search

cobbr / Elite

Elite is the client-side component of the Covenant project. Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.
https://cobbr.io/Covenant.html
GNU General Public License v3.0
117 stars 18 forks source link

Elite Fails to Connect to Covenant on the Local Loopback #5

Closed surgicalmittens closed 5 years ago

surgicalmittens commented 5 years ago

I was spinning this up in my lab using the docker commands and trying to run Covenant and Elite on the same host. Covenant started correctly, but it appears Elite can't bind to the loopback. 

# docker run -it --rm --name elite -v /tmp/Elite/Data:/app/Data elite --username AdminUser --computername 127.0.0.1
Password: *********
Covenant CertHash (Empty to trust all): 
[!] Could not connect to Covenant at: 127.0.0.1

It works if I put the local IP address in place of 127.0.0.1.

# docker run -it --rm --name elite -v /tmp/Elite/Data:/app/Data elite --username AdminUser --computername 192.168.151.161
Password: *********
Covenant CertHash (Empty to trust all): 
(Covenant) >

Thanks.

cobbr commented 5 years ago

Confirmed as a bug, thanks @surgicalmittens

cobbr commented 5 years ago

I did some thinking on this, and it actually makes sense that this is the case. You are creating a docker container that is running Elite. The Elite docker container's loopback address is not the same as the Covenant docker container's loopback address. Covenant is not running within the Elite docker container. To connect to Covenant, you need to specify an address that Covenant is listening on and that Elite can route to.

So this is expected behavior. With that being said, the reason the loopback address does not work is non-obvious and we should include a better error message that explains this to the user. Leaving this issue open until that is added.

cobbr commented 5 years ago

Added a better error message in 389eebdd0f6fdda27d0133e603ff0856d95352e4