaJISRKSCgeAGBngeTmdSSuUzIWhIuFqAVUcuGOYiWctxixPThcHRzmNnJbCYTqgKGUcGgsKbQwZyhvvoUyimaPOXjkvxcFLtQzFoohMTaXRHSxSNareqijPYtwvPwWcvuYJLfxVPjdQCbbpeAadYGsRRCUdKzwbVQaUkkhDuzdIxDckfrCbOVukjartOoMIrRXMgWFJhcrORagbLXmAWPGfjBGSblAENcImYCShonOyMSbLHpukAhGIbKyTEcTJJYNhreElygHZQzzfIwSsnBIORiBkapyYmnAsOWQwYIHtnzxFmRlKBTnyGhScOkBoOZEibvUPGnlGPKntIZpEzPOFuFtgtPNdQtncfCgUCvGGxBzdAyqcEVagdDbYsMlzBEkiQGKbrGuDpNKEmWQoKqTPGcKTlxZLtqVISYviSpRAkMBobFwLRYWfXzqENacDxBWPjmVzbHdqZbOQnUXIfUJyOchJnpvEzeQQkbKfboQEshtCHGFIubTcHjNLRXLvJeaMGTBGuGRCdVTohNaotMteOrjcZwnRFuQjwqeLhgKmWBVCfDgRQGgBqReOsvjlVAgELeVEtNtBOlAPDLYmnHdOAVSniCCncGgNIOvPqnxGnCwsXoVokeUbpnKhXbyMQqWBaPKATIIdyFuehqGPbsPXYjorjhLwEwTAXJdGEedZjTKDdJFWewKRIZzkBweQnYABEMgfDgYfUEdAMVcFLEhNTRqOtqNZxWNdAOTDYwgsJozzGDjphAqHYQCglLHOZdrTfbdzXEwwXHfvPsRfSiSGEDJFtjKbvLlvhNUOPPCuvVyaRZfLnhXpTjCfJxefbOATeOfYOnCOixKLyEWHcyjLbTeLgYcQsuUdFnRMgKaFAuLVtMhQNHqqcdjqLMluIALdgLKCEIWtDJzUsymnzLwLLAaEznyCxFXquWyTrEwrnjrssdIKSyNiYhQTOnRpHWcxBDBpByTTrqqANJQByjJAwHgQZxLYnDgeCLPwReBZlQdCinbGAXGWCqdHVpWHrhLGldLQGXeqfdGqfopuwTaesiVczELcOFjMqlIsRvjjVTxyOAxtonURVMJvHuleOikuJZyfIUBAWwRzTMGRWxsFySLRsufKFcpSqAsUdFWndEEdrAyyHeEMlfvARtBpRbkXlmdOMyaGPOKyfyCUvkeSImvCQMztoEIqKyrTfAztRPbVrwLtGYrFrvnVPBrGfdsZiZwUnbyRPFZvYVPTOyrcINXVMkrqoUZztNGNAcnRcqxneVaJzbKzEdsYqMIqqSkAjCPOKKMgVGPIvoLLoafPlEnYzTolblRgGefazkElhZuCzXpzyKLzvIWzxDmQqEZdNuyXkEEUSJfCfCjOjlMvZmjusMIwtppQJxcwzHQFscLevLJFZaRHjrOGyVyMrMIYIYtktFWjmenxnrJkSwQUaGStoqGbWWpVRRqAvViZFgybCSeIxPctzaXlENdoQGrPiRznWfscCCveRENTnWHmzDPPRyezRUhGGXLVYwrNuLgUkbWwrAcQNlIfGEzBKSHoTYyykaxMqOTmEpMPamoKXAwmdYDgWHzyjYqnwmAGhwDerfbtiglmRohDAWgTvsUQFRFQllPNgmrItUbJPMiBWhFXegJJvMXBojJZwnWizeTgOpPWesTFTBbcMCzFZKZDhjvkuPBFRrvRQzwRRjMfdcSvFUeZZolCqTwLCTXvPkHEpxsKkpTCdAmVCkiiPoHChFSVwSEqIiDlWoPnRIULTQrPVQYbBrAdtsMQeAGGWGvITJJfyExgxXNkMZqMZNOkSsHOsWXHxxlgUoXAEfefGnsAfJilzkxQAasfjUPYqyEWPmjtLVLHSXZgyykPGZDlwasKPVThhCzQvGkuttsvsuaLdTdeJBCihlKQUEBAJFvGSZTVEEmxbnKYXEqGzmmOnsTClUTSxHLjnIwFedYRAbJcuKjSdyyDpPqSUKNbVtbSOGrFixXSechmFmolHiBjFrwsLdiicyjhDrCRLAKhSOhifKyFORwiNENKCSgrVhmyfOERuuHUaErvAkdgurgwZfzVBQXCAXZFypdbWxpBKuUsPemBegeFrIXZwDbLVExwTlCbhZTMTVLhDioJtwomdPKJSQLhbTzFsBBAgvtzygAohzMiawtWyJJoXhDOLbBhLrUiDJnHcFClbzzSXVvZakFDpEkTXxKUMpsJkYUYbfjDETjKAfidUHIAjflqvawoDBSSPIoeteKfOOOsFsCEWTOYycpXCVnUICygywKEKjlEXzVGkCjCPNEbmjWUlymXLLthotJIrLyxDimIYYJBnpWvPfIvscnoYoYuANcvCMZAFkvIPGqhyTKkxowjJjlcejAjPYaQCaRvFGBQPHiDHJYbUGYMqCFdfHvRFMiglutTiKfvosvemDrTwkRcbItXMqdkVBYahJjBjVBgUXppMZMijidqohLUTXEpwTMuQsByyiIGyEWDxmoqlSIvaDukRPgxwUbIDxFmNxSUVzTWIevBkHJcLLZFptzIqwBxgdmhBFwYqaGnnOTUjuZNzSwEdBbdNEuikrDCEebgwKWkQqLwOnCkfWocxtqIjsDKIjyTpVEMCPPDXtrXiJWmziNVnjNyFRueEFzNKuPaaTTivSoXdNcGtyQjKAVDVeNHLBbyPkvsuhOtsDGRLiywDRtjnEjLQ Token:}

[DEBUG] [DEBUG]POST DATA: {0 546d32c9-9a89-45d3-bbba-9f58bfae8632 2 {1 [0 0 0 16 84 109 50 201 154 137 69 211 187 186 159 88 191 174 134 50 219 139 99 250 176 198 6 51 222 130 50 206 248 226 104 249 199 21 111 100 247 86 34 23 187 130 66 203 197 232 194 43]} szLDGNDMiqsukSnNeAmOToTnaWOMuYRweNFoxUiXsVFifUezzetZobbnhnHXQoLWOBHtkwrTYTPGcPVZHLhwRbVMiLJtsULqgzxXGtSfqjcbbChJXRuuNAnkDCZuGTfYCYrieLPzjZlHEJVfzTlTcQsRZoeOvFgReZJNOLlLQSUfVrXMTMREmYJJxyaChROEiQuWarNIoTwmwEMQBYPOqISyvNZzhbDMaAsBYyKgClCDjQMFzSciMQJFwvpNjpsCnnabfMgkiTArIPeFoJIefDZKHQnawGFkAoBmzsfaDluuFnrEJHhxZEtmDGhbUbEATNizDvSHipeVIJzLOjToFBzWGzQUgQGEgNAvzfOuGtDJDpzMysTAVsZjhwWLVqcLHfeKZsAabzpCKzSRvAifQJhAeZHvSABXrLKikdoffNLscEmMWoeCfNOPAsOCEJgvpgtOoFnufNrpKXDsEmNgnTTUYUuLebjDiKCEyRwVTUQGegNJlagceSJLFfXNIYjajbBDNVsPtBxurzpDWEQXozxNjSBiFNeLTfXsACQMoARvSidrYUFbRieCXFcrBLoShiMHSlAPxAYTFQupCvELriUaJyLfVrJpCEIdXJHHHIwkebPkZejLANkjJwGhgvKDtgtKckqKogCDMqwqRsobGvODeZFHUIZkQTJbzRKDxzrwfOBnidtYnmoBSHwOVgZyNPYlRjjNoBhpvBShEDrjrVecAxCdcNfBHTLAqynXlMwVgqHxXGoenvimxCusBgKpipFKRiwXynqLzZRfvXQfVBjNyZMtAmZPyTYMcXvwiyKVUsesWMSYBhvnSNdDWOPyluzmidvNrrDEjkzwSvpmxzAUXXGCZLfoqrSJXZdxNfFDCUrhrWjNlKwJqjbCPnpBtGAAaEZaAVwQdwtRPXEWPTUZapyRRfmhIdBRvZgFDWnluCeVjsnMKUSgrHCRzAPfDotEmLJpMafwGWeJXcJrbnAYGOBrftSTDCcjBIuCYFIOdvxlpnMUUygHxtURJxXKLLTTOcrEXPRQjsTNhLszEpvmkgCBGrllrIRhfLAaXYrsFIEsidWPMJocHevVbXDOtoeprUzVmCCqRHbMgWiVgYGhOBBiMrWIomtReHxVcBaMGmAdINitlLmYtlxEaIztGOwsFxQvJvUlkXDUkRTWpMJoyUHfKHiHkLEiahinaNmJeIacgzAmFnFAnsxHAnjZZgKBGjwrLyVboxKUbisqcxthHJNgkFZzfEMlyzCLvHdFJjJWJydfMGFIbUDaeMNBrNJXgrapQUukDLSAWYjWYvbWNxQwZLAmKDkBNvQEVdncnOPDfcdDLkAGdKRBoyfHjPiQbrsunjIOcPOEAqvXeBDhUIglbuBTyMrRUmpdYMqidQjcczgawSzrguXIaOrjxuQvPnsnPQLPaJISRKSCgeAGBngeTmdSSuUzIWhIuFqAVUcuGOYiWctxixPThcHRzmNnJbCYTqgKGUcGgsKbQwZyhvvoUyimaPOXjkvxcFLtQzFoohMTaXRHSxSNareqijPYtwvPwWcvuYJLfxVPjdQCbbpeAadYGsRRCUdKzwbVQaUkkhDuzdIxDckfrCbOVukjartOoMIrRXMgWFJhcrORagbLXmAWPGfjBGSblAENcImYCShonOyMSbLHpukAhGIbKyTEcTJJYNhreElygHZQzzfIwSsnBIORiBkapyYmnAsOWQwYIHtnzxFmRlKBTnyGhScOkBoOZEibvUPGnlGPKntIZpEzPOFuFtgtPNdQtncfCgUCvGGxBzdAyqcEVagdDbYsMlzBEkiQGKbrGuDpNKEmWQoKqTPGcKTlxZLtqVISYviSpRAkMBobFwLRYWfXzqENacDxBWPjmVzbHdqZbOQnUXIfUJyOchJnpvEzeQQkbKfboQEshtCHGFIubTcHjNLRXLvJeaMGTBGuGRCdVTohNaotMteOrjcZwnRFuQjwqeLhgKmWBVCfDgRQGgBqReOsvjlVAgELeVEtNtBOlAPDLYmnHdOAVSniCCncGgNIOvPqnxGnCwsXoVokeUbpnKhXbyMQqWBaPKATIIdyFuehqGPbsPXYjorjhLwEwTAXJdGEedZjTKDdJFWewKRIZzkBweQnYABEMgfDgYfUEdAMVcFLEhNTRqOtqNZxWNdAOTDYwgsJozzGDjphAqHYQCglLHOZdrTfbdzXEwwXHfvPsRfSiSGEDJFtjKbvLlvhNUOPPCuvVyaRZfLnhXpTjCfJxefbOATeOfYOnCOixKLyEWHcyjLbTeLgYcQsuUdFnRMgKaFAuLVtMhQNHqqcdjqLMluIALdgLKCEIWtDJzUsymnzLwLLAaEznyCxFXquWyTrEwrnjrssdIKSyNiYhQTOnRpHWcxBDBpByTTrqqANJQByjJAwHgQZxLYnDgeCLPwReBZlQdCinbGAXGWCqdHVpWHrhLGldLQGXeqfdGqfopuwTaesiVczELcOFjMqlIsRvjjVTxyOAxtonURVMJvHuleOikuJZyfIUBAWwRzTMGRWxsFySLRsufKFcpSqAsUdFWndEEdrAyyHeEMlfvARtBpRbkXlmdOMyaGPOKyfyCUvkeSImvCQMztoEIqKyrTfAztRPbVrwLtGYrFrvnVPBrGfdsZiZwUnbyRPFZvYVPTOyrcINXVMkrqoUZztNGNAcnRcqxneVaJzbKzEdsYqMIqqSkAjCPOKKMgVGPIvoLLoafPlEnYzTolblRgGefazkElhZuCzXpzyKLzvIWzxDmQqEZdNuyXkEEUSJfCfCjOjlMvZmjusMIwtppQJxcwzHQFscLevLJFZaRHjrOGyVyMrMIYIYtktFWjmenxnrJkSwQUaGStoqGbWWpVRRqAvViZFgybCSeIxPctzaXlENdoQGrPiRznWfscCCveRENTnWHmzDPPRyezRUhGGXLVYwrNuLgUkbWwrAcQNlIfGEzBKSHoTYyykaxMqOTmEpMPamoKXAwmdYDgWHzyjYqnwmAGhwDerfbtiglmRohDAWgTvsUQFRFQllPNgmrItUbJPMiBWhFXegJJvMXBojJZwnWizeTgOpPWesTFTBbcMCzFZKZDhjvkuPBFRrvRQzwRRjMfdcSvFUeZZolCqTwLCTXvPkHEpxsKkpTCdAmVCkiiPoHChFSVwSEqIiDlWoPnRIULTQrPVQYbBrAdtsMQeAGGWGvITJJfyExgxXNkMZqMZNOkSsHOsWXHxxlgUoXAEfefGnsAfJilzkxQAasfjUPYqyEWPmjtLVLHSXZgyykPGZDlwasKPVThhCzQvGkuttsvsuaLdTdeJBCihlKQUEBAJFvGSZTVEEmxbnKYXEqGzmmOnsTClUTSxHLjnIwFedYRAbJcuKjSdyyDpPqSUKNbVtbSOGrFixXSechmFmolHiBjFrwsLdiicyjhDrCRLAKhSOhifKyFORwiNENKCSgrVhmyfOERuuHUaErvAkdgurgwZfzVBQXCAXZFypdbWxpBKuUsPemBegeFrIXZwDbLVExwTlCbhZTMTVLhDioJtwomdPKJSQLhbTzFsBBAgvtzygAohzMiawtWyJJoXhDOLbBhLrUiDJnHcFClbzzSXVvZakFDpEkTXxKUMpsJkYUYbfjDETjKAfidUHIAjflqvawoDBSSPIoeteKfOOOsFsCEWTOYycpXCVnUICygywKEKjlEXzVGkCjCPNEbmjWUlymXLLthotJIrLyxDimIYYJBnpWvPfIvscnoYoYuANcvCMZAFkvIPGqhyTKkxowjJjlcejAjPYaQCaRvFGBQPHiDHJYbUGYMqCFdfHvRFMiglutTiKfvosvemDrTwkRcbItXMqdkVBYahJjBjVBgUXppMZMijidqohLUTXEpwTMuQsByyiIGyEWDxmoqlSIvaDukRPgxwUbIDxFmNxSUVzTWIevBkHJcLLZFptzIqwBxgdmhBFwYqaGnnOTUjuZNzSwEdBbdNEuikrDCEebgwKWkQqLwOnCkfWocxtqIjsDKIjyTpVEMCPPDXtrXiJWmziNVnjNyFRueEFzNKuPaaTTivSoXdNcGtyQjKAVDVeNHLBbyPkvsuhOtsDGRLiywDRtjnEjLQ }

[-] Received OPAQUE message, decrypted JWE with interface PSK

[DEBUG] Entering into opaque.UnAuthHandler() function...

[-] Received OPAQUE message type: 1

[DEBUG] Entering into opaque.RegistrationInit() function... [DEBUG]Entering into opaque.ServerRegisterInit() function...

[DEBUG] Entering into agents.newAgent function

[-] Created agent log file at: /opt/merlin/data/agents/546d32c9-9a89-45d3-bbba-9f58bfae8632 agent_log.txt

[DEBUG] Leaving agents.newAgent function without error

[DEBUG] Entering into agents.Log

[DEBUG] Leaving agents.OPAQUERegistrationInit function without error

[DEBUG] Leaving opaque.UnAuthHandler() function without error

[!] Received HTTP/2.0 POST connection from 192.168.201.3:48043

[DEBUG] HTTP Connection Details: Host: 192.168.201.19:443 URI: / Method: POST Protocol: HTTP/2.0 Headers: map[Accept-Encoding:[gzip] Authorization:[Bearer eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..xLjCpym9WJeuSQYT.1TWRMbVFFWZ69KDcgqhePpDyNUS157zwJ-tIUCJHDPuxd3VaCGJT8b2JtNd1vZe0LMjwyRP6zom8EqzpeWUeOwyKq4UUjRDo_wa-r02evQ2zJEDUcRn3EsmOWM545ngmJ_uo1YzhOcaGhhWE7mwMeDLLP_54ktrEttqWuecPrsO63Rp3hB8djarRCyljPu1sLQGI0Rfse8Ueq-kew1-rCDPMHiabD4brBN5HPEcCWzkTh8BwMyLTPoJj-QY.EA1A50HGjsyvNn-l5uGRGg] Content-Length:[6209] Content-Type:[application/octet-stream; charset=utf-8] User-Agent:[Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36]] TLS Negotiated Protocol: h2 TLS Cipher Suite: 4867 TLS Server Name: Content Length: 6209 [DEBUG]Entering into jwt.ValidateJWT [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..xLjCpym9WJeuSQYT.1TWRMbVFFWZ69KDcgqhePpDyNUS157zwJ-tIUCJHDPuxd3VaCGJT8b2JtNd1vZe0LMjwyRP6zom8EqzpeWUeOwyKq4UUjRDo_wa-r02evQ2zJEDUcRn3EsmOWM545ngmJ_uo1YzhOcaGhhWE7mwMeDLLP_54ktrEttqWuecPrsO63Rp3hB8djarRCyljPu1sLQGI0Rfse8Ueq-kew1-rCDPMHiabD4brBN5HPEcCWzkTh8BwMyLTPoJj-QY.EA1A50HGjsyvNn-l5uGRGg

[-] Checking to see if authorization JWT was signed by server's interface key... [DEBUG]Entering into jwt.ValidateJWT [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..xLjCpym9WJeuSQYT.1TWRMbVFFWZ69KDcgqhePpDyNUS157zwJ-tIUCJHDPuxd3VaCGJT8b2JtNd1vZe0LMjwyRP6zom8EqzpeWUeOwyKq4UUjRDo_wa-r02evQ2zJEDUcRn3EsmOWM545ngmJ_uo1YzhOcaGhhWE7mwMeDLLP_54ktrEttqWuecPrsO63Rp3hB8djarRCyljPu1sLQGI0Rfse8Ueq-kew1-rCDPMHiabD4brBN5HPEcCWzkTh8BwMyLTPoJj-QY.EA1A50HGjsyvNn-l5uGRGg

[!] there was an error decrypting the JWT: square/go-jose: error in cryptographic primitive

[-] Authorization JWT not signed with server's interface key, trying again with PSK... [DEBUG]Agent wait time: [-]The returned Agent wait time was empty, using default 60s [!]The JWT claims were not valid for 546d32c9-9a89-45d3-bbba-9f58bfae8632 [-]Agent Wait Time: 60s, Time now: 2021-06-23 12:36:44.154549379 +0200 CEST m=+10261.529613865 [-]JWT Claim Expiry: 2021-06-23 12:35:25 +0200 CEST [-]JWT Claim Issued: 2021-06-23 12:35:15 +0200 CEST

[-] Authorization JWT not signed with PSK, returning 404...

[!] square/go-jose/jwt: validation failed, token is expired (exp)

Ne0nd0g commented 3 years ago

Looks like we're still running into the same problem, but for a different reason. The JWT expired at 2021-06-23 12:35:25 +0200 CEST and was evaluated at 2021-06-23 12:36:44.154549379 +0200 CEST. The JWT was invalid because the expiration time was reached. I'm speculating that the crypto is too slow and causing the delay. One work around to try is set the agent's sleep time to 2 minutes. We can also reduce the crypto rounds in the source to see if that lightens the load. I'll post a link of what lines to modify in the source.

Ne0nd0g commented 3 years ago

Increase the time from 10 seconds to 60 seconds on this line and see if that works better https://github.com/Ne0nd0g/merlin-agent/blob/master/clients/http/http.go#L264

h00die-gr3y commented 3 years ago

Hi Russel, Played around with your suggestion to increase the expiry date from 10 to 60 seconds. It allows me to authenticate now without an error 404, however I get a re-authentication message due to an expired JWT when the agent checks in again. Also the agent information is not properly displayed when I check it with the sessions command.

Connecting to the agent and submitting a command like ls is executed on the agent however the job submission results to the server triggers the expiry JWT message and initiate the re-authentication. I have shared the sequence of events below without debug to understand the issue better.

I also played with the number and increased from 60 to 120 seconds and also tried 300 seconds. All the with the same results. I am really wondering if this is the solution to the problem because I do not see this behavior with other agents.

Agent output with 300 seconds expiry: UNIXNET_NAS> ./merlinAgent-Linux-arm5 -v -url https://192.168.201.19:443 -psk merlin [i]Host Information: [i] Agent UUID: 0c5c9caf-4312-4dcc-b998-0c5158a0c051 [i] Platform: linux [i] Architecture: arm [i] User Name: root [i] User GUID: 0 [i] Hostname: UNIXNET_NAS [i] PID: 30139 [i] IPs: [127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] [i]Client information: [i] Protocol: h2 [i] URL: https://192.168.201.19:443 [i] User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36 [i] HTTP Host Header: [i] Payload Padding Max: 4096 [i] JA3 String: [-]Agent version: 1.0.1 [-]Agent build: 70c07d5831774f1f271ca9f6420c2c0ee66d3a2c [-]Starting OPAQUE Registration [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server registration initialization message [-]Sending OPAQUE message to https://192.168.201.19:443 [-]OPAQUE registration complete [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server complete message [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Agent authentication successful [+]Jobs message type received! [+]AgentControl job type received! [-]Received Agent Control Message: agentInfo [-]Sleeping for 31.681s at 2021-06-23T19:18:09Z [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [+]OPAQUE message type received! [-]Received re-authentication request [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server complete message [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Agent authentication successful [+]Jobs message type received! [+]AgentControl job type received! [-]Received Agent Control Message: agentInfo [-]Sleeping for 30.279s at 2021-06-23T19:21:51Z [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [+]OPAQUE message type received! [-]Received re-authentication request [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server complete message [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Agent authentication successful [+]Jobs message type received! [+]Native job type received! [+]AgentControl job type received! [-]Received Agent Control Message: agentInfo [-]Sleeping for 30.111s at 2021-06-23T19:25:30Z [-]Executing native command: ls [+]listing directory contents for: ./ [+]Directory listing for: /root

-rw-r--r-- 2014-11-04 06:42:22 364 .profile -rwxr-xr-x 2021-06-23 19:13:23 7798784 merlinAgent-Linux-arm5 [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [+]OPAQUE message type received! [-]Received re-authentication request [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server complete message [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Agent authentication successful [+]Jobs message type received! [+]Native job type received! [+]AgentControl job type received! [-]Received Agent Control Message: agentInfo [-]Sleeping for 32.69s at 2021-06-23T19:29:10Z [-]Executing native command: ls [+]listing directory contents for: ./ [+]Directory listing for: /root

-rw-r--r-- 2014-11-04 06:42:22 364 .profile -rwxr-xr-x 2021-06-23 19:13:23 7798784 merlinAgent-Linux-arm5 [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [+]OPAQUE message type received! [-]Received re-authentication request [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server complete message [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Agent authentication successful [+]Jobs message type received! [+]AgentControl job type received! [-]Received Agent Control Message: agentInfo [-]Sleeping for 31.004s at 2021-06-23T19:32:54Z [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [+]OPAQUE message type received! [-]Received re-authentication request [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443

Merlin Server output with 300 seconds expiry: [+] New authenticated agent checkin for 0c5c9caf-4312-4dcc-b998-0c5158a0c051 at 2021-06-23T19:17:33Z Merlin» Merlin» sessions

           AGENT GUID              | PLATFORM | USER | HOST | TRANSPORT | STATUS

+--------------------------------------+----------+------+------+-----------+--------+ 0c5c9caf-4312-4dcc-b998-0c5158a0c051 | / | | | Unknown: |

Merlin» sessions

           AGENT GUID              | PLATFORM | USER | HOST | TRANSPORT | STATUS

+--------------------------------------+----------+------+------+-----------+--------+ 0c5c9caf-4312-4dcc-b998-0c5158a0c051 | / | | | Unknown: |

Merlin» [!] Agent 0c5c9caf-4312-4dcc-b998-0c5158a0c051 connected with expired JWT. Instructing agent to re-authenticate

[+] New authenticated agent checkin for 0c5c9caf-4312-4dcc-b998-0c5158a0c051 at 2021-06-23T19:21:15Z

[!] Agent 0c5c9caf-4312-4dcc-b998-0c5158a0c051 connected with expired JWT. Instructing agent to re-authenticate Merlin» Merlin» interact 0c5c9caf-4312-4dcc-b998-0c5158a0c051 Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» info Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» [!] Error converting to a time duration: time: invalid duration "" Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» ls

[-] Created job zsAtMDngDX for agent 0c5c9caf-4312-4dcc-b998-0c5158a0c051 at 2021-06-23T19:23:49Z Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» [+] New authenticated agent checkin for 0c5c9caf-4312-4dcc-b998-0c5158a0c051 at 2021-06-23T19:24:54Z Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» ls Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» [-] Created job IrORwhRsGP for agent 0c5c9caf-4312-4dcc-b998-0c5158a0c051 at 2021-06-23T19:25:04Z Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» Merlin[agent][0c5c9caf-4312-4dcc-b998-0c5158a0c051]» [!] Agent 0c5c9caf-4312-4dcc-b998-0c5158a0c051 connected with expired JWT. Instructing agent to re-authenticate

[+] New authenticated agent checkin for 0c5c9caf-4312-4dcc-b998-0c5158a0c051 at 2021-06-23T19:28:34Z

[!] Agent 0c5c9caf-4312-4dcc-b998-0c5158a0c051 connected with expired JWT. Instructing agent to re-authenticate

[+] New authenticated agent checkin for 0c5c9caf-4312-4dcc-b998-0c5158a0c051 at 2021-06-23T19:32:18Z

[!] Agent 0c5c9caf-4312-4dcc-b998-0c5158a0c051 connected with expired JWT. Instructing agent to re-authenticate

Ne0nd0g commented 3 years ago

My guess is that problem is that the crypto operations are too time consuming and causing the timeouts.

Many other platforms do not use JWTs to prevent replay attacks. Typically, as long as you know the password for encryption you're "authenticated" and messages will be processed.

h00die-gr3y commented 3 years ago

Hi Russel, I am using a Synology DiskStation DS209. I am using DSM version 4.2. I have shared the link to latest version: https://www.synology.com/en-global/support/download/DS209#system. You probably can use any arm5 image to test the agent because i have run the agent against on an old arm5 router. Same result.

Last but not least I tested with -sleep 60s but issue remains

h00die-gr3y commented 3 years ago

Hi Russel, I have some good news for you. I managed to get around the problem. I recompiled the agents with the latest version of Golang (1.16.5) and the issue has disappeared. I initially compiled the agents and server with go1.15.9. Maybe they fixed some bugs in the crypto. Saw some articles on the internet.

Anyhow, it works as charm now... I will close the issue...

Merlin» sessions

           AGENT GUID              | PLATFORM  | USER |    HOST     |    TRANSPORT    | STATUS

+--------------------------------------+-----------+------+-------------+-----------------+---------+ aea23a8f-e40f-4041-a77f-e8ceee4e88e8 | linux/arm | root | UNIXNET_NAS | HTTP/2 over TLS | Delayed

Merlin Version: 1.0.1
Merlin Build: 70c07d5831774f1f271ca9f6420c2c0ee66d3a2c
Go Version: **go1.16.5 linux/arm64**
GOPATH Environment Variable: /root/go
GOROOT Environment Variable: /usr/local/go
Operating System: Kali Linux ARM64 on Raspberry PI
h00die-gr3y commented 3 years ago

Well Russel, I was a bit too soon with my conclusion. Left it running for a while and got the error back. I think it was triggered by another issue (see bold marked message below in the agent output)

After this happened, the agent fails consistently checking in with the usual error described above. Also after fresh start.

[-]Checking in... [-]Sending StatusCheckIn message to https://192.168.201.19:443 [+]Idle message type received! [-]Received idle command, doing nothing [-]Sleeping for 11.817s at 2021-06-29T21:01:13Z [-]Checking in... [-]Sending StatusCheckIn message to https://192.168.201.19:443 [+]OPAQUE message type received! [-]Received re-authentication request [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Invalid: 0 message type received! [!]Input message was not for this agent (8c30d7d8-1988-41e3-9d22-84859d1974a4): {Version:0 ID:00000000-0000-0000-0000-000000000000 Type:0 Payload: Padding: Token:} [-]Sleeping for 11.408s at 2021-06-29T21:05:36Z [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [!]there was an error communicating with the server: 404 [-]2 out of 7 total failed checkins [+]Jobs message type received! [+]Result job type received! [-]Sleeping for 10.423s at 2021-06-29T21:07:11Z [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [!]there was an error communicating with the server: 404 [-]3 out of 7 total failed checkins

Merlin Server showed this error: [!] the 8370eb47-78b5-4b76-8b26-45c6cb90db64 agent has already been registered

[!] the 8370eb47-78b5-4b76-8b26-45c6cb90db64 agent has already been registered

[!] the 8370eb47-78b5-4b76-8b26-45c6cb90db64 agent has already been registered

[!] the 8370eb47-78b5-4b76-8b26-45c6cb90db64 agent has already been registered

Ne0nd0g commented 3 years ago

Glad you got the agent working momentarily by using the Go 1.16.5. I should have caught it earlier. The go.mod file requires Go 1.16 so you shouldn't have been able to use Go 1.15.

Can you confirm what version of the Server & Agent you are using? Can you run the agent with the -debug flag?

h00die-gr3y commented 3 years ago

Hi Russell, Here is another run... As you can see, we still have the timing issue, however with the new compiled version it has become more stable. I do think that there is still some more debug to be done to understand this a bit better. One thing I sensed that if I get in a 404 error with the agent, I can only recover to get the agent working again by rebooting my Linux server hosting the Merlin server and start a fresh Merlin server. I will share a broken session with debug output in a separate thread.

Merlin Version: 1.0.1 Merlin Build: 70c07d5831774f1f271ca9f6420c2c0ee66d3a2c Go Version: go1.16.5 linux/arm64 GOPATH Environment Variable: /root/go GOROOT Environment Variable: /usr/local/go Operating System: Kali Linux ARM64 on Raspberry PI

Merlin Server output: [+] Started HTTPS listener on 0.0.0.0:443 Merlin[listeners][Default]» [+] New authenticated agent checkin for 2584a462-a892-4894-b026-5e4ee688a08f at 2021-07-01T17:07:32Z

[!] Agent 2584a462-a892-4894-b026-5e4ee688a08f connected with expired JWT. Instructing agent to re-authenticate

[+] New authenticated agent checkin for 2584a462-a892-4894-b026-5e4ee688a08f at 2021-07-01T17:11:10Z Merlin[listeners][Default]» Merlin[listeners][Default]» back Merlin[listeners]» main Merlin» sessions

           AGENT GUID              | PLATFORM | USER | HOST | TRANSPORT | STATUS

+--------------------------------------+----------+------+------+-----------+--------+ 2584a462-a892-4894-b026-5e4ee688a08f | / | | | Unknown: |

Merlin» [!] Agent 2584a462-a892-4894-b026-5e4ee688a08f connected with expired JWT. Instructing agent to re-authenticate

[+] New authenticated agent checkin for 2584a462-a892-4894-b026-5e4ee688a08f at 2021-07-01T17:14:47Z Merlin» Merlin» sessions

           AGENT GUID              | PLATFORM | USER | HOST | TRANSPORT | STATUS

+--------------------------------------+----------+------+------+-----------+--------+ 2584a462-a892-4894-b026-5e4ee688a08f | / | | | Unknown: |

Merlin» sessions

           AGENT GUID              | PLATFORM  | USER |    HOST     |    TRANSPORT    | STATUS

+--------------------------------------+-----------+------+-------------+-----------------+---------+ 2584a462-a892-4894-b026-5e4ee688a08f | linux/arm | root | UNIXNET_NAS | HTTP/2 over TLS | Delayed

Merlin» interact 2584a462-a892-4894-b026-5e4ee688a08f Merlin[agent][2584a462-a892-4894-b026-5e4ee688a08f]» ls Merlin[agent][2584a462-a892-4894-b026-5e4ee688a08f]» [-] Created job tEFcwSknhY for agent 2584a462-a892-4894-b026-5e4ee688a08f at 2021-07-01T17:17:33Z

[-] Results job tEFcwSknhY for agent 2584a462-a892-4894-b026-5e4ee688a08f at 2021-07-01T17:19:23Z

[+] Directory listing for: /root

-rw-r--r-- 2014-11-04 06:42:22 364 .profile -rwxr-xr-x 2021-06-29 19:52:23 7798784 merlinAgent-Linux-arm5

Merlin[agent][2584a462-a892-4894-b026-5e4ee688a08f]» Merlin[agent][2584a462-a892-4894-b026-5e4ee688a08f]»

Agent Output: UNIXNET_NAS> ./merlinAgent-Linux-arm5 -v -url https://192.168.201.19:443 -psk merlin [i]Host Information: [i] Agent UUID: 2584a462-a892-4894-b026-5e4ee688a08f [i] Platform: linux [i] Architecture: arm [i] User Name: root [i] User GUID: 0 [i] Hostname: UNIXNET_NAS [i] PID: 31429 [i] IPs: [127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] [i]Client information: [i] Protocol: h2 [i] URL: https://192.168.201.19:443 [i] User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36 [i] HTTP Host Header: [i] Payload Padding Max: 4096 [i] JA3 String: [-]Agent version: 1.0.1 [-]Agent build: 70c07d5831774f1f271ca9f6420c2c0ee66d3a2c [-]Starting OPAQUE Registration [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server registration initialization message [-]Sending OPAQUE message to https://192.168.201.19:443 [-]OPAQUE registration complete [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server complete message [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Agent authentication successful [+]Jobs message type received! [+]AgentControl job type received! [-]Received Agent Control Message: agentInfo [-]Sleeping for 32.32s at 2021-07-01T17:08:43Z [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [+]OPAQUE message type received! [-]Received re-authentication request [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server complete message [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Agent authentication successful [+]Jobs message type received! [+]AgentControl job type received! [-]Received Agent Control Message: agentInfo [-]Sleeping for 31.948s at 2021-07-01T17:12:21Z [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [+]OPAQUE message type received! [-]Received re-authentication request [-]Starting OPAQUE Authentication [-]Sending OPAQUE message to https://192.168.201.19:443 [-]Received OPAQUE server complete message [-]Sending OPAQUE message to https://192.168.201.19:443 [+]Agent authentication successful [+]Jobs message type received! [+]AgentControl job type received! [-]Received Agent Control Message: agentInfo [-]Sleeping for 30.26s at 2021-07-01T17:15:58Z [-]Checking in... [-]Sending Jobs message to https://192.168.201.19:443 [+]Idle message type received! [-]Received idle command, doing nothing [-]Sleeping for 32.678s at 2021-07-01T17:17:29Z [-]Checking in... [-]Sending StatusCheckIn message to https://192.168.201.19:443 [+]Jobs message type received! [+]Native job type received! [-]Sleeping for 30.604s at 2021-07-01T17:19:03Z [-]Executing native command: ls [+]listing directory contents for: ./ [+]Directory listing for: /root

-rw-r--r-- 2014-11-04 06:42:22 364 .profile -rwxr-xr-x 2021-06-29 19:52:23 7798784 merlinAgent-Linux-arm5

h00die-gr3y commented 3 years ago

Debug output with 404 error:

Merlin Server Debug Output: Merlin» [!] Received HTTP/2.0 POST connection from 192.168.201.3:57768

[DEBUG] HTTP Connection Details: Host: 192.168.201.19:443 URI: / Method: POST Protocol: HTTP/2.0 Headers: map[Accept-Encoding:[gzip] Authorization:[Bearer eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..4cC6A94g7MOeMJ3j.79hDD0ALjOgC4JExf5yEjCMU9EdDN6Z7OiK_Np1R0tvnDnYrMQnxGNj8emwIEmUMS16WJIAQSiJNcidTc-ep4MLSe_M6ZSaMTEPswyA1YLK33dLt1vhVFCgk5wCJdCGa1lvIRcrcMjy_6_SmUFWq-Q0cmlIa3vvMnCkbF6Br-i_zboxMSoZRvGQKobRgt3o3PgJyQoWxOI5irlzEWotebVSP0qY36GI9PpVPleAuhBTv7nsKDqeHw4KAzEA.xOByn0OBN8Ntxihy3YrHCw] Content-Length:[6052] Content-Type:[application/octet-stream; charset=utf-8] User-Agent:[Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36]] TLS Negotiated Protocol: h2 TLS Cipher Suite: 4867 TLS Server Name: Content Length: 6052 [DEBUG]Entering into jwt.ValidateJWT

[-] Checking to see if authorization JWT was signed by server's interface key... [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..4cC6A94g7MOeMJ3j.79hDD0ALjOgC4JExf5yEjCMU9EdDN6Z7OiK_Np1R0tvnDnYrMQnxGNj8emwIEmUMS16WJIAQSiJNcidTc-ep4MLSe_M6ZSaMTEPswyA1YLK33dLt1vhVFCgk5wCJdCGa1lvIRcrcMjy_6_SmUFWq-Q0cmlIa3vvMnCkbF6Br-i_zboxMSoZRvGQKobRgt3o3PgJyQoWxOI5irlzEWotebVSP0qY36GI9PpVPleAuhBTv7nsKDqeHw4KAzEA.xOByn0OBN8Ntxihy3YrHCw [DEBUG]Entering into jwt.ValidateJWT

[!] there was an error decrypting the JWT: square/go-jose: error in cryptographic primitive

[-] Authorization JWT not signed with server's interface key, trying again with PSK... [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..4cC6A94g7MOeMJ3j.79hDD0ALjOgC4JExf5yEjCMU9EdDN6Z7OiK_Np1R0tvnDnYrMQnxGNj8emwIEmUMS16WJIAQSiJNcidTc-ep4MLSe_M6ZSaMTEPswyA1YLK33dLt1vhVFCgk5wCJdCGa1lvIRcrcMjy_6_SmUFWq-Q0cmlIa3vvMnCkbF6Br-i_zboxMSoZRvGQKobRgt3o3PgJyQoWxOI5irlzEWotebVSP0qY36GI9PpVPleAuhBTv7nsKDqeHw4KAzEA.xOByn0OBN8Ntxihy3YrHCw [DEBUG]there was an error getting the agent's wait time: 496ce3c4-eb6f-435e-8eba-ae9f97e18edb is not a valid agent [DEBUG]Agent wait time: [-]The returned Agent wait time was empty, using default 60s [DEBUG]agentID: 496ce3c4-eb6f-435e-8eba-ae9f97e18edb [DEBUG]Leaving jwt.ValidateJWT without error [DEBUG]Entering into jwt.DecryptJWE function [DEBUG]Input JWE String: eyJhbGciOiJQQkVTMi1IUzUxMitBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIiwicDJjIjo1MDAwMDAsInAycyI6Il9wX0RUY1VGd29fMlZMWTNFVklZUGcifQ.ANG_7704Z_4cbrBJ4d_3CSj25ifSJZ2Ajtg0MkSQFIi8f_H8XeC6bQ.LH1HYK_pRw-BfzxP.05PQGQ98Iehe0y0TgWQSgghkHkqgj-HwVBHRvVFuG3jXwi-xdgXiKDHgekvbXxYqn5eIjWBL8ZtE2PEnL2X_0_76x6k8FlkbD-oJSOEC4k_zeudgA7YzxneZmUoWQ6C8V4a6yIt-KBydhZ5XPMq-5lUnKsm0E8OL4GczumtDRxmz38zhn_I_vW92eckPnGWtozuP_bosR7cx7amZjCsyhdcvQbUJcKArSxa-EOx5sBjnrG9GJs5ODZy-qGd7Iahp_cop8pD-28aYRxbD5loHJzX_zGMWtBT6UlOWwvaliYkWhVOFCN17NCailviqphpl5OAwk4vBWmh7cmM8DaxyQZauDU4j6vFJMn8WPj6xqiRQjFbmd8BSDh3yJ9elTD4Je0g_7aoE3DhvGsAQdXlmrbDdR87l-HOwOMzthuRHHVZGQbD-RlqN-ocvWprXhw27_RzwSG9itnoFDmVVRYkt--BebcsN2F8cpTs27iL1iFJ1FANOiQW1i3s8564Urt7Bv7_79lEOcPSYk9e0KHKCbHaOu4zmrq-gVVAauhf2FIxY2nTuhN3i5di2eZ1lBEFyJobOfa-Gq2AOWLQ1UVyMsc0cJzdFHbJT3t6Z6VPqW59j0kbuy2b3Yb3n9KdiR-hN5MUJtrr79QMQ-saJwdZG1pIxZsmhXyWvCGzglLs-q4sMZSLieKqQlffMaCUnVWnE4MASpxpRe5Bzj4zgN9IhChiF9r6x_I74-qrlth4RLvNv_vH7Pq4ynosDWItc1eWckq6IuUCM8_w1KPfKIO8x-_O0yqg3BjNp5ndBX8veLbtujdSAQDsEwUyaZnkg-7H1D_aNV4DLAo1hieXQPUwVF0nps2UnTytvRaW1L8Xw8-2k3YRTbzGtqFiIwKRYb5uR6Su-SdrM5eDtG_bIVP2uDvJtkF_DJWp7E3tuYoqSwwYQKLSxM_iLzaTaLNYD0cjZ49qIVoGKa3qndXNg-QywOYyjohqebPdKVmU0dly5R-I3TolywjcUGHmERGz2mnUBep2hiw2ZsojFCW8AhC9os5waCjh3DHI-Nfo1gP2POn7XTJo2k8vrzGrVoBbjC77Ttzf45rp2_P9iJyWzSnPGj1nUsPb2ks9_LKG-nJovTon4tNf5gLS745mdUepSUoXiPGkL93fLOea9vSKqVDROgRQPIH5vywZWMO9oxj_ISF9QXB450sfNyuxcKwRDBD7A7-Sd1HTANkzO0PvhSWnWtiVrY9_Hq1H-8dORFUuHIUsopxNLZxgBgS72NdVTc6LOXlJRiU_oJUy_XnpiMKJs8rSelBmnmgtiyLKPD3tWLXlHAoB5SI5FAzo8ob70zEqc5k_uH2vqMm353YlcXxdHmeKmfGMFEZ_NhTGxt5o5UXHOA-usFxaRvaqmDieZwrYRAA3VqbyWAxYF_JGzYKExFNpQXB4f3XQ1HBaJqU_HwmN5b03FQnMKbFBBWvYYNjgONr-eSXex43W0J3D69tubfayMxJeSnjhYmW4gsxhwUpI23SDca07sOrMWSJPUtdDHUU_7BD3mx3vQcigmLr-n4IpT1Yw4FDeqq8pAEJELSDZDP9Iea2ikCxtsM_6U8YT8paPIwX7LsZrlmmKbK0ujn81VUhCpZANakI4LIujMu_D_qyLfJTsmOrLsyguzSvF5nuhLM9sVl8dk1QqPvduc98QYULruPkMEHRrP1qy7_MXBjVFnI_xFzu-g5Py-G2KQPrlpLl9x9H59uU7UyV0GNERCgaL7NAIR6UCxwVqJvjMFE7-CWSHDsW8CT_9qgmfANfqnq-sFoidpGihLj_yquvOu1GdoaPQnHJyZ7u1VB4k7OexsTBWnbTeEP7CaKBZguSOac9EWP_P5avXI3jTHz2X07WuCVHg7GjSKBEyLDnZWLeUPU9OMH3QBzQhKEJf9ruEWb9vaCtW5Jt00mW4hcSec67cfUt05vSlzoJq53O9HP1GF73whR5gjc7gSchSs_Fa8CB3NYQMNMfCi8BPNaYG8kPoWpapbRuVMZAEU5NDyedz9PlWX8VYcoEiEl0OXPVao2pthh_Xa3rRl3wgB9oDmSwO2Pj0vb3nB-svgMcF4fP3JHMIivib2vBxDRzdwf7QjYZ-7OIoC8hQCmMrHZ3Xw3F8SLIbGRHv1Av3d9_2LOGAeecNb8o2EO6bHpRAfENILYq1KlqMzQqtZMcduUUe35x1CKqSl9lEYqKf7D-IZ7XnMq1yU7OBQZbNg-ChTKtH4N_T64VAXz6VnIgQ1W4j0QhGKE2u8B0LJ4zuG8qjyaUueD1Ocf9k_skO9E3U2E8iY4u0vdySYxfrkCBu-BgjJzbbvjgLBzLGmXQC-4kkdG-PxG-oLGrrngyofYI2k23bKzXT4-4sziJEpKDxvzuKLfo1IbTjJ00tSSqSWhedGRt5wOj3NfMwyrPZySJjRsXOm751SUx4yD2wXWxwqnCthyEObhhTcE36eoW6OoKSfS7LUXA_4inOYWEx-CTpe2woEmvSIxfN14CiMqbbDFXJe-quoiMxNUATy2mb5UJ3Rvxz19T8NVRvwT1Xo1r0RALXi9x1HYf7ERZb0jFoiYx6N22JdccUjvwj-SvVrzbzt0jvUDZDG_sy1Bqhn-csp2OIUflfhJEwooRBL5NwMkuqoJwk2QY07gJIsLOV0oPUJFQACZn89WVPUOxJFF3BlyFgF7GhHNzD2f3wjtfZbhGcZDdxXybI8dM85vbzQhmm-Ld7RmOLHVnriVpBjWhWwhzsnPlIdCfSK0oSvioqNaDbEnJUl848KbjUQ6brtRQVI1qaVIOLNi7vOdMd9d5XsYAR_rt4jvYKxsIB5wh-yEG112jn4TuMrIkCE4lsbnR2D92L226pBaS-TUIM8dbLwhy8HCpAQ_1tzdM7U1fiD5hZj5I9jSub6lNIccTCAHEiwjuk7O05IYqb4hKvgu3TKLQkIIQvxfED4jsdLqbN4t2noa_t2OEqC_AUR0wyGojl5qaSirLE4pdDTVBVcVC1cg0K4qfKmT0l0AvEa8NfrLJgx3RhIOGylXoxbofzc-Fi3lwQyVlfsnP68Wf09-XZ52p47Gp5ln5hU9oy13Ektjm7x6CLRLmpfmeKsZIhvwvGZSSp_pSyWO3_t4con3T9d-PwR_VBgWbk-HoJmQS9d3vPKa0vi2XasX4xNLLdL-NsZ7IqNj32fmifOYowy_1aMoq2XqQiL_0FmXgvhTmRXm4uPF5zSIyt5eVn9JW4HcjMTJtAzM0J_0HOg_nBXZh2SUI8Xs2xfGW8FMVwd0VyOo71l9nIIvoAw0ucrDaOVWJm3hxGUbRvqQSmJhiLxz5bPomgCxzOaM_cKgm3EALfJVcMJiWfVHgrOdAw6WitOyKFm_BtbPb9byAYjDviI868rbHPkUknmp59HiUmC8iy0ehNKfYdpdBpODl8hRSu4x-HA1UxYiRNpmUX97qI0637nTZTh2zd1OJ9gqI8-UQAjXJ6fy2P6byDyvXlWZO-2afhODX5BTsfmKfylg_65hf9qEXOKIlFBeMl7Ez_wbQuBLKiMkZf5jWjEAfO5FBttBCluCUmblJH8i1SiBqXqrEqH5pBh-YEntZ_3BSwx1edDwQxyue04eX-e7738xIzmmrUW-sTWPagtlvfpmeVWuk198_cTCW1Nbt__O3A67o8AahmaxJUBJSi-naI-E0CaiQ7ZKRbJDauLSc0YbNypdWpBMdD0Ocy6imvL8CuUQuOaifnQOiS8AULc6a7mthL_lwI62PMru5t39_mDhwNs7wxEfE5XrxsA-_iMUAY48TmsKvMNS-DDFOQfsNWTV_giQ80GaksKabgfsOhWD-Vh8E4Qmp3n5ySV0lZaDnWSLRz51AYeZ6uROHwnHVqrp3p5MRMf0yDXxUMTQ_XkvDIHXAJdivvPq99-vaZBjzh7pqJFOgzemI86adSkMaFLDqRv0R4HMNamkHxsr-W8v7rNFgHeyZQ7Mw3Al-BmWMsyAr5d789FAWN2dUVe7-x00zl9nIDo1mLJQISdJDse0RAO3l1CDXIxXF1ohxTtqHc09iDz_upR93t2HU0jflAM0AqyzdL1WPVmeKgX856E9ha_kgT1WV65AuLf1cOK6al09Dwn8ZSCrFjRGJ_CzVPN2Q8DXzCnLK8FMZCCBaowgRBBj97rSen9OhNOzOxP2iEcbcYRqSH1noZ9rhwhwqnbI6keY56zqBpt_sUuhX_hd6J_vgsqXcl09TYCdFvJlyOW2ePh3JpSxi-EUnMRp1nZiQhWaxndl64-2tFDD6oQtlC46Q4DLt76Bc9HyC5SV62KgzKjQQidxKtf51l-syg82Jx8-pK8kyb8d0WzOEpsr0Kkk--30hyymA7_Ro_EN1WstcW6MVx6XwAekx73AsydM0yF7OIKo9CUU34wkbqchZb4PVYgkcUu5qx1kzGVBSh_1be8X3u9_cUrikcx_hQJuBZG3pEJmLxFEPELqZu0xPY1jHjO70JBotN4jIAsU0d9CzRIeVVWTRh70FjVWQnCKUiq5Y0evXmbRxSOqrXTr5uo4uy0VSWD0dgXEQZ6jT6pw8FsjWjdR4j_AdQOpulhBiq1B59aJhwXP-grMy2_f6U3wDtsC-wU1PXkRPX5B6YsV0JTWnfwSgD3X8Ad9qgSJr2uS0l1T_wsOrw-mUB9Jz_1g7XXpuLEWKQqrqCV2PlK3KwOMZMz781tRt36HMVAGgYK1Pr4vYeCJOIAgVrain9uKYx9sF_L8uM2zi8y7CsbI34j4svrecw90nJ-qft5HtLTd_R775d76La_uuSPlarCVysT0ydipQ_B_RlSC8IKVpkIoq8zp9uvRxyCxC7qFbEhbw4e6QMymJnjHQ_apZTQ-RhYPzlbWyhevaY0IoTdyqd_2UCevaGrC2u9QfA3mRsgP1IlFM9hP7GtB2w8_t04x9FZFeKNNv0P2sONDqmW3jsDZwPriEgN8Gjq2GA0NKJJ0tWnVdeU63FPB1JtZQswHROFB4mJ8PsPhdTdvc2GXwR3ksUXW0NJH-hX1vwVT1iSkuXw7DZnsd55Rh2I6P4j8EfKwHId6DQyFvVZ8skLUrzvGqg3kOvRZWfCZ_bi8MFiERixQprsdKTjDUxgCMh82C4J_uzl4vz8SzYLqRHZVV21cmqW-MKY-lOlhv8XEIRLDXyUKBuqgi5p0jwAWNOdkWojvK4wenNz7y0wc8NiTXgTebAiLqkGykGp52ueEgEB4nFQZ06EntynTOvTsIWZnHNQpp8op1VHS7vzz0Gl1j3xmD8dab4Ze-50hOzqLHtNDlelaa-vZInmfoPK-7gUZWjl98bpeXGqxHzNtizYP-cnaN6U4NroRt-YKvMHqx4NeXc_PKg33LLSV1azePrIWHGNAf-JYI9535LkUeQYGI5FFJmXgPEKxjDqldI_M6ipTmC1D796AssDIfVpNe9BqMSl1NKYjuzGAhHIExCrDdshb0Fg7mmjh3dBO_D978t-YEhHohXJLK1cg1Ha0UEmiIsZOJ0PxVm6VpQemoTkETtstf3qszMz8jWHFDky9XyDO2at_tp0Gjg9A-VjRAGDtdrrbcpAW5CrK8F2vXZpPM8VZmtKIImzo7I5nEnU9ph11bxzhFGARm5Pavs5gjiyPOEFhxSN7cds78BykxjSbc-dApOY6eQMDyC4D1zqsHk0doppZegUbGhUtQFJQLZRiJfA9FLojOmvWbNSSuoWp3jeFWGLnifTB_zNLvQptNjbjzdGuNy73fpm8RHI0Wuh1oOv2WT7RRlDfWrnwuL0zlsNBYsNm9X0Dn8YWPXnWPm2DPJ11vbMC05WmMQy1SiYz_plqPRQ.4mMdaSFfnK8wg8ZGIwDEYw

[i] UnAuthenticated JWT [DEBUG]Parsed JWE: &{Header:{KeyID: JSONWebKey: Algorithm:PBES2-HS512+A256KW Nonce: certificates:[] ExtraHeaders:map[enc:A256GCM p2c:500000 p2s:_p_DTcUFwo_2VLY3EVIYPg]} protected:0x40002e2060 unprotected: recipients:[{header: encryptedKey:[0 209 191 239 189 56 103 254 28 110 176 73 225 223 247 9 40 246 230 39 210 37 157 128 142 216 52 50 68 144 20 136 188 127 241 252 93 224 186 109]}] aad:[] iv:[44 125 71 96 175 233 71 15 129 127 60 79] ciphertext:[211 147 208 25 15 124 33 232 94 211 45 19 129 100 18 130 8 100 30 74 160 143 225 240 84 17 209 189 81 110 27 120 215 194 47 177 118 5 226 40 49 224 122 75 219 95 22 42 159 151 136 141 96 75 241 155 68 216 241 39 47 101 255 211 254 250 199 169 60 22 89 27 15 234 9 72 225 2 226 79 243 122 231 96 3 182 51 198 119 153 153 74 22 67 160 188 87 134 186 200 139 126 40 28 157 133 158 87 60 202 190 230 85 39 42 201 180 19 195 139 224 103 51 186 107 67 71 25 179 223 204 225 159 242 63 189 111 118 121 201 15 156 101 173 163 59 143 253 186 44 71 183 49 237 169 153 140 43 50 133 215 47 65 181 9 112 160 43 75 22 190 16 236 121 176 24 231 172 111 70 38 206 78 13 156 190 168 103 123 33 168 105 253 202 41 242 144 254 219 198 152 71 22 195 230 90 7 39 53 255 204 99 22 180 20 250 82 83 150 194 246 165 137 137 22 133 83 133 8 221 123 52 38 162 150 248 170 166 26 101 228 224 48 147 139 193 90 104 123 114 99 60 13 172 114 65 150 174 13 78 35 234 241 73 50 127 22 62 62 177 170 36 80 140 86 230 119 192 82 14 29 242 39 215 165 76 62 9 123 72 63 237 170 4 220 56 111 26 192 16 117 121 102 173 176 221 71 206 229 248 115 176 56 204 237 134 228 71 29 86 70 65 176 254 70 90 141 250 135 47 90 154 215 135 13 187 253 28 240 72 111 98 182 122 5 14 101 85 69 137 45 251 224 94 109 203 13 216 95 28 165 59 54 238 34 245 136 82 117 20 3 78 137 5 181 139 123 60 231 174 20 174 222 193 191 191 251 246 81 14 112 244 152 147 215 180 40 114 130 108 118 142 187 140 230 174 175 160 85 80 26 186 23 246 20 140 88 218 116 238 132 221 226 229 216 182 121 157 101 4 65 114 38 134 206 125 175 134 171 96 14 88 180 53 81 92 140 177 205 28 39 55 69 29 178 83 222 222 153 233 83 234 91 159 99 210 70 238 203 102 247 97 189 231 244 167 98 71 232 77 228 197 9 182 186 251 245 3 16 250 198 137 193 214 70 214 146 49 102 201 161 95 37 175 8 108 224 148 187 62 171 139 12 101 34 226 120 170 144 149 247 204 104 37 39 85 105 196 224 192 18 167 26 81 123 144 115 143 140 224 55 210 33 10 24 133 246 190 177 252 142 248 250 170 229 182 30 17 46 243 111 254 241 251 62 174 50 158 139 3 88 139 92 213 229 156 146 174 136 185 64 140 243 252 53 40 247 202 32 239 49 251 243 180 202 168 55 6 51 105 230 119 65 95 203 222 45 187 110 141 212 128 64 59 4 193 76 154 102 121 32 251 177 245 15 246 141 87 128 203 2 141 97 137 229 208 61 76 21 23 73 233 179 101 39 79 43 111 69 165 181 47 197 240 243 237 164 221 132 83 111 49 173 168 88 136 192 164 88 111 155 145 233 43 190 73 218 204 229 224 237 27 246 200 84 253 174 14 242 109 144 95 195 37 106 123 19 123 110 98 138 146 195 6 16 40 180 177 51 248 139 205 164 218 44 214 3 209 200 217 227 218 136 86 129 138 107 122 167 117 115 96 249 12 176 57 140 163 162 26 158 108 247 74 86 101 52 118 92 185 71 226 55 78 137 114 194 55 20 24 121 132 68 108 246 154 117 1 122 157 161 139 13 153 178 136 197 9 111 0 132 47 104 179 156 26 10 56 119 12 114 62 53 250 53 128 253 143 58 126 215 76 154 54 147 203 235 204 106 213 160 22 227 11 190 211 183 55 248 230 186 118 252 255 98 39 37 179 74 115 198 143 89 212 176 246 246 146 207 127 44 161 190 156 154 47 78 137 248 180 215 249 128 180 187 227 153 157 81 234 82 82 133 226 60 105 11 247 119 203 57 230 189 189 34 170 84 52 78 129 20 15 32 126 111 203 6 86 48 239 104 198 63 200 72 95 80 92 30 57 210 199 205 202 236 92 43 4 67 4 62 192 239 228 157 212 116 192 54 76 206 208 251 225 73 105 214 182 37 107 99 223 199 171 81 254 241 211 145 21 75 135 33 75 40 167 19 75 103 24 1 129 46 246 53 213 83 115 162 206 94 82 81 137 79 232 37 76 191 94 122 98 48 162 108 242 180 158 148 25 167 154 11 98 200 178 143 15 123 86 45 121 71 2 128 121 72 142 69 3 58 60 161 190 244 204 74 156 230 79 238 31 107 234 50 109 249 221 137 92 95 23 71 153 226 166 124 99 5 17 159 205 133 49 177 183 154 57 81 113 206 3 235 172 23 22 145 189 170 166 14 39 153 194 182 17 0 13 213 169 188 150 3 22 5 252 145 179 96 161 49 20 218 80 92 30 31 221 116 53 28 22 137 169 79 199 194 99 121 111 77 197 66 115 10 108 80 65 90 246 24 54 56 14 54 191 158 73 119 177 227 117 180 39 112 250 246 219 155 125 172 140 196 151 146 158 56 88 153 110 32 179 24 112 82 146 54 221 32 220 107 78 236 58 179 22 72 147 212 181 208 199 81 79 251 4 61 230 199 123 208 114 40 38 46 191 167 224 138 83 213 140 56 20 55 170 171 202 64 16 145 11 72 54 67 63 210 30 107 104 164 11 27 108 51 254 148 241 132 252 165 163 200 193 126 203 177 154 229 154 98 155 43 75 163 159 205 85 82 16 169 100 3 90 144 142 11 34 232 204 187 240 255 171 34 223 37 59 38 58 178 236 202 11 179 74 241 121 158 232 75 51 219 21 151 199 100 213 10 143 189 219 156 247 196 24 80 186 238 62 67 4 29 26 207 214 172 187 252 197 193 141 81 103 35 252 69 206 239 160 228 252 190 27 98 144 62 185 105 46 95 113 244 126 125 185 78 212 201 93 6 52 68 66 129 162 251 52 2 17 233 64 177 193 90 137 190 51 5 19 191 130 89 33 195 177 111 2 79 255 106 130 103 192 53 250 167 171 235 5 162 39 105 26 40 75 143 252 170 186 243 174 212 103 104 104 244 39 28 156 153 238 237 85 7 137 59 57 236 108 76 21 167 109 55 132 63 176 154 40 22 96 185 35 154 115 209 22 63 243 249 106 245 200 222 52 199 207 101 244 237 107 130 84 120 59 26 52 138 4 76 139 14 118 86 45 229 15 83 211 140 31 116 1 205 8 74 16 151 253 174 225 22 111 219 218 10 213 185 38 221 52 153 110 33 113 39 156 235 183 31 82 221 57 189 41 115 160 154 185 220 239 71 63 81 133 239 124 33 71 152 35 115 184 18 114 20 172 252 86 188 8 29 205 97 3 13 49 240 162 240 19 205 105 129 188 144 250 22 165 170 91 70 229 76 100 1 20 228 208 242 121 220 253 62 85 151 241 86 28 160 72 132 151 67 151 61 86 168 218 155 97 135 245 218 222 180 101 223 8 1 246 128 230 75 3 182 62 61 47 111 121 193 250 203 224 49 193 120 124 253 201 28 194 34 190 38 246 188 28 67 71 55 112 127 180 35 97 159 187 56 138 2 242 20 2 152 202 199 103 117 240 220 95 18 44 134 198 68 123 245 2 253 221 247 253 139 56 96 30 121 195 91 242 141 132 59 166 199 165 16 31 16 210 11 98 173 74 150 163 51 66 171 89 49 199 110 81 71 183 231 29 66 42 164 165 246 81 24 168 167 251 15 226 25 237 121 204 171 92 148 236 224 80 101 179 96 248 40 83 42 209 248 55 244 250 225 80 23 207 165 103 34 4 53 91 136 244 66 17 138 19 107 188 7 66 201 227 59 134 242 168 242 105 75 158 15 83 156 127 217 63 178 67 189 19 117 54 19 200 152 226 237 47 119 36 152 197 250 228 8 27 190 6 8 201 205 182 239 142 2 193 204 177 166 93 0 190 226 73 29 27 227 241 27 234 11 26 186 231 131 42 31 96 141 164 219 118 202 205 116 248 251 139 51 136 145 41 40 60 111 206 226 139 126 141 72 109 56 201 211 75 82 74 164 150 133 231 70 70 222 112 58 61 205 124 204 50 172 246 114 72 152 209 177 115 166 239 157 82 83 30 50 15 108 23 91 28 42 156 43 97 200 67 155 134 20 220 19 126 158 161 110 142 160 164 159 75 178 212 92 15 248 138 115 152 88 76 126 9 58 94 219 10 4 154 244 136 197 243 117 224 40 140 169 182 195 21 114 94 250 171 168 136 204 77 80 4 242 218 102 249 80 157 209 191 28 245 245 63 13 85 27 240 79 85 232 214 189 17 0 181 226 247 29 71 97 254 196 69 150 244 140 90 34 99 30 141 219 98 93 113 197 35 191 8 254 74 245 107 205 188 237 210 59 212 13 144 198 254 204 181 6 168 103 249 203 41 216 226 20 126 87 225 36 76 40 161 16 75 228 220 12 146 234 168 39 9 54 65 141 59 128 146 44 44 229 116 160 245 9 21 0 2 102 127 61 89 83 212 59 18 69 23 112 101 200 88 5 236 104 71 55 48 246 127 124 35 181 246 91 132 103 25 13 220 87 201 178 60 116 207 57 189 188 208 134 105 190 45 222 209 152 226 199 86 122 226 86 144 99 90 21 176 135 59 39 62 82 29 9 244 138 210 132 175 138 138 141 104 54 196 156 149 37 243 143 10 110 53 16 233 186 237 69 5 72 214 166 149 32 226 205 139 187 206 116 199 125 119 149 236 96 4 127 174 222 35 189 130 177 176 128 121 194 31 178 16 109 117 218 57 248 78 227 43 34 64 132 226 91 27 157 29 131 247 98 246 219 170 65 105 47 147 80 131 60 117 178 240 135 47 7 10 144 16 255 91 115 116 206 212 213 248 131 230 22 99 228 143 99 74 230 250 148 210 28 113 48 128 28 72 176 142 233 59 59 78 72 98 166 248 132 171 224 187 116 202 45 9 8 33 11 241 124 64 248 142 199 75 169 179 120 183 105 232 107 251 118 56 74 130 252 5 17 211 12 134 162 57 121 169 164 162 172 177 56 165 208 211 84 21 92 84 45 92 131 66 184 169 242 166 79 73 116 2 241 26 240 215 235 44 152 49 221 24 72 56 108 165 94 140 91 161 252 220 248 88 183 151 4 50 86 87 236 156 254 188 89 253 61 249 118 121 218 158 59 26 158 101 159 152 84 246 140 181 220 73 45 142 110 241 232 34 209 46 106 95 153 226 172 100 136 111 194 241 153 73 42 127 165 44 150 59 127 237 225 202 39 221 63 93 248 252 17 253 80 96 89 185 62 30 130 102 65 47 93 222 243 202 107 75 226 217 118 172 95 140 77 44 183 75 248 219 25 236 138 141 143 125 159 154 39 206 98 140 50 255 86 140 162 173 151 169 8 139 255 65 102 94 11 225 78 100 87 155 139 143 23 156 210 35 43 121 121 89 253 37 110 7 114 51 19 38 208 51 51 66 127 208 115 160 254 112 87 102 29 146 80 143 23 179 108 95 25 111 5 49 92 29 209 92 142 163 189 101 246 114 8 190 128 48 210 231 43 13 163 149 88 153 183 135 17 148 109 27 234 65 41 137 134 34 241 207 150 207 162 104 2 199 51 154 51 247 10 130 109 196 0 183 201 85 195 9 137 103 213 30 10 206 116 12 58 90 43 78 200 161 102 252 27 91 61 191 91 200 6 35 14 248 136 243 175 43 108 115 228 82 73 230 167 159 71 137 73 130 242 44 180 122 19 74 125 135 105 116 26 78 14 95 33 69 43 184 199 225 192 213 76 88 137 19 105 153 69 253 238 162 52 235 126 231 77 148 225 219 55 117 56 159 96 168 143 62 81 0 35 92 158 159 203 99 250 111 32 242 189 121 86 100 239 182 105 248 78 13 126 65 78 199 230 41 252 165 131 254 185 133 255 106 17 115 138 34 81 65 120 201 123 19 63 240 109 11 129 44 168 140 145 151 249 141 104 196 1 243 185 20 27 109 4 41 110 9 73 155 148 145 252 139 84 162 6 165 234 172 74 135 230 144 97 249 129 39 181 159 247 5 44 49 213 231 67 193 12 114 185 237 56 121 127 158 239 189 252 196 140 230 154 181 22 250 196 214 61 168 45 150 247 233 153 229 86 186 77 125 243 247 19 9 109 77 110 223 255 59 112 58 238 143 0 106 25 154 196 149 1 37 40 190 157 162 62 19 64 154 137 14 217 41 22 201 13 171 139 73 205 24 108 220 169 117 106 65 49 208 244 57 204 186 138 107 203 240 43 148 66 227 154 137 249 208 58 36 188 1 66 220 233 174 230 182 18 255 151 2 58 216 243 43 187 155 119 247 249 131 135 3 108 239 12 68 124 78 87 175 27 0 251 248 140 80 6 56 241 57 172 42 243 13 75 224 195 20 228 31 176 213 147 87 248 34 67 205 6 106 75 10 105 184 31 176 232 86 15 229 97 240 78 16 154 157 231 231 36 149 210 86 90 14 117 146 45 28 249 212 6 30 103 171 145 56 124 39 29 90 171 167 122 121 49 19 31 211 32 215 197 67 19 67 245 228 188 50 7 92 2 93 138 251 207 171 223 126 189 166 65 143 56 123 166 162 69 58 12 222 152 143 58 105 212 164 49 161 75 14 164 111 209 30 7 48 214 166 144 124 108 175 229 188 191 186 205 22 1 222 201 148 59 51 13 192 151 224 102 88 203 50 2 190 93 239 207 69 1 99 118 117 69 94 239 236 116 211 57 125 156 128 232 214 98 201 64 132 157 36 59 30 209 16 14 222 93 66 13 114 49 92 93 104 135 20 237 168 119 52 246 32 243 254 234 81 247 123 118 29 77 35 126 80 12 208 10 178 205 210 245 88 245 102 120 168 23 243 158 132 246 22 191 146 4 245 89 94 185 2 226 223 213 195 138 233 169 116 244 60 39 241 148 130 172 88 209 24 159 194 205 83 205 217 15 3 95 48 167 44 175 5 49 144 130 5 170 48 129 16 65 143 222 235 73 233 253 58 19 78 204 236 79 218 33 28 109 198 17 169 33 245 158 134 125 174 28 33 194 169 219 35 169 30 99 158 179 168 26 109 254 197 46 133 127 225 119 162 127 190 11 42 93 201 116 245 54 2 116 91 201 151 35 150 217 227 225 220 154 82 198 47 132 82 115 17 167 89 217 137 8 86 107 25 221 151 174 62 218 209 67 15 170 16 182 80 184 233 14 3 46 222 250 5 207 71 200 46 82 87 173 138 131 50 163 65 8 157 196 171 95 231 89 126 179 40 60 216 156 124 250 146 188 147 38 252 119 69 179 56 74 108 175 66 164 147 239 183 210 28 178 152 14 255 70 143 196 55 85 172 181 197 186 49 92 122 95 0 30 147 30 247 2 204 157 51 76 133 236 226 10 163 208 148 83 126 48 145 186 156 133 150 248 61 86 32 145 197 46 230 172 117 147 49 149 5 40 127 213 183 188 95 123 189 253 197 43 138 71 49 254 20 9 184 22 70 222 145 9 152 188 69 16 241 11 169 155 180 196 246 53 140 120 206 239 66 65 162 211 120 140 128 44 83 71 125 11 52 72 121 85 86 77 24 123 208 88 213 89 9 194 41 72 170 229 141 30 189 121 155 71 20 142 170 181 211 175 155 168 226 236 180 85 37 131 209 216 23 17 6 122 141 62 169 195 193 108 141 104 221 71 136 255 1 212 14 166 233 97 6 42 181 7 159 90 38 28 23 63 232 43 51 45 191 127 165 55 192 59 108 11 236 20 212 245 228 68 245 249 7 166 44 87 66 83 90 119 240 74 0 247 95 192 29 246 168 18 38 189 174 75 73 117 79 252 44 58 188 62 153 64 125 39 63 245 131 181 215 166 226 196 88 164 42 174 160 149 216 249 74 220 172 14 49 147 51 239 205 109 70 221 250 28 197 64 26 6 10 212 250 248 189 135 130 36 226 0 129 90 218 138 127 110 41 140 125 176 95 203 242 227 54 206 47 50 236 43 27 35 126 35 226 203 235 121 204 61 210 114 126 169 251 121 30 210 211 119 244 123 239 151 123 232 182 191 186 228 143 149 170 194 87 43 19 211 39 98 165 15 193 253 25 82 11 194 10 86 153 8 162 175 51 167 219 175 71 28 130 196 46 234 21 177 33 111 14 30 233 3 50 152 153 227 29 15 218 165 148 208 249 24 88 63 57 91 91 40 94 189 166 52 34 132 221 202 167 127 217 64 158 189 161 171 11 107 189 65 240 55 153 27 32 63 82 37 20 207 97 63 177 173 7 108 60 254 221 56 199 209 89 21 226 141 54 253 15 218 195 141 14 169 150 222 59 3 103 3 235 136 72 13 240 104 234 216 96 52 52 162 73 210 213 167 85 215 148 235 113 79 7 82 109 101 11 48 29 19 133 7 137 137 240 251 15 133 212 221 189 205 134 95 4 119 146 197 23 91 67 73 31 232 87 214 252 21 79 88 146 146 229 240 236 54 103 177 222 121 70 29 136 232 254 35 240 71 202 192 114 29 232 52 50 22 245 89 242 201 11 82 188 239 26 168 55 144 235 209 101 103 194 103 246 226 240 193 98 17 24 177 66 154 236 116 164 227 13 76 96 8 200 124 216 46 9 254 236 229 226 252 252 75 54 11 169 17 217 85 93 181 114 106 150 248 194 152 250 83 165 134 255 23 16 132 75 13 124 148 40 27 170 130 46 105 210 60 0 88 211 157 145 106 35 188 174 48 122 115 115 239 45 48 115 195 98 77 120 19 121 176 34 46 169 6 202 65 169 231 107 158 18 1 63 7 137 197 65 157 58 18 123 114 157 51 175 78 194 22 102 113 205 66 154 124 162 157 85 29 46 239 207 61 6 151 88 247 198 96 252 117 166 248 101 239 254 231 72 78 206 162 199 180 208 229 122 86 154 250 246 72 158 103 232 60 175 187 129 70 86 142 95 124 110 151 151 26 172 71 204 219 98 205 131 254 114 118 141 233 78 13 174 132 109 249 130 175 48 122 177 224 215 151 115 243 202 131 125 203 45 37 117 107 55 143 172 133 135 24 208 31 248 150 8 247 157 249 46 69 30 65 129 136 228 81 73 153 120 15 16 172 99 14 169 93 35 243 58 138 148 230 11 80 251 247 160 44 176 50 31 86 147 94 244 26 140 74 93 77 41 136 238 204 96 33 28 129 49 10 176 221 178 22 244 22 14 230 154 56 119 116 19 191 15 222 252 183 230 4 132 122 33 92 146 202 213 200 53 29 173 20 18 104 136 177 147 137 208 252 85 155 165 105 65 233 168 78 65 19 182 203 95 222 171 51 51 63 35 88 113 67 147 47 87 200 51 182 106 223 237 167 65 163 131 208 62 86 52 64 24 59 93 174 182 220 164 5 185 10 178 188 23 107 215 102 147 204 241 86 102 180 162 8 155 58 59 35 153 196 157 79 105 135 93 91 199 56 69 24 4 102 228 246 175 179 152 35 139 35 206 16 88 113 72 222 220 118 206 252 7 41 49 141 38 220 249 208 41 57 142 158 64 192 242 11 128 245 206 171 7 147 71 104 166 150 94 129 70 198 133 75 80 20 148 11 101 24 137 124 15 69 46 136 206 154 245 155 53 36 174 161 106 119 141 225 86 24 185 226 125 48 127 204 210 239 66 155 77 141 184 243 116 107 141 203 189 223 166 111 17 28 141 22 186 29 104 58 253 150 79 180 81 148 55 214 174 124 46 47 76 229 176 208 88 176 217 189 95 64 231 241 133 143 94 117 143 155 96 207 39 93 111 108 192 180 229 105 140 67 45 82 137 140 255 166 90 143 69] tag:[226 99 29 105 33 95 156 175 48 131 198 70 35 0 196 99] original:0x40002a8540} [DEBUG]Leaving jwt.DecryptJWE function without error [DEBUG]Returning message base: {Version:0 ID:496ce3c4-eb6f-435e-8eba-ae9f97e18edb Type:2 Payload:{Type:1 Payload:[0 0 0 16 73 108 227 196 235 111 67 94 142 186 174 159 151 225 142 219 225 170 205 9 191 243 81 153 7 167 66 25 49 155 90 100 63 130 131 197 240 82 138 97 141 176 230 208 244 76 86 102]} Padding:WrarWzXhoRtBjCttjrYWERzlkHXQPdqvFLjJBghTKTTKUyoGMBxeiGjPNFeZHdygqPpQOUmHDOWwlEqqLwTGoaVWdawScNSdLDeyaspLZRctwawyZNwCDKgumKhMzHIRLEzyWWvLqfvKcOiNRSwTZBAEvUGnPgmfigLgdwFXOtwSwbwmkaIhnsgOEcdVRplTLGsTdmVwQJaADwvovqSGShstKoAqnKOnDvVrmKmBLEBiAyseBVqnaqbretvpWsKQQmTcpqXDfbTuxBsWGMcXGIQZBpFlqfAiPOMCBiQFuwYhPYfrOToRUvVhoiUDjNqbqMYnSwAlxycjcfPWUQFSCAdEnbVwCRunNtoUktJFcpoxdskyuxPMMMAzwXybifsqNGUBJwUfqcrzQLtScMhCRTmTSyufrZdPDCYUrPCWpzbzOpFPhUOVAauIETafXjjrZCnbjguYwlSHGNiSpzilkNYnTvgXCxEemWmlyRZgWPTOcmOLGaXbnpKDpUBXkNKWVkoNrtmTpqmZTwFwmrUyXTeFtAxoBbUnJKSxAmblaMXuutdtivkAmuFvrjzAwbLrLDiUUOSafTMfecPAGHFORaKskwDKbKyZwaUsAvEOVxXVLTKIYYBDVjqOJXpHJQXlrvurrZCZCROmfRIPmIBiVMghnSfXBtaTdObtGeiVFqHQknLNmSzRGyZnQPIZNpFlkEvvHqOgmwyooQMskMTYsBMilLdlWlnEBxSivbeRLRkJsHRdIUveWzJScyjvPJPSYwFqnsnMzqOaQLRoEAQZjBgTMuaUgZJWosyoJrrdDqsYfnwpIftYltZatMSTrTlTeSrNzCQoNTquCPJRgYzdVZjAuatJDNqNUHhzrnJdhaPQsVDvDhiGKIHSDKfBueKoYwJkuKTLpajzqjElYNZloLmSwkvboYzYoymEvpvzdHpivrvdMwAQhRqfubCMqjPHVwcWtaTkqptYSAPPXtJKkqbdIUexaCZGLSfVHBIrKpHYnrxFpbEjiLpbSdVkkzswvfKSZqTGAQoJfNzPvMIzOLEqwOrRRZfUuDAEhfPZacvSlgvPgIptFOwcFvaKDQNYYNhjHqUjGQatqZnTLMqAsPeaLOGngqJAAoZDOMaCnlVoPjpFjJVPYAZaXaJYOOrTSAvgofpJtIYjUySDnSDLgsHBqeoTMmaLPqRZlmHyKELOOqPzyQiyJWLbeBkpmsUuhYIycJFlDeHRspSlrhDTcBzjMIkJhyTBosSqnrRNmgcpffOMbyVvQpLCfXcPRGzfDYLTpfsvTczxcvVojlAOxJoLPJkMOvKRDnvbqmPqZlGCrUVtUHcRgKkRfbDPOiFFJItmecEHOZEXiTsBCcyoiGimlEbYdJClMkhLOcqsVghSNZYixLgAsKndhGRBvmmqfBpZJxqPZDJyHZrAJPsKwgMuQXBOYNtZfYvuuQrEEvFbhPEffMrDZQWAWaNOCSRdWMlFGMQmqYENMIZRvEDYNmooPzmPKrzErnhvFBHDNGvTjkttguUYXOOyRWNFRTOBlFJGZDosyNPXfemtRuFYZgRDlJTlYpCFzxAGaMImNsTIGGPaxadHeztprnYtjyzzRwcKafIkQPrAyGcNSuTtABTMJnsipEDOcGODwoSGhZuypiuByQvYyPUqbspIiePweDngfbCPhZwuiYZkEBGTfqhqwFeYsiHeuiMKAtdzJejUDgCoSXEwBAVNaBXXnxNYTgBLGeJqbwhaEFqmlDqydSbJnIekPSJtEQLWomZjtmQjxvFLIwvxDFAxRcTOtfUnHyryxlStxrcuWgLBACiQcWCimcRXWVfmYHhcYdjrlarieoIuYjDgFjAxLYcaVMsnnKmJJqdqXNyTZGJsuFHjZawMXoVcTTghaPtjdzGAeUhLrNZLAZhmPfQfVXagoDdEurjIAxPZRZdgTDPiuwAzLMDFPAuALlFTnLpsujhGZwOVyBumMBFvyryrIjtbedJfOOILZiFlSOlTzGdQdSlUryIcTsEaTAnyvbDwwnEHfcxXacLqHxkPaiGSCvYMVwTqiSVSJzwVSIsbIwjwrnXZsAEuSlnvUtOfFCDxyUrIqcudWUfYhwNlKBawALSEYCHBskMKMhdmmAxngEvFnJaKENeeWQfcRMSuJqSJPdxMSPwjXZWspZnHAhMFsALLIYZgIDtbQHrCHjIPOqKVUAUUevKQvWXisClmCWyWrjTFkkEDxvPaBxCpWQemmVbSNetGhrwgBxnzDOCFhLBjBtWZIzWvTHHKRrKAeITwGIfDdUyJylXlNSnizPyZpynxCJPiqSIonjygtNIpQLxAAcBzEMNzbYihMEAFgkbKFtKcrXYaIIlNbzsmzSwCuOgXzMUklLiubcKMHgywGQRWpTpbAUfLGiuwIMmUqXcBLLsfuYJSEKFgnEAylgRUnUoQNRGhapAGDRbeWgPNLVkomjnIEBPJIyouGwmicikHpJDkeEeQNABpDeIhMlvgyMjZiFdHjONiaxzYOiLHVeqxEJmVBdRykvpvPVsCKqoaaGeEYwPdxliMDetwoNQXIlFlqCDLqkvpaWpcmVpChPgNjxbFSqHoerZiXwuoLHhGuzVIjhrHbwVYtYdXMSjYQWUxLmfnrMRAIGESGLUaRsJGNUMblYMQLNIcvkhsksgdUGjlDnnJcbFzqQUnLqYfqnOPWvCnIjViTvbVveYQkeGvIEplbtDFGYrtCLLkEjrFoKpAGiKoXdQGrrZylYldiPcLgQVOgtSdIhOiSXMuZvHnlQpfcMucWCICUXBssUKeghpzgzFfIBHRZbrcoajNuSZQgoFfeeBroBkIqHHgcJXhJVuCIbKXHPPPCcBLlHJvkGJuJxjKHmIoJIbnAqVwYwWPCqPupAvCkODiCNzpzmeFIvzTnlVhWWPEeHHSfYeLjiuxTqFttMuIxOzspbLRmRmdBjaUWgTmqwbrQxXrKIylOFipVPpGKYRWyEbYPmlEJkjwpHREWJsLEGnDTuuVGfIJUOzuYEXlPErwDrHXPKkdqWwcnKVItClerqaeBJWjXokIKAFpocWKihgRILMBDpztdJLNIOWCikGokVCtnaSrFzFDtVPuNqQlKAejwKlnpnLnPCfKKDCsNItPhGjGUSbcMcGvHdSrbWRAFfNuHPreCveYIjLAImMPqsleyFpYMRkbVmplflgoGGSOoKSAJQucnJSTJSsbORHWuzUdDUPZmOeXIUTRcfflxGVefqxFXfTmWcyIWajYUmEhFaZhAPLeyaleixDVKtuMhhzxQexYNTYWMiIeAmYFvTLHHPmhFxXambMvkMwJUgwiaByonjNlYVFcxfqRYVzQAoXppQGlVuYqZDJAtEplkdFuIThyMJForfofjgQedzsOMBcJnVxAoKCgtcSfOUsWzzNWAkfkkWmAYLgFIHtuGhLEKejOaAGvWCLXwxScDJxLWEUhrHbEHvmzJjbDnvVtDeVIWCETyywKfsupfYRHMPmrMFqAVnHiIFRvUsHihzgwcFLDtnEZJBztIfiSfAmtxBIhCWrHzXMBgcCyOmPYbAeHkaQmVnwPVpefVWQopMcFNdPDYXYfPDFAOtFtMEHgGRZIaGltnEmThMncQQqMZiMEWDqVyIGddkeUcIFKZbDwjpWJOymoMfArvKzUkAMFklcDJPNFgkpLBEWBDPVwhbvYmPpDqAsaRceHDHLxszfeWZdAhzDTBhLFuVygLogyKHWblnGHhdxCyQSRMnBMIqUCPObhewZkYgfFhicFuYAAbIlxZeiElLkTtEzEHyGAWWgpNgGTwTdVpoRMAzDcDiATWNeicUhRKqtZDbILIRESoiKdsYPElLKxYrpwQqAseAFsMVCCKsXEOeybMOtQRmTftddZRESIxzxmyJnTryywETALfAenQylpIPMgwfNpUWurOLKZLvQXYSSEBcBqxMvAJeFAtWWumXfGzNLKykKvwtWsbkaasXLMhHsqTBSZfWZxclkiOUySzMWEkxGDATrrtzahrLgoNTCqIPyGAAYmbfMcMaXxLUSbNIdcdUXmkVpwZzNXoqoiyOsfzwXlRkuQpmjQqEtVBsuilhuxfoKXrOuLcGAxrAXU Token:}

[DEBUG] [DEBUG]POST DATA: {0 496ce3c4-eb6f-435e-8eba-ae9f97e18edb 2 {1 [0 0 0 16 73 108 227 196 235 111 67 94 142 186 174 159 151 225 142 219 225 170 205 9 191 243 81 153 7 167 66 25 49 155 90 100 63 130 131 197 240 82 138 97 141 176 230 208 244 76 86 102]} WrarWzXhoRtBjCttjrYWERzlkHXQPdqvFLjJBghTKTTKUyoGMBxeiGjPNFeZHdygqPpQOUmHDOWwlEqqLwTGoaVWdawScNSdLDeyaspLZRctwawyZNwCDKgumKhMzHIRLEzyWWvLqfvKcOiNRSwTZBAEvUGnPgmfigLgdwFXOtwSwbwmkaIhnsgOEcdVRplTLGsTdmVwQJaADwvovqSGShstKoAqnKOnDvVrmKmBLEBiAyseBVqnaqbretvpWsKQQmTcpqXDfbTuxBsWGMcXGIQZBpFlqfAiPOMCBiQFuwYhPYfrOToRUvVhoiUDjNqbqMYnSwAlxycjcfPWUQFSCAdEnbVwCRunNtoUktJFcpoxdskyuxPMMMAzwXybifsqNGUBJwUfqcrzQLtScMhCRTmTSyufrZdPDCYUrPCWpzbzOpFPhUOVAauIETafXjjrZCnbjguYwlSHGNiSpzilkNYnTvgXCxEemWmlyRZgWPTOcmOLGaXbnpKDpUBXkNKWVkoNrtmTpqmZTwFwmrUyXTeFtAxoBbUnJKSxAmblaMXuutdtivkAmuFvrjzAwbLrLDiUUOSafTMfecPAGHFORaKskwDKbKyZwaUsAvEOVxXVLTKIYYBDVjqOJXpHJQXlrvurrZCZCROmfRIPmIBiVMghnSfXBtaTdObtGeiVFqHQknLNmSzRGyZnQPIZNpFlkEvvHqOgmwyooQMskMTYsBMilLdlWlnEBxSivbeRLRkJsHRdIUveWzJScyjvPJPSYwFqnsnMzqOaQLRoEAQZjBgTMuaUgZJWosyoJrrdDqsYfnwpIftYltZatMSTrTlTeSrNzCQoNTquCPJRgYzdVZjAuatJDNqNUHhzrnJdhaPQsVDvDhiGKIHSDKfBueKoYwJkuKTLpajzqjElYNZloLmSwkvboYzYoymEvpvzdHpivrvdMwAQhRqfubCMqjPHVwcWtaTkqptYSAPPXtJKkqbdIUexaCZGLSfVHBIrKpHYnrxFpbEjiLpbSdVkkzswvfKSZqTGAQoJfNzPvMIzOLEqwOrRRZfUuDAEhfPZacvSlgvPgIptFOwcFvaKDQNYYNhjHqUjGQatqZnTLMqAsPeaLOGngqJAAoZDOMaCnlVoPjpFjJVPYAZaXaJYOOrTSAvgofpJtIYjUySDnSDLgsHBqeoTMmaLPqRZlmHyKELOOqPzyQiyJWLbeBkpmsUuhYIycJFlDeHRspSlrhDTcBzjMIkJhyTBosSqnrRNmgcpffOMbyVvQpLCfXcPRGzfDYLTpfsvTczxcvVojlAOxJoLPJkMOvKRDnvbqmPqZlGCrUVtUHcRgKkRfbDPOiFFJItmecEHOZEXiTsBCcyoiGimlEbYdJClMkhLOcqsVghSNZYixLgAsKndhGRBvmmqfBpZJxqPZDJyHZrAJPsKwgMuQXBOYNtZfYvuuQrEEvFbhPEffMrDZQWAWaNOCSRdWMlFGMQmqYENMIZRvEDYNmooPzmPKrzErnhvFBHDNGvTjkttguUYXOOyRWNFRTOBlFJGZDosyNPXfemtRuFYZgRDlJTlYpCFzxAGaMImNsTIGGPaxadHeztprnYtjyzzRwcKafIkQPrAyGcNSuTtABTMJnsipEDOcGODwoSGhZuypiuByQvYyPUqbspIiePweDngfbCPhZwuiYZkEBGTfqhqwFeYsiHeuiMKAtdzJejUDgCoSXEwBAVNaBXXnxNYTgBLGeJqbwhaEFqmlDqydSbJnIekPSJtEQLWomZjtmQjxvFLIwvxDFAxRcTOtfUnHyryxlStxrcuWgLBACiQcWCimcRXWVfmYHhcYdjrlarieoIuYjDgFjAxLYcaVMsnnKmJJqdqXNyTZGJsuFHjZawMXoVcTTghaPtjdzGAeUhLrNZLAZhmPfQfVXagoDdEurjIAxPZRZdgTDPiuwAzLMDFPAuALlFTnLpsujhGZwOVyBumMBFvyryrIjtbedJfOOILZiFlSOlTzGdQdSlUryIcTsEaTAnyvbDwwnEHfcxXacLqHxkPaiGSCvYMVwTqiSVSJzwVSIsbIwjwrnXZsAEuSlnvUtOfFCDxyUrIqcudWUfYhwNlKBawALSEYCHBskMKMhdmmAxngEvFnJaKENeeWQfcRMSuJqSJPdxMSPwjXZWspZnHAhMFsALLIYZgIDtbQHrCHjIPOqKVUAUUevKQvWXisClmCWyWrjTFkkEDxvPaBxCpWQemmVbSNetGhrwgBxnzDOCFhLBjBtWZIzWvTHHKRrKAeITwGIfDdUyJylXlNSnizPyZpynxCJPiqSIonjygtNIpQLxAAcBzEMNzbYihMEAFgkbKFtKcrXYaIIlNbzsmzSwCuOgXzMUklLiubcKMHgywGQRWpTpbAUfLGiuwIMmUqXcBLLsfuYJSEKFgnEAylgRUnUoQNRGhapAGDRbeWgPNLVkomjnIEBPJIyouGwmicikHpJDkeEeQNABpDeIhMlvgyMjZiFdHjONiaxzYOiLHVeqxEJmVBdRykvpvPVsCKqoaaGeEYwPdxliMDetwoNQXIlFlqCDLqkvpaWpcmVpChPgNjxbFSqHoerZiXwuoLHhGuzVIjhrHbwVYtYdXMSjYQWUxLmfnrMRAIGESGLUaRsJGNUMblYMQLNIcvkhsksgdUGjlDnnJcbFzqQUnLqYfqnOPWvCnIjViTvbVveYQkeGvIEplbtDFGYrtCLLkEjrFoKpAGiKoXdQGrrZylYldiPcLgQVOgtSdIhOiSXMuZvHnlQpfcMucWCICUXBssUKeghpzgzFfIBHRZbrcoajNuSZQgoFfeeBroBkIqHHgcJXhJVuCIbKXHPPPCcBLlHJvkGJuJxjKHmIoJIbnAqVwYwWPCqPupAvCkODiCNzpzmeFIvzTnlVhWWPEeHHSfYeLjiuxTqFttMuIxOzspbLRmRmdBjaUWgTmqwbrQxXrKIylOFipVPpGKYRWyEbYPmlEJkjwpHREWJsLEGnDTuuVGfIJUOzuYEXlPErwDrHXPKkdqWwcnKVItClerqaeBJWjXokIKAFpocWKihgRILMBDpztdJLNIOWCikGokVCtnaSrFzFDtVPuNqQlKAejwKlnpnLnPCfKKDCsNItPhGjGUSbcMcGvHdSrbWRAFfNuHPreCveYIjLAImMPqsleyFpYMRkbVmplflgoGGSOoKSAJQucnJSTJSsbORHWuzUdDUPZmOeXIUTRcfflxGVefqxFXfTmWcyIWajYUmEhFaZhAPLeyaleixDVKtuMhhzxQexYNTYWMiIeAmYFvTLHHPmhFxXambMvkMwJUgwiaByonjNlYVFcxfqRYVzQAoXppQGlVuYqZDJAtEplkdFuIThyMJForfofjgQedzsOMBcJnVxAoKCgtcSfOUsWzzNWAkfkkWmAYLgFIHtuGhLEKejOaAGvWCLXwxScDJxLWEUhrHbEHvmzJjbDnvVtDeVIWCETyywKfsupfYRHMPmrMFqAVnHiIFRvUsHihzgwcFLDtnEZJBztIfiSfAmtxBIhCWrHzXMBgcCyOmPYbAeHkaQmVnwPVpefVWQopMcFNdPDYXYfPDFAOtFtMEHgGRZIaGltnEmThMncQQqMZiMEWDqVyIGddkeUcIFKZbDwjpWJOymoMfArvKzUkAMFklcDJPNFgkpLBEWBDPVwhbvYmPpDqAsaRceHDHLxszfeWZdAhzDTBhLFuVygLogyKHWblnGHhdxCyQSRMnBMIqUCPObhewZkYgfFhicFuYAAbIlxZeiElLkTtEzEHyGAWWgpNgGTwTdVpoRMAzDcDiATWNeicUhRKqtZDbILIRESoiKdsYPElLKxYrpwQqAseAFsMVCCKsXEOeybMOtQRmTftddZRESIxzxmyJnTryywETALfAenQylpIPMgwfNpUWurOLKZLvQXYSSEBcBqxMvAJeFAtWWumXfGzNLKykKvwtWsbkaasXLMhHsqTBSZfWZxclkiOUySzMWEkxGDATrrtzahrLgoNTCqIPyGAAYmbfMcMaXxLUSbNIdcdUXmkVpwZzNXoqoiyOsfzwXlRkuQpmjQqEtVBsuilhuxfoKXrOuLcGAxrAXU }

[-] Received OPAQUE message, decrypted JWE with interface PSK

[DEBUG] Entering into opaque.UnAuthHandler() function...

[-] Received OPAQUE message type: 1

[DEBUG] Entering into opaque.RegistrationInit() function... [DEBUG]Entering into opaque.ServerRegisterInit() function...

[DEBUG] Entering into agents.newAgent function

[-] Created agent log file at: /root/data/agents/496ce3c4-eb6f-435e-8eba-ae9f97e18edb agent_log.txt

[DEBUG] Leaving agents.newAgent function without error

[DEBUG] Entering into agents.Log

[DEBUG] Leaving agents.OPAQUERegistrationInit function without error

[DEBUG] Leaving opaque.UnAuthHandler() function without error

[!] Received HTTP/2.0 POST connection from 192.168.201.3:46800

[DEBUG] HTTP Connection Details: Host: 192.168.201.19:443 URI: / Method: POST Protocol: HTTP/2.0 Headers: map[Accept-Encoding:[gzip] Authorization:[Bearer eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..4cC6A94g7MOeMJ3j.79hDD0ALjOgC4JExf5yEjCMU9EdDN6Z7OiK_Np1R0tvnDnYrMQnxGNj8emwIEmUMS16WJIAQSiJNcidTc-ep4MLSe_M6ZSaMTEPswyA1YLK33dLt1vhVFCgk5wCJdCGa1lvIRcrcMjy_6_SmUFWq-Q0cmlIa3vvMnCkbF6Br-i_zboxMSoZRvGQKobRgt3o3PgJyQoWxOI5irlzEWotebVSP0qY36GI9PpVPleAuhBTv7nsKDqeHw4KAzEA.xOByn0OBN8Ntxihy3YrHCw] Content-Length:[6209] Content-Type:[application/octet-stream; charset=utf-8] User-Agent:[Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36]] TLS Negotiated Protocol: h2 TLS Cipher Suite: 4867 TLS Server Name: Content Length: 6209 [DEBUG]Entering into jwt.ValidateJWT [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..4cC6A94g7MOeMJ3j.79hDD0ALjOgC4JExf5yEjCMU9EdDN6Z7OiK_Np1R0tvnDnYrMQnxGNj8emwIEmUMS16WJIAQSiJNcidTc-ep4MLSe_M6ZSaMTEPswyA1YLK33dLt1vhVFCgk5wCJdCGa1lvIRcrcMjy_6_SmUFWq-Q0cmlIa3vvMnCkbF6Br-i_zboxMSoZRvGQKobRgt3o3PgJyQoWxOI5irlzEWotebVSP0qY36GI9PpVPleAuhBTv7nsKDqeHw4KAzEA.xOByn0OBN8Ntxihy3YrHCw

[-] Checking to see if authorization JWT was signed by server's interface key...

[!] there was an error decrypting the JWT: square/go-jose: error in cryptographic primitive

[-] Authorization JWT not signed with server's interface key, trying again with PSK... [DEBUG]Entering into jwt.ValidateJWT [DEBUG]Input JWT: eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwidHlwIjoiSldUIn0..4cC6A94g7MOeMJ3j.79hDD0ALjOgC4JExf5yEjCMU9EdDN6Z7OiK_Np1R0tvnDnYrMQnxGNj8emwIEmUMS16WJIAQSiJNcidTc-ep4MLSe_M6ZSaMTEPswyA1YLK33dLt1vhVFCgk5wCJdCGa1lvIRcrcMjy_6_SmUFWq-Q0cmlIa3vvMnCkbF6Br-i_zboxMSoZRvGQKobRgt3o3PgJyQoWxOI5irlzEWotebVSP0qY36GI9PpVPleAuhBTv7nsKDqeHw4KAzEA.xOByn0OBN8Ntxihy3YrHCw [DEBUG]Agent wait time: [-]The returned Agent wait time was empty, using default 60s [!]The JWT claims were not valid for 496ce3c4-eb6f-435e-8eba-ae9f97e18edb [-]Agent Wait Time: 60s, Time now: 2021-07-01 20:11:17.953952736 +0200 CEST m=+379.996820857 [-]JWT Claim Expiry: 2021-07-01 20:07:50 +0200 CEST [-]JWT Claim Issued: 2021-07-01 20:07:40 +0200 CEST

[-] Authorization JWT not signed with PSK, returning 404...

[!] square/go-jose/jwt: validation failed, token is expired (exp)

Agent Debug Output: UNIXNET_NAS> ./merlinAgent-Linux-arm5 -v -debug -url https://192.168.201.19:443 -psk merlin [DEBUG]Entering agent.New() function [i]Host Information: [i] Agent UUID: 496ce3c4-eb6f-435e-8eba-ae9f97e18edb [i] Platform: linux [i] Architecture: arm [i] User Name: root [i] User GUID: 0 [i] Hostname: UNIXNET_NAS [i] PID: 31443 [i] IPs: [127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] [DEBUG]Leaving agent.New function [DEBUG]Entering into clients.http.New()... [DEBUG]new client PSK: merlin [DEBUG]new client Secret: f6274d9892026fe47dd5f96f708ef8983dccc7bacf5ee4a90b2400805adaea0a [DEBUG]Entering into clients.http.getClient()... [i]Client information: [i] Protocol: h2 [i] URL: https://192.168.201.19:443 [i] User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.85 Safari/537.36 [i] HTTP Host Header: [i] Payload Padding Max: 4096 [i] JA3 String: [-]Agent version: 1.0.1 [-]Agent build: 70c07d5831774f1f271ca9f6420c2c0ee66d3a2c [DEBUG]Entering into agent.getAgentInfoMessage function... [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: paddingmax [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: protocol [DEBUG]Entering into clients.http.Get()... [DEBUG]Key: ja3 [DEBUG]Returning AgentInfo message: {Version:1.0.1 Build:70c07d5831774f1f271ca9f6420c2c0ee66d3a2c WaitTime:30s PaddingMax:4096 MaxRetry:7 FailedCheckin:0 Skew:3000 Proto:h2 SysInfo:{Platform:linux Architecture:arm UserName:root UserGUID:0 HostName:UNIXNET_NAS Pid:31443 Ips:[127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] Domain:} KillDate:0 JA3:} [DEBUG]Entering clients.http.Initial function [DEBUG]Input AgentInfo: {Version:1.0.1 Build:70c07d5831774f1f271ca9f6420c2c0ee66d3a2c WaitTime:30s PaddingMax:4096 MaxRetry:7 FailedCheckin:0 Skew:3000 Proto:h2 SysInfo:{Platform:linux Architecture:arm UserName:root UserGUID:0 HostName:UNIXNET_NAS Pid:31443 Ips:[127.0.0.1/8 ::1/128 192.168.201.3/24 fe80::211:32ff:fe07:b18e/64] Domain:} KillDate:0 JA3:} [DEBUG]Entering into clients.http.opaqueAuth()... [DEBUG]Entering into agent.opaqueRegister [-]Starting OPAQUE Registration [DEBUG]Entering into clients.http.getJWT()... [DEBUG]Entering into opaque.UserRegisterInit... [DEBUG]OPAQUE UserID: 496ce3c4eb6f435e8ebaae9f97e18edb [DEBUG]OPAQUE Alpha: e1aacd09bff3519907a74219319b5a643f8283c5f0528a618db0e6d0f44c5666 [DEBUG]OPAQUE PwdU: 94d70a22182d5f49fd60333d614292f17e38b3d90419e3d144b208305a82448f [DEBUG]Sending OPAQUE RegInit message [DEBUG]Entering into agent.sendMessage() [-]Sending OPAQUE message to https://192.168.201.19:443 [DEBUG]Sending POST request size: 6052 to: https://192.168.201.19:443 [DEBUG]HTTP Response: &{Status:200 OK StatusCode:200 Proto:HTTP/2.0 ProtoMajor:2 ProtoMinor:0 Header:map[Content-Type:[application/octet-stream] Date:[Thu, 01 Jul 2021 18:08:29 GMT]] Body:{cs:0x8fa630} ContentLength:-1 TransferEncoding:[] Close:false Uncompressed:false Trailer:map[] Request:0x880f00 TLS:0xae6180} [DEBUG]Entering into opaque.UserRegisterComplete... [-]Received OPAQUE server registration initialization message [DEBUG]OPAQUE Beta: 9a4f30d2fd2596d9df3bd37a5e6a71c6b10bce69cbecc3caa67adba4b4c88973 [DEBUG]OPAQUE V: 4a4f541b2af76671e9a530b0463ff98f7d5d17c27d36e61caa5c92400e14e4f5 [DEBUG]OPAQUE PubS: 35c21f7c1fd2473a28bdf427a79d1e7213086b05d0c186b458e7e75bb52d11a5 [DEBUG]OPAQUE EnvU: 653195edc8026de2b9a438dc391923de0759ef1e06a1a960b27cef385ce2c1b94fe36dd05eef26e0a3b763d395713e5ecd67aa1eda1c464d28d216adcab24707c4664226a34422658013b246645e8960baf27e689fef14dfb918408a7e43accdca84be498c5918559b2a0d117e14751e08acd4bb750a85bdb727742f0011180f [DEBUG]OPAQUE PubU: 80e313018e4763eefcf9ad4f022dd7d4c634224d7bb0cd044d4fa4fb9fee173f [DEBUG]Sending OPAQUE RegComplete message [DEBUG]Entering into agent.sendMessage() [-]Sending OPAQUE message to https://192.168.201.19:443 [DEBUG]Sending POST request size: 6209 to: https://192.168.201.19:443 [DEBUG]HTTP Response: &{Status:404 Not Found StatusCode:404 Proto:HTTP/2.0 ProtoMajor:2 ProtoMinor:0 Header:map[Content-Length:[0] Date:[Thu, 01 Jul 2021 18:11:17 GMT]] Body:{Reader:0x86e678} ContentLength:0 TransferEncoding:[] Close:false Uncompressed:false Trailer:map[] Request:0x881e00 TLS:0xae6660} [!]there was an error performing OPAQUE User Registration: there was an error sending the OPAQUE User Registration Complete message to the server: there was an error communicating with the server: 404 [-]1 out of 7 total failed checkins [-]Sleeping for 32.226s at 2021-07-01T18:11:58Z

Ne0nd0g commented 11 months ago

There has not been activity on this issue 2 years. Closing for now, but re-open if the problem persists with the latest release.