search

mitre / sandcat

A CALDERA plugin
https://caldera.mitre.org/
Apache License 2.0
60 stars 36 forks source link

Executing issues with Sandcat agent #416

Open Purpl3Lynx opened 2 years ago

Purpl3Lynx commented 2 years ago

I'm testing some adversary emulation on Caldera and I'm using Sandcat as the agent to deploy operations. I have this ability with just an executable called Backstab and it runs fine both locally and with Sandcat. It's behavior: drops a Procexp driver, creates the service and kills a protected program leveraging Procexp.

To test further techniques I use SharpSploit to embed Backstab and this SharpSploit+Backstab runs as expected when executed locally on the victim system. But If I execute the same binary from Caldera with Sandcat it executes fine (the Procmon logs match with the previous local execution) but no actions take place (the protected process is not killed). In addition, the driver dropped it's supposed to be deleted before ending the execution, but this deletion does not happen and if I try to delete it manually the system complains that the file is being used. So it's like the execution never ended and the service is still running although Caldera marks the operation as successful.

My impression is that somehow the execution is stopped by the agent or Caldera. It is weird that Procmon logs are the same, that's why I'm suspicious of Sandcat. I have all defenses disabled. I am testing on a Windows 10. I have tried with Manx agent but I'm having other issues running Manx agents so I cannot test this.

elegantmoose commented 1 year ago

@Purpl3Lynx Apologies for VERY late response. Were you able to solve this?