Errors running ScareCrow. Exit status 128 and exit status 255

rockabillycat666 commented 1 year ago

└─# ./ScareCrow_5.1_linux_amd64 -I /root/implants/new.bin -domain microsoft.com -encryptionmode AES

  _________                           _________                       
 /   _____/ ____ _____ _______   ____ \_   ___ \_______  ______  _  __
 \_____  \_/ ___\\__  \\_  __ \_/ __ \/    \  \/\_  __ \/  _ \ \/ \/ /
 /        \  \___ / __ \|  | \/\  ___/\     \____|  | \(  <_> )     / 
/_______  /\___  >____  /__|    \___  >\______  /|__|   \____/ \/\_/  
    \/     \/     \/            \/        \/                      
                            (@Tyl0us)
    “Fear, you must understand is more than a mere obstacle. 
    Fear is a TEACHER. the first one you ever had.”

[+] Shellcode Encrypted
[+] Patched ETW Enabled
[+] Patched AMSI Enabled
[+] Sleep Timer set for 2530 milliseconds 
[*] Creating an Embedded Resource File
[+] Created Embedded Resource File With Excel's Properties
[*] Compiling Payload
exit status 1: error obtaining VCS status: exit status 128
    Use -buildvcs=false to disable VCS stamping.

[+] Payload Compiled
[*] Signing Excel.exe With a Fake Cert
2023/06/27 15:52:43 cmd.Run() failed with exit status 255

Tylous commented 1 year ago

@rockabillycat666 I only get this error if I am compiling it on a network share. I've tested on a couple different versions. Can you let me know if A you are compiling it on a share and B what version of go your using?

D4rkX0 commented 1 year ago

Hi, i faced the same problem, fixed by using go v 1.19.11. Here is my output.

`┌──(root㉿kali)-[/tmp] └─# tar -C /usr/local/ -xzf go1.19.11.linux-amd64.tar.gz

┌──(root㉿kali)-[/tmp] └─# go version
go version go1.19.11 linux/amd64

┌──(root㉿kali)-[/tmp] └─# cd /home/kali/Tools/ScareCrow

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# go get github.com/fatih/color
go: upgraded github.com/fatih/color v1.13.0 => v1.15.0 go: upgraded github.com/mattn/go-colorable v0.1.9 => v0.1.13 go: upgraded github.com/mattn/go-isatty v0.0.14 => v0.0.17 go: upgraded golang.org/x/sys v0.3.0 => v0.6.0

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# go get github.com/yeka/zip go: added github.com/yeka/zip v0.0.0-20180914125537-d046722c6feb go: added golang.org/x/crypto v0.11.0 go: upgraded golang.org/x/sys v0.6.0 => v0.10.0

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# go get github.com/josephspurrier/goversioninfo

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# go get github.com/Binject/debug/pe go: upgraded github.com/Binject/debug v0.0.0-20211007083345-9605c99179ee => v0.0.0-20230508195519-26db73212a7a

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# go get github.com/awgh/rawreader go: added github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# go build ScareCrow.go /root/go-workspace/pkg/mod/github.com/mattn/go-isatty@v0.0.17/isatty_tcgets.go:7:8: missing go.sum entry for module providing package golang.org/x/sys/unix (imported by github.com/mattn/go-isatty); to add: go get github.com/mattn/go-isatty@v0.0.17

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# go get github.com/mattn/go-isatty@v0.0.17

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# go build ScareCrow.go

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# ls
Cryptor go.mod go.sum limelighter Loader main.json README.md ScareCrow ScareCrow.go Screenshots Struct Utils

┌──(root㉿kali)-[/home/kali/Tools/ScareCrow] └─# ./ScareCrow -I /home/kali/Tools/payloads/test.exe -domain www.win-rar.com

/ / ____ ____ \ __ \ __ _ ___ _/ \_ \_ _/ \/ \ \/_ \/ _ \ \/ \/ / / \ _ / | | \/\ /\ ____| | ( <> ) / /___ /_ >__ /| _ >____ /|| __/ \/_/
\/ \/ \/ \/ \/
(@Tyl0us) “Fear, you must understand is more than a mere obstacle. Fear is a TEACHER. the first one you ever had.”

[!] Missing Garble... Downloading it now [] Encrypting Shellcode Using ELZMA Encryption [+] Shellcode Encrypted [+] Patched ETW Enabled [+] Patched AMSI Enabled [+] Sleep Timer set for 2224 milliseconds [] Creating an Embedded Resource File [+] Created Embedded Resource File With Excel's Properties [] Compiling Payload [+] Payload Compiled [] Signing Excel.exe With a Fake Cert [+] Signed File Created [+] Binary Compiled [!] Sha256 hash of Excel.exe: a5de31d88f4d4d920c8a2f4cd41e03bcabc109145e4abed32454f294695d6e7e `

optiv / ScareCrow

Errors running ScareCrow. Exit status 128 and exit status 255 #78