search

mgeeky / Stracciatella

OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, Constrained Language Mode and Script Block Logging disabled at startup
GNU General Public License v3.0
495 stars 64 forks source link

File /path/to/Stracciatella.exe is not a process assembly(.NET EXE) #2

Closed ac884b closed 3 years ago

ac884b commented 3 years ago

I am running into an issue when trying to execute straciatella from a beacon console command "straciatella get-childitem" I get : [*] Tasked Beacon to run Stracciatella: get-childitem [-] File /path/to/stracciatella.exe is not a process assembly (.NET EXE)

However, If i run the Straciatella.exe through execute-assembly, it works properly - "execute-assembly /path/to/straciatella.exe get-childitem"

I have compiled it with VS2019 as .NET3,5; .NET4; .NET4.5; .NET4.8 and all versions showed the same result.

ac884b commented 3 years ago

The issue is resolved.

The problem was running CS on linux, where the aggressor script requires "straciatella.exe"(lowercase) and due to case sensitivity and "path/to/Straciatella.exe"(Uppercase "S") throws an error.

The resolution was to just rename Straciatella.exe -> straciatella.exe