search

optiv / Ivy

Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.
MIT License
740 stars 127 forks source link

panic: strings: negative Repeat count #17

Closed jamesjguthrie closed 2 years ago

jamesjguthrie commented 2 years ago

Hey,

When trying a number of the example commands including:

Ivy -stageless -Ix64 stageless64.bin -Ix86 stageless32.bin -P Inject -process64 C:\\windows\\system32\\notepad.exe -process32 C:\\windows\\SysWOW64\\notepad.exe -O stageless.js

I get the error:

panic: strings: negative Repeat count

goroutine 1 [running]:
strings.Repeat(0x569f21, 0x4, 0xffffffffffffffff, 0xc00007ed78, 0x40971b)
    /usr/lib/go-1.13/src/strings/strings.go:533 +0x5aa
github.com/optiv/Ivy/Cryptor.StagelessArrayGen(0x0, 0x0, 0x0, 0x0, 0x0)
    /home/jabo/go/src/github.com/optiv/Ivy/Cryptor/Cryptor.go:84 +0x48
main.main()
    /home/jabo/go/src/github.com/optiv/Ivy/Ivy.go:128 +0xbc8

I'm running v1.12 on Ubuntu 20.04.3 LTS with the dependencies installed per your instructions.

jamesjguthrie commented 2 years ago

Oh I just noticed that stageless32/64 binaries don't exist. Is your intention that we use a tool like Meterpreter to create those payloads?

Tylous commented 2 years ago

stageless is a universal thing, most frameworks can and do stateless. That being you need to do raw shellcode not compiled binaries as the input.

Tylous commented 2 years ago

Is this still an issue?