jm33-m0 / emp3r0r

Linux/Windows post-exploitation framework made by linux user
https://infosec.exchange/@jm33
MIT License
1.24k stars 235 forks source link

socks5 agent functionality always crashes, and crashes cause agents to be taken offline, #245

Closed winezer0 closed 10 months ago

winezer0 commented 11 months ago

Describe the bug

socks5 agent functionality always crashes, and crashes cause agents to be taken offline,

To Reproduce

Steps to reproduce the behavior:

  1. linux running agent
  2. Enable the proxy function
  3. Try to connect to socks5
  4. The link is successful, but the agent network is disconnected
  5. panic occurs on the panel
  6. PS -ef kills the emp3r0r process and restarts the EMP3R0r process
  7. Restart to discover that the agent is offline
  8. The agent running on the crashed host cannot go online | Other hosts are normal.

Expected behavior

1.socks5 needs to be stable, and the agent cannot easily exit by error

2.Can the host run multiple clients at the same time

Screenshots

No screenshots this time, I forgot every time

Your environment

emp3r0r.json

I suggest that you format your JSON with an online JSON formatter, for example https://codebeautify.org/jsonviewer

emp3r0r.json:
Paste emp3r0r.json here, you can redact sensitive information

CC

Linux distro name and version, use cat /etc/*release* to view, paste the result below

# cat /etc/*release*

C2 Transport

Agent

OS

CPU architecture

Additional context

jm33-m0 commented 11 months ago

I have tested run_proxy feature and it didn't crash.

2023-08-10_14-23

Could you share the crash log with VERBOSE=true ./agent?

winezer0 commented 11 months ago

Now that I don't have the environment to replicate this,

Can only submit the next time there is a problem

But I guess the problem is caused by too much traffic

Does this command "VERBOSE=true ./agent" run under agent?

Does emp3r0r server have log ?

jm33-m0 commented 11 months ago

Does this command "VERBOSE=true ./agent" run under agent?

Yes, it makes agent process print log on stderr

Does emp3r0r server have log ?

You can type debug 3 to increase debug level, but mostly it's unnecessary.

winezer0 commented 11 months ago

Ok, I'll keep an eye on this error message next time.

Usually s5 or other issues (like I broke while generating agent) will indicate that the panel is dead and the entire program must be shut down.

So I can only set the log information before running the program.

jm33-m0 commented 11 months ago

If you want to cleanly shutdown C2 program, execute tmux kill-session -t emp3r0r

winezer0 commented 11 months ago

tmux kill-session -t emp3r0

Okay, thank you. That's very helpful.

Oh, and I have a little question

How do I copy the contents of a tmux with emp3r0r installed using my mouse

jm33-m0 commented 11 months ago

How do I copy the contents of a tmux with emp3r0r installed using my mouse

You can hold shift while selecting text. I wrote a tutorial for basic tmux usage.

winezer0 commented 11 months ago

Thank you very much. I see that. I only looked at the shortcut keys in the table at first