search

jm33-m0 / emp3r0r

Linux/Windows post-exploitation framework made by linux user
https://infosec.exchange/@jm33
MIT License
1.25k stars 235 forks source link

`get` interrupted, incomplete file download #203

Closed jm33-m0 closed 1 year ago

jm33-m0 commented 1 year ago

As shown in the screenshot, get command fails at 99%, saying the H2 connection is canceled, if we retry get it will download the remaining bytes.

image

jm33-m0 commented 1 year ago

Now both sides use io.Copy to transfer file data, not sure what causes the connection to cancel for C2 side before it can save the whole file.

Every time it fails at a certain point. From agent side I can see no errors and io.Copy finishes its job without complaining, C2 should be able to receive every byte of the file, but instead it complains that the download can't be finished before connection is closed.

jm33-m0 commented 1 year ago

In agent.ftp file, sendFile2CC has two deferred connection closing action, there's a chance that the first cancel kills the connection before it finishes its job. Removing cancel solves this issue.