Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crazy behaviour #1791

Open
artemy-ccrsky opened this issue Oct 9, 2024 · 2 comments
Open

Crazy behaviour #1791

artemy-ccrsky opened this issue Oct 9, 2024 · 2 comments

Comments

@artemy-ccrsky
Copy link

artemy-ccrsky commented Oct 9, 2024

Compile from sources current version of Sliver
P.S. Yes, I'm aware of the warnings, I was just trying to point out the current behavior in the source code.

IT'S CRAZY or i am really doing something wrong:
for example using sharpsh armory - insert hell Unicode and C# symbols
image

With another way mimikatz did not work - just push svchost path as prompt (try everything mimikatz -- "coffee" OR mimikatz -- coffee too):

image

What's up with deleting entire lines instead of individual characters using CLI? That's ridiculously inconvenient!

Armory modules only produce output when run with the --in-process flag; otherwise, there is absolutely no result.

@miszr
Copy link

miszr commented Oct 18, 2024

I believe this might have to do with the fact that strings in Go are not null-escaped. This causes the strings to continue untill a null character is found.

A fix would require all strings sent to BOFs and Extensions to be explicitly null-escaped.

@rkervella
Copy link
Member

We're in a transition with extensions. The whole extension manifest has been revamped for 1.6, but most of the extensions in the armory are not compatible with that yet (to avoid breaking things for people using releases versions). The new extension model uses the same BOF argument parser/packer than the BOFs use, which imposes the extensions authors to add that logic to their extensions.
For the assembly, it seems there was an issue while loading it, per the HRESULT you got (maps to System.Reflection.TargetInvocationException from a quick Google search). Not sure what happened here, could be a bug in the lib we're using, or could be a security product partially blocking the load.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants