Can no longer run pre-compiled SysInternals PE

fortra / No-Consolation

A BOF that runs unmanaged PEs inline

https://www.coresecurity.com/core-labs/articles/running-pes-inline-without-console

MIT License

548 stars 64 forks source link

Can no longer run pre-compiled SysInternals PE #7

Open pen3tr8or opened 4 weeks ago

pen3tr8or commented 4 weeks ago

I'm currently unable to run sdelete64.exe from SysInternals with No-Consolation in Cobalt Strike 4.10. This worked in commits through f791d277aa843c15047d290c1ba00d2bdfcbb950 (September 14, 2024), however, now the beacon hangs/dies when attempting to run the same PE.

Screenshot showing using successful execution using the commit mentioned above and then execution when using the latest commit. The test file to be deleted was recreated before attempting execution with each commit.

S4ntiagoP commented 3 weeks ago

I tried it on havoc and it works for me. Could it be that you are not updating the .CNA script?

pen3tr8or commented 3 weeks ago

Thanks for the quick response, I have used the .CNA script provided with each commit.