search

cobbr / Elite

Elite is the client-side component of the Covenant project. Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.
https://cobbr.io/Covenant.html
GNU General Public License v3.0
117 stars 18 forks source link

Unhandled exception with GetNetLocalGroup and GetNetLocalGroupMember #4

Closed egypt closed 5 years ago

egypt commented 5 years ago

Grunt running on Windows 10 and Covenant/Elite running on Ubuntu.

(Covenant: Grunts\high) > GetNetLocalGroupMember . administrators
[!] EliteMenu Exception: Object reference not set to an instance of an object.
   at Elite.Menu.Grunts.MenuCommandGruntInteractGetNetLocalGroupMember.Command(MenuItem menuItem, String UserInput) in /home/egypt/repo/Elite/Elite/Menu/Grunts/InteractGruntMenuItem.cs:line 1143
   at Elite.Menu.EliteMenu.PrintMenu(String UserInput) in /home/egypt/repo/Elite/Elite/Menu/EliteMenu.cs:line 123
(Covenant: Grunts\high) > GetNetLocalGroupMember .               
[!] Usage: GetNetLocalGroupMember <computernames> <localgroup>
(Covenant: Grunts\high) > GetNetLocalGroupMember DESKTOP-2QATPR1 administrators
[!] EliteMenu Exception: Object reference not set to an instance of an object.
   at Elite.Menu.Grunts.MenuCommandGruntInteractGetNetLocalGroupMember.Command(MenuItem menuItem, String UserInput) in /home/egypt/repo/Elite/Elite/Menu/Grunts/InteractGruntMenuItem.cs:line 1143
   at Elite.Menu.EliteMenu.PrintMenu(String UserInput) in /home/egypt/repo/Elite/Elite/Menu/EliteMenu.cs:line 123
(Covenant: Grunts\high) > GetNetLocalGroup DESKTOP-2QATPR1                     
[!] EliteMenu Exception: Operation returned an invalid status code 'NotFound'
   at Covenant.API.CovenantAPI.ApiGruntTasksByTasknameGetWithHttpMessagesAsync(String taskname, Dictionary`2 customHeaders, CancellationToken cancellationToken) in /home/egypt/repo/Elite/Elite/API/CovenantAPI.cs:line 4523
   at Covenant.API.CovenantAPIExtensions.ApiGruntTasksByTasknameGetAsync(ICovenantAPI operations, String taskname, CancellationToken cancellationToken) in /home/egypt/repo/Elite/Elite/API/CovenantAPIExtensions.cs:line 856
   at Covenant.API.CovenantAPIExtensions.ApiGruntTasksByTasknameGet(ICovenantAPI operations, String taskname) in /home/egypt/repo/Elite/Elite/API/CovenantAPIExtensions.cs:line 843
   at Elite.Menu.Tasks.TaskMenuItem.ValidateMenuParameters(String[] parameters, Boolean forwardEntrance) in /home/egypt/repo/Elite/Elite/Menu/Tasks/TaskMenuItem.cs:line 147
   at Elite.Menu.MenuItem.GetMenuOption(String UserInput) in /home/egypt/repo/Elite/Elite/Menu/MenuItem.cs:line 183
   at Elite.Menu.EliteMenu.PrintMenu(String UserInput) in /home/egypt/repo/Elite/Elite/Menu/EliteMenu.cs:line 112

In case it helps, here is the output of net localgroup on the same machine:

Aliases for \\DESKTOP-2QATPR1

-------------------------------------------------------------------------------
*Access Control Assistance Operators
*Administrators
*Backup Operators
*Cryptographic Operators
*Distributed COM Users
*Event Log Readers
*Guests
*Hyper-V Administrators
*IIS_IUSRS
*Network Configuration Operators
*Performance Log Users
*Performance Monitor Users
*Power Users
*Remote Desktop Users
*Remote Management Users
*Replicator
*Ssh Users
*System Managed Accounts Group
*Users
The command completed successfully.

and net localgroup Administrators:

Alias name     Administrators
Comment        Administrators have complete and unrestricted access to the computer/domain

Members

-------------------------------------------------------------------------------
Administrator
egypt
The command completed successfully.
cobbr commented 5 years ago

Thanks @egypt. I'm tracking an issue where Elite can get in a bad "state" like this.

I don't think GetNetLocalGroup/GetNetLocalGroupMember is the cause of the issue (they are working fine for me).

The workaround for this issue is simply to exit Elite and restart it, and the command should work once again. I'll work on the strange bad "state" issue.

egypt commented 5 years ago

I exited both Elite and Covenant, restarted them and the exception persists.

On Wed, Feb 20, 2019, 00:21 Ryan Cobb notifications@github.com wrote:

Thanks @egypt https://github.com/egypt. I'm tracking an issue where Elite can get in a bad "state" like this.

I don't think GetNetLocalGroup/GetNetLocalGroupMember is the cause of the issue (they are working fine for me).

The workaround for this issue is simply to exit Elite and restart it, and the command should work once again. I'll work on the strange bad "state" issue.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/cobbr/Elite/issues/4#issuecomment-465455787, or mute the thread https://github.com/notifications/unsubscribe-auth/AARk33t0yJnmzXrfO0NrqcscHPILUhglks5vPPeIgaJpZM4bDkR0 .

cobbr commented 5 years ago

@egypt Ah, well maybe it isn't the error I thought.

Do any of the built-in modules work or just the GetNetLocalGroup/GetNetLocalGroupMember tasks aren't working? If none of them are working did you use git clone --recurse-submodules https://github.com/cobbr/Covenant?

If other modules are working and you did clone recursively, then I'd say to try resetting the database and restart everything. To do that on the Covenant side:

$ ~/Covenant/Covenant > docker stop covenant
$ ~/Covenant/Covenant > docker rm covenant
$ ~/Covenant/Covenant > rm Data\covenant.db
$ ~/Covenant/Covenant > docker build -t covenant .
$ ~/Covenant/Covenant > docker run -it -p 7443:7443 -p 80:80 -p 443:443 --name covenant covenant --username AdminUser --computername 0.0.0.0

And on the Elite side:

$ ~/Elite/Elite > docker build -t elite .
$ ~/Elite/Elite > docker run -it --rm --name elite -v /absolute/path/to/Elite/Data:/app/Data elite --username AdminUser --computername <Covenant IP>
egypt commented 5 years ago

It was the submodules. I've been using git for most of a decade and that still bites me. >_<

Interestingly, git submodule init did not show any. I had to re-clone with --recurse-submodules to pick them up.

Thanks!

cobbr commented 5 years ago

Yeah, I really wish I could configure --recurse-submodules to trigger by default. Either way, I need a more obvious error message when the submodules are not there. I'll add something like that in here soon.