search

jm33-m0 / emp3r0r

Linux/Windows post-exploitation framework made by linux user
https://infosec.exchange/@jm33
MIT License
1.26k stars 232 forks source link

KCP: CC unable to detect agent disconnection #118

Closed jm33-m0 closed 2 years ago

jm33-m0 commented 2 years ago

When an agent using KCP+Shadowsocks as C2 transport dies, C2 is not aware of its disconnection

jm33-m0 commented 2 years ago

Since TakeASnap might take up to 2 minutes, we set timeout value to exactly 2 min, side effect is that when a KCP agent dies, you will be notified after 2 min rather than immediately.

This change doesn't affect TCP-based C2 transports, as CC is able to check TCP connection state reliably.

https://github.com/jm33-m0/emp3r0r/blob/cb9afb2b290b47e2570367b1592fd43365a2c9c7/core/lib/util/proc.go#L160-L164

https://github.com/jm33-m0/emp3r0r/blob/cb9afb2b290b47e2570367b1592fd43365a2c9c7/core/lib/agent/poll.go#L235-L254