Powershell Error from client

[domwhewell]

Hi,

I am getting an error from the client when it successfully connects back to my listener ive pasted some output below;

Listener Sucessfully Running

Octopus >>listeners

Name       IP         Port  Host              Interval  Path      SSL
---------  -------  ------  --------------  ----------  --------  -----
listener1  0.0.0.0      80  192.168.80.129           5  page.php  False

Session Started on target

  Session  IP            Hostname           Process Name / PID / Arch    Username    Domain     Last ping                 OS
---------  ------------  -----------------  ---------------------------  ----------  ---------  ------------------------  --------------------------------
        2  192.168.80.1  TestHost-PWYVI  powershell (21060) - x64     test*   WORKGROUP  Thu Nov 12 11:30:11 2020  Microsoft Windows 10 Pro(64-bit)

Error Received each time host checks in

Octopus >>
Command execution result is :
Invoke-Expression : Cannot bind argument to parameter 'Command' because it is an empty string.
At line:144 char:33
+         $ec = Invoke-Expression ($fc) | Out-String;
+                                 ~~~~~
    + CategoryInfo          : InvalidData: (:) [Invoke-Expression], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.PowerShell.Commands.Invo
   keExpressionCommand

I have tried several different generation methods each with the same results, I have turned AV off but still the same error.

Please could you assist?

[mhaskar]

Thank you @domwhewell for reporting this.

We think that this issue is happened because of the new random agent generator feature, we noticed in some rare cases that some variables are not named correctly, so we are investigating this issue now.

Can you please regenerate the agent and test it again on the same target and execute it?

[domwhewell]

Hi @mhaskar Thanks for your reply.

I have recreated the listener and run the powershell on my same host with the same result

Octopus >>listeners
Name       IP         Port  Host              Interval  Path         SSL
---------  -------  ------  --------------  ----------  -----------  -----
listener1  0.0.0.0      80  192.168.80.129           5  profile.php  False

Session has been started on target;

  Session  IP            Hostname           Process Name / PID / Arch    Username    Domain     Last ping                 OS
---------  ------------  -----------------  ---------------------------  ----------  ---------  ------------------------  --------------------------------
        1  192.168.80.1  TestHost-HBCRQ  powershell (10908) - x64     test*   WORKGROUP  Fri Nov 27 10:50:14 2020  Microsoft Windows 10 Pro(64-bit)

And Error received from client;

Command execution result is :
Invoke-Expression : Cannot bind argument to parameter 'Command' because it is an empty string.
At line:144 char:33
+         $ec = Invoke-Expression ($fc) | Out-String;
+                                 ~~~~~
    + CategoryInfo          : InvalidData: (:) [Invoke-Expression], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.PowerShell.Commands.Invo
   keExpressionCommand

My TestHost is Windows 10 Pro 2004 if that may be what is causing this error

[w0rm12]

Yes, it might be possible because of the new OS update. Even I am facing the same issue.

[mhaskar]

Thank you @domwhewell and @w0rm12 for the updates.

I run the same agent on multiple windows versions and didn't face this issue.

Can you please share with me the winver results for the targets?

[yfang831]

We run into the same issue. Two PC I am testing with. windows 10, version 1809, os build 17763.1577 windows 10, version 20H2, os build 19042.685

@mhaskar what version of windows you have success with?

[madmantm]

Having the same issues as @w0rm12

Here are my OS Versions :

Windows 10 Version 1909 (OS Build 18363.1379) Windows 10 Version 20H2 (OS Build 19042.804)

Thanks a lot for your time and work on this C2 ;)

[ChristineSeven]

Having the same issues, too.

[tijldeneut]

I found that the issue is due to the libraries used on the server side, not the client side. I started getting this issue once I upgraded my Octopus server OS from Ubuntu 20.04.4 to 20.04.6

I'm guessing some encryption algorithm no longer supported or something?