search

bats3c / shad0w

A post exploitation framework designed to operate covertly on heavily monitored environments
https://blog.dylan.codes/shad0w/
MIT License
2.03k stars 323 forks source link

Issue 33 beacon idle memory leak #34

Closed bblenard closed 4 years ago

bblenard commented 4 years ago

This PR fixes most (I think) of the memory leaks present in the stageless beacons idle code path. The following screenshots show the memory usage over a 10 minute idle test. The memory usage in process explorer started out at ~5.9MB. There still seems to be some type of leak but my suspicion is that it occurs because a new http session is created every callback loop, that is the only place I can think of where a leak would still exist: See this stackoverflow post. That being said I could have missed something.

I wanted to keep this PR as specific to the idle loop as possible so the fixes could be digested and discussed. I don't want to introduce bugs into the code base in a huge PR. I also choose not to squash my commits so each individual change can be inspected for correctness. There are still memory leaks in other parts of the beacon code!

NOTE: The jump in the perfmon test happened when windows defender started a scan :(

Relates to #34

Perfmon 10 minute idle test memleak_fix_perfmon

Process Explorer Performance graph for 10 minute idle test memleak_fix_process_explorer

bblenard commented 4 years ago

~NOTE: I found an issue while testing DO NOT MERGE~

Fixed: https://github.com/bats3c/shad0w/pull/34/commits/21553c3ebd5fc0af62080c0327985e0fd9390494