mufeedvh / moonwalk

Cover your tracks during Linux Exploitation by leaving zero traces on system logs and filesystem timestamps.
MIT License
1.35k stars 123 forks source link

Crash when using start #2

Closed ariary closed 2 years ago

ariary commented 2 years ago

moonwalk crashes when I try to use start subcommand (other also subcommand btw).

I have tried all the installation way provided in the README, nothing change.

Here is the output of the command:

$ moonwalk start
thread 'main' panicked at 'failed to execute child process: Os { code: 2, kind: NotFound, message: "No such file or directory" }', src/core/recon.rs:10:10
stack backtrace:
   0:     0x5556628d9ebc - <unknown>
   1:     0x55566289ebfc - <unknown>
   2:     0x5556628dba6f - <unknown>
   3:     0x5556628db09f - <unknown>
   4:     0x5556628da524 - <unknown>
   5:     0x5556628db01d - <unknown>
   6:     0x555662893521 - <unknown>
   7:     0x555662893613 - <unknown>
   8:     0x5556628aa0fb - <unknown>
   9:     0x5556628adce0 - <unknown>
  10:     0x5556628b422b - <unknown>
  11:     0x555662894c6c - <unknown>
  12:     0x5556628b2483 - <unknown>
  13:     0x5556628a93f3 - <unknown>
  14:     0x5556628b3d36 - <unknown>
  15:     0x7fd44b532bf7 - __libc_start_main
                               at /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
  16:     0x55566289682e - <unknown>
  17:                0x0 - <unknown>
Aborted (core dumped)
ariary commented 2 years ago

Complementary info:

$ uname -a
[...] 4.15.0-137-generic #141 x86_64 x86_64 x86_64 GNU/Linux

$ cargo --version
cargo 1.54.0 (5ae8d74b3 2021-06-22)

$ rustc --version
rustc 1.54.0 (a178d0322 2021-07-26)
mufeedvh commented 2 years ago

Thank you for raising this issue, it's due to the fact that find command was not available on the machine. There is a default fallback for the function to use /tmp but that error case should've been added to Command execution as well.

I will fix this issue in the next release! :+1:

btv commented 2 years ago

In quickly reviewing the code, the code assumes find is at /bin/find. That is not always the case, on my current machine it's located at /usr/bin/find.

mufeedvh commented 2 years ago

This has been fixed, thank you @ariary @btv! :raised_hands::heart:

ariary commented 2 years ago

LGTM