iagox86 / dnscat2

BSD 3-Clause "New" or "Revised" License
3.4k stars 599 forks source link

Unknown command sent by the server: COMMAND_PING #143

Closed IRemUnknown closed 5 years ago

IRemUnknown commented 5 years ago

If you think this might be a bug, please report this trace:

<DnscatException: Unknown command sent by the server: COMMAND_PING :: {:is_request=>true, :request_id=>1, :command_id=>0, :data=>"DMKDDRUEPKHAUWCLPRBHVVXVTEPNJGQUOUYQOYCPKDXRALEVFIVVAEJNWSJVSRVGNZOTVQEDQSGFBELWLLCHJSBITVGAPINEDLVAEMBQXDSTVJIDVRLQCHSWZVSYNWIYCPEKBFQFLDYUUFEVQXLPCDPCVAODDFVWVMFIKHWCBJKJONEAIKHZJPGYBRNXLOJAINVYPYCTBTANSKUGXGIPESTDECIFMGAPWOZEFBVWMJPAECKAWOESWPZWKXXUONUM"}

00000000 00 01 00 00 44 4D 4B 44 44 52 55 45 50 4B 48 41 ....DMKDDRUEPKHA 00000010 55 57 43 4C 50 52 42 48 56 56 58 56 54 45 50 4E UWCLPRBHVVXVTEPN 00000020 4A 47 51 55 4F 55 59 51 4F 59 43 50 4B 44 58 52 JGQUOUYQOYCPKDXR 00000030 41 4C 45 56 46 49 56 56 41 45 4A 4E 57 53 4A 56 ALEVFIVVAEJNWSJV 00000040 53 52 56 47 4E 5A 4F 54 56 51 45 44 51 53 47 46 SRVGNZOTVQEDQSGF 00000050 42 45 4C 57 4C 4C 43 48 4A 53 42 49 54 56 47 41 BELWLLCHJSBITVGA 00000060 50 49 4E 45 44 4C 56 41 45 4D 42 51 58 44 53 54 PINEDLVAEMBQXDST 00000070 56 4A 49 44 56 52 4C 51 43 48 53 57 5A 56 53 59 VJIDVRLQCHSWZVSY 00000080 4E 57 49 59 43 50 45 4B 42 46 51 46 4C 44 59 55 NWIYCPEKBFQFLDYU 00000090 55 46 45 56 51 58 4C 50 43 44 50 43 56 41 4F 44 UFEVQXLPCDPCVAOD 000000A0 44 46 56 57 56 4D 46 49 4B 48 57 43 42 4A 4B 4A DFVWVMFIKHWCBJKJ 000000B0 4F 4E 45 41 49 4B 48 5A 4A 50 47 59 42 52 4E 58 ONEAIKHZJPGYBRNX 000000C0 4C 4F 4A 41 49 4E 56 59 50 59 43 54 42 54 41 4E LOJAINVYPYCTBTAN 000000D0 53 4B 55 47 58 47 49 50 45 53 54 44 45 43 49 46 SKUGXGIPESTDECIF 000000E0 4D 47 41 50 57 4F 5A 45 46 42 56 57 4D 4A 50 41 MGAPWOZEFBVWMJPA 000000F0 45 43 4B 41 57 4F 45 53 57 50 5A 57 4B 58 58 55 ECKAWOESWPZWKXXU 00000100 4F 4E 55 4D 00 ONUM.> /home/ChazzMM/dnscat2/server/drivers/driver_command_tunnels.rb:184:in tunnel_data_incoming' /home/ChazzMM/dnscat2/server/drivers/driver_command.rb:107:in_handle_incoming' /home/ChazzMM/dnscat2/server/drivers/driver_command.rb:157:in block in feed' /home/ChazzMM/dnscat2/server/drivers/driver_command.rb:142:inloop' /home/ChazzMM/dnscat2/server/drivers/driver_command.rb:142:in feed' /home/ChazzMM/dnscat2/server/controller/session.rb:243:in_handle_msg' /home/ChazzMM/dnscat2/server/controller/session.rb:387:in _handle_incoming' /home/ChazzMM/dnscat2/server/controller/session.rb:405:inblock in feed' /home/ChazzMM/dnscat2/server/controller/encryptor.rb:244:in decrypt_and_encrypt' /home/ChazzMM/dnscat2/server/controller/session.rb:395:infeed' /home/ChazzMM/dnscat2/server/controller/controller.rb:91:in feed' /home/ChazzMM/dnscat2/server/tunnel_drivers/tunnel_drivers.rb:25:inblock in start' /home/ChazzMM/dnscat2/server/tunnel_drivers/driver_dns.rb:316:in block in initialize' /home/ChazzMM/dnscat2/server/libs/dnser.rb:872:inblock (2 levels) in on_request' /home/ChazzMM/dnscat2/server/libs/dnser.rb:843:in loop' /home/ChazzMM/dnscat2/server/libs/dnser.rb:843:inblock in on_request'

IRemUnknown commented 5 years ago

I get this error when I send the ping command from the server to the client

iagox86 commented 5 years ago

My gut reaction is this is a mismatched server/client version - I didn't always support every command.

If you're sure they're both the same version, let me know! I haven't been maintaining this a ton, but I'll try to fix that sorta breaking bug.

On Thu, Jun 27, 2019 at 9:31 AM MadPackets notifications@github.com wrote:

I get this error when I send the ping command to server to the client

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/iagox86/dnscat2/issues/143?email_source=notifications&email_token=AAEAQTF5JR52X3VABECCI7TP4TTPBA5CNFSM4H35Y4XKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYXVSCY#issuecomment-506419467, or mute the thread https://github.com/notifications/unsubscribe-auth/AAEAQTC5ZEQQ6Q6DYASXZ6TP4TTPBANCNFSM4H35Y4XA .

IRemUnknown commented 5 years ago

That was exactly it, cheers!