search

cobbr / Covenant

Covenant is a collaborative .NET C2 framework for red teamers.
https://cobbr.io/Covenant.html
GNU General Public License v3.0
4.19k stars 771 forks source link

[Feature Request] MSBuild launcher is incompatible with NetFramework35, should restrict MSBuild launcher options to NetFramework40 #80

Closed NotoriousRebel closed 3 years ago

NotoriousRebel commented 5 years ago

Feature Request or Bug Bug

Describe the feature request or bug A 500 error happens when you use netcore version 21 with msbuild launcher. Also unable to host file on webserver.

To Reproduce Steps to reproduce the behavior:

  1. Go to launcher after logging on
  2. Click on MSbuild and set otnetFrameworkVersion to netcore21
  3. Go to host
  4. For url type https://ip/filepath
  5. Click host

Expected behavior Server should not respond with 500 error and should host the file and automatically generate launcher.

Screenshots image

Covenant Server Information:

Browser Information:

Target Information (System that implant is running on): NA

Additional context NA

cobbr commented 5 years ago

@NotoriousRebel NetCore21 is not a valid DotNetVersion to use with any launcher. You must choose a dotnet framework version.

I should find a way to remove this option from the GUI, so I'll leave this open for now.

NotoriousRebel commented 5 years ago

@cobbr If I change to DotNet 35 and specify the host such as my /fun/cool.xml or https://ip:7443/tmp/cool.xml and then click host it crashes with a 500 error inside launcher/msbuild.

cobbr commented 5 years ago

@NotoriousRebel You must click "Generate" before hosting! Have you generated the launcher?

NotoriousRebel commented 5 years ago

I am able to successfully do that with regsvr32; however, when it comes to msbuild. Here is exactly what I do:

  1. Go to launchers and select MSBuild
  2. Make sure dotnet version is 35
  3. Click generate
  4. Go to host
  5. Set path to /cool/tmp.xml
  6. Go back to generate and see msbuild.exe tmp.xml

I am not exactly sure about the internals of msbuild but for example with regsvr32 you can specify on the webserver http://ip/filepath.sct is that possible in msbuild? Like for example with msbuild http://ip/cool/tmp.xml

cobbr commented 5 years ago

@NotoriousRebel That is not possible with msbuild, as far as I know. You must download the XML file to disk, which is why the Launcher remains the same.

NotoriousRebel commented 5 years ago

Ok @cobbr one last thing. I have downloaded the xml after generating it and am trying to run it with msbuild this happens image

cobbr commented 5 years ago

@NotoriousRebel This is interesting! It appears to only work if you use the v4.0 MSBuild version located at: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Thanks for the heads up!

NotoriousRebel commented 5 years ago

Thank you for the quick replies!!! image :)

cobbr commented 5 years ago

This is interesting

Starting in .NET Framework version 4, you can create tasks inline in the project file. You do not have to create a separate assembly to host the task. This makes it easier to keep track of source code and easier to deploy the task. The source code is integrated into the script.

via https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-inline-tasks?view=vs-2019

It may be not possible to use .NET3.5 with the MSBuild launcher. This is good to know for future reference, and possible making that clear within the interface.

cobbr commented 5 years ago

Glad you got it working @NotoriousRebel 🙂

cobbr commented 3 years ago

UI has been modified. Changes currently in dev branch.