rasta-mouse
commented
1 year ago Open rasta-mouse opened 1 year ago
rasta-mouse
commented
1 year ago 
benpturner
commented
1 year ago Thanks @rasta-mouse - we'll try and take a look into this.
riskydissonance
commented
1 year ago Hey, apologies for the slow response over xmas etc.
I'm not able to reproduce this with a fresh build from the master branch - I only get the error you get when using the wrong bof architecture for the binary (though from your logs it looks like you have it correct).
E.g. working:
Not working:
I appreciate "it works on my machine" isn't helpful but maybe just double check the files are named correctly in terms of architecture and have another go. I used make with mingw32 on WSL to build the dependencies if it helps.
Feel free to ping me on twitter/discord (am on the HTB server with the same name) if you want to dive into it a bit and we can re-open this if we confirm issues.
riskydissonance
commented
1 year ago Unable to reproduce locally but issue confirmed on @rasta-mouse 's build. Looking into it but have published working builds as a release in the interim.
rasta-mouse
commented
1 year ago Your build works with both the published BOF and my BOF. Issue certainly appears to be in my build of RunOF.
checkymander
commented
1 year ago Trying to implement this in a .net agent, and getting the same issue as rasta. Made some modifications to the code (mostly to change parsed_args to a dictionary rather than an object and removed debug messages)
In case it matters I'm running modified RunOF in an executable on .NET 7 Windows version: 22621.1105 Windows 11 Pro 22H2
checkymander
commented
1 year ago Update when I use this code to steal the embedded resource from your release, and use that it works fine lmao
using System.IO;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.Loader;
AssemblyLoadContext alc = new AssemblyLoadContext("");
Assembly assembly = alc.LoadFromAssemblyPath(@"C:\Users\Administrator\Downloads\RunOF_x64 (1)\RunOF.exe");
using(Stream s = assembly.GetManifestResourceStream("RunOF.beacon_funcs"))
{
Console.WriteLine(s.Length);
var file = File.Create(@"C:\users\Administrator\Downloads\stolen_beacon_funcs.o");
byte[] buffer = new byte[8 * 1024];
int len;
while ((len = s.Read(buffer, 0, buffer.Length)) > 0)
{
file.Write(buffer, 0, len);
}
file.Close();
}So, I think Rasta's issue has something to do with the Makefile, or the compilation environment?
riskydissonance
commented
1 year ago Hmm that's interesting aye 🤔and I assume if you build the beacon_funcs and use that you also hit the error?
checkymander
commented
1 year ago yep exactly, I built the beacon_funcs on an ubuntu 20.04 box using the Makefile and got the same issue as Rasta.
checkymander
commented
1 year ago Re-examining this, I compiled it in a more up to date Linux machine (Ubuntu 22.04) and it compiled and ran without issue. So it definitely seems like it's down to the version being run.