infobyte / faraday

Open Source Vulnerability Management Platform
https://www.faradaysec.com
GNU General Public License v3.0
5.03k stars 915 forks source link

Password prompted while connecting to webshell from remote machine #306

Closed Thilaknath closed 5 years ago

Thilaknath commented 6 years ago

Issue Type

Faraday version

C-3.2

Component Name

If you know where the problem lays indicate it: webshell

Steps to reproduce

1) Enabled webshell following instructions from faraday wiki 2) faraday server client running inside a VM 3) Able to access webshell from the dashboard (i.e the web GUI) 4) Able to access faraday server from my host machine 5) Unable to access the webshell from the host machine 6) Passord prompted and the session gets killed

Note: Currently in the Corporate trial we have two users 1) faraday and Susan Is it possible to switch the users in the client shell after its launched ?

Expected results

Should be able to access the webshell running inside the VM from my host machine

OS

Windows 10 (Host OS)

Provide information on your operating system. Example:

$ cat /etc/lsb-release DISTRIB_ID=Kali DISTRIB_RELEASE=kali-rolling DISTRIB_CODENAME=kali-rolling DISTRIB_DESCRIPTION="Kali GNU/Linux Rolling"

WinnaZ commented 6 years ago

Did you enter the sudo password or the password for said user?

Thilaknath commented 6 years ago

@WinnaZ Yes i did enter the password, But the session gets terminated no matter what.

Thilaknath commented 6 years ago

@WinnaZ I have a workaround for the above, Not sure if this the right approach.

1) Launch the butterfly server using the following flag --login. 2) The above prompts me for a username/password when i connect from an external client and i am able to access the shell once i provide the system credentials where butterfly server is running. 3) I also would have to manually go and execute ./faraday-terminal.zsh to have the client shell open with in my webshell

Can you advise if this could be improved if the client certificate is already present in the server and the user allowed to directly login in to faraday client shell.

Thilaknath commented 5 years ago

Closing this issue, Since this is not related to faraday and it corresponds to the webshell behavior.