center-for-threat-informed-defense / adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.
https://ctid.io/adversary-emulation
Apache License 2.0
1.6k stars 292 forks source link

(Oilrig) SideTwist agent doesn't react to 103 (upload) commands #159

Open arty-hlr opened 3 months ago

arty-hlr commented 3 months ago

Hi,

When going through the Oilrig scenario, in step 3 the fsociety.dat is not uploaded to the control server after submitting the 102 command, here reproduced with a test file, the agent doesn't respond after the 102 command: Pasted image 20240318165617

We tried with several different files, and do not see any POST request from the agent, unless the file doesn't exist, in which case it responds correctly with an error message. From the SideTwist agent or control server code, it is unclear why this should be happening for uploads.

Steps to reproduce: