Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Runtime error: index out of range [3] with length 3 #7

Open
QU35T-code opened this issue Oct 13, 2023 · 4 comments
Open

Runtime error: index out of range [3] with length 3 #7

QU35T-code opened this issue Oct 13, 2023 · 4 comments

Comments

@QU35T-code
Copy link

  1. Create a HTTP listener
  2. Run shaco agent on the target (Linux c8b61144fa84 5.4.0-1030-aws #31-Ubuntu SMP Fri Nov 13 11:40:37 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux)
  3. Crash error
[*] teamserver socket opened
[*] New Message
[*] register agent
[*] New Message
send agent checkin request
[*] New Message
new command register request
[-] Websocket error: Connection to remote host was lost.
[21:34:35] [INFO] [SERVICE] registered a new agent [Name: Shaco]
[21:34:35] [DBUG] [service.(*Service).dispatch:206]: {"Name":"Shaco","MagicValue":"0x6861636f","Author":"@souzomain","Formats":[{"Name":"Linux Executable","Extension":"elf"},{"Name":"Linux Shared Library","Extension":"so"}],"SupportedOS":null,"Description":"Shaco payload, version: 0.1","Commands":[{"Name":"shell","Description":"executes commands using shell","Help":"shell \u003ccommand\u003e","NeedAdmin":false,"Mitr":["T1059.004"],"Params":[{"Name":"command","IsFilePath":false,"IsOptional":false}]},{"Name":"cd","Description":"change direcroty","Help":"cd \u003cpath\u003e","NeedAdmin":false,"Mitr":[""],"Params":[{"Name":"command","IsFilePath":false,"IsOptional":false}]},{"Name":"pwd","Description":"get current directory","Help":"pwd","NeedAdmin":false,"Mitr":[""],"Params":[]},{"Name":"upload","Description":"upload file to agent. Don't try upload \u003e 7k","Help":"upload \u003clocalfile\u003e \u003cremote put file\u003e","NeedAdmin":false,"Mitr":[""],"Params":[{"Name":"localfile","IsFilePath":true,"IsOptional":false},{"Name":"remotefile","IsFilePath":false,"IsOptional":false}]},{"Name":"download","Description":"download file of agent","Help":"download \u003cremotefile\u003e","NeedAdmin":false,"Mitr":[""],"Params":[{"Name":"remotefile","IsFilePath":false,"IsOptional":false}]},{"Name":"checkin","Description":"agent checkin","Help":"checkin","NeedAdmin":false,"Mitr":[""],"Params":[]},{"Name":"exit","Description":"","Help":"exit","NeedAdmin":false,"Mitr":[""],"Params":[]},{"Name":"sleep","Description":"change sleep duration","Help":"","NeedAdmin":false,"Mitr":[],"Params":[{"Name":"time","IsFilePath":false,"IsOptional":false}]},{"Name":"jitter","Description":"change max timeout duration: jitter = random_int(sleep, sleep+maxtimeout)","Help":"jitter \u003ctime\u003e","NeedAdmin":false,"Mitr":[],"Params":[{"Name":"time","IsFilePath":false,"IsOptional":false}]}],"BuildingConfig":{"AntiDebug":true,"Daemon":true,"HideCmdline":true,"MaxTimeout":"0","Sleep":"5"}}
[21:34:39] [DBUG] [service.(*AgentService).SendResponse:112]: map[Body:map[Agent:<nil> AgentHeader:map[AgentID:000b39af MagicValue:6861636f Size:0] RandID:794b96 Response:AAAADlFsSFB5SzJDMnE2aU4yUlRYUG5lZTBXNDE4YzRs Type:AgentResponse] Head:map[Type:Agent]]
[21:34:39] [DBUG] [service.(*Service).dispatch:343]: BodyAgentResponse
[21:34:39] [DBUG] [service.(*Service).dispatch:344]: map[Body:map[Agent:<nil> AgentHeader:map[AgentID:000b39af MagicValue:6861636f Size:0] RandID:794b96 Response:AAAADA== Type:AgentResponse] Head:map[Type:Agent]]
[21:34:39] [DBUG] [service.(*Service).dispatch:355]: [0xc0004740f0]
[21:34:39] [DBUG] [service.(*AgentService).SendResponse:112]: map[Body:map[Agent:<nil> AgentHeader:map[AgentID:000b39af MagicValue:6861636f Size:0] RandID:73e831 Response:AAAADAALOa8AAAAMYzhiNjExNDRmYTg0AAAABihub25lKQAAAAYobm9uZSkAAAAPMTkyLjE2OC4xMDAuMTAwAAAJAgAAAAEAAAAGeDg2XzY0AAAAAQAAAA41LjQuMC0xMDMwLWF3cwAAAAUAAAAAZDlmTzBCME1qdDZZdg== Type:AgentResponse] Head:map[Type:Agent]]
panic: runtime error: index out of range [3] with length 3

goroutine 26 [running]:
Havoc/pkg/agent.getWindowsVersionString({0xc00036ac48?, 0xa?, 0xd32bd1?})
	/home/qu35t/Documents/Havoc/teamserver/pkg/agent/agent.go:1290 +0x3ff
Havoc/pkg/agent.RegisterInfoToInstance({0xc00038c3a0?, 0xc0001879c8?, 0x1?, 0x0?}, 0x466419?)
	/home/qu35t/Documents/Havoc/teamserver/pkg/agent/agent.go:288 +0xb32
Havoc/pkg/service.(*Service).dispatch(0xc000438630, 0xc00043d230, 0xc0004740f0)
	/home/qu35t/Documents/Havoc/teamserver/pkg/service/service.go:329 +0x9bf
Havoc/pkg/service.(*Service).routine(0xc6cfc0?, 0xc0004740f0)
	/home/qu35t/Documents/Havoc/teamserver/pkg/service/service.go:162 +0x4f
Havoc/pkg/service.(*Service).handleConnection(0xc000438630, 0xc0000f8160)
	/home/qu35t/Documents/Havoc/teamserver/pkg/service/service.go:69 +0xf7
created by Havoc/pkg/service.(*Service).Start.func1
	/home/qu35t/Documents/Havoc/teamserver/pkg/service/service.go:45 +0xf0
@souzomain
Copy link
Owner

Hey, I'll understand better this issue later, call me in discord if you have more details

@QU35T-code
Copy link
Author

The problem is that when requesting agent registration at Havoc, Havoc tries to determine the version of the agent. But Havoc only supports Windows, it cannot find the Linux version, which causes a crash

@rm1984
Copy link

rm1984 commented Feb 29, 2024

The problem is that when requesting agent registration at Havoc, Havoc tries to determine the version of the agent. But Havoc only supports Windows, it cannot find the Linux version, which causes a crash

Hi,
thank you QU35T-code, I'm having exactly the same issue right now.
What could be possibile solutions? Faking the Shaco agent as running on Windows?
Or asking Havoc maintainer to add support for other platforms?

@ElJayRight
Copy link

You can add this:

	if len(OsVersion) != 5 {
		logger.Debug("Idk What this is:", OsVersion)
		return WinVersion
	}

on line 1245 in agent.go and it will fix server crashing. A better fix would be to pass out the version string, but im to lazy for that rn

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants