Rubeus icon indicating copy to clipboard operation
Rubeus copied to clipboard

Published 20 hours ago • verified publisher icon GhostPack

Removed use of System.Environment.Exit

Open anthemtotheego opened this issue 3 years ago • 12 comments

This prevents Rubeus from killing your process when running certain functions inline (or in a non sacrificial process). To reproduce, run current Rubeus through inline-ExecuteAssembly in monitor mode for X seconds. The process is killed and you lose your beacon. If you remove System.Environment.Exit and run the same command, it functions properly and you do not lose your beacon.

anthemtotheego avatar Feb 18 '22 14:02 anthemtotheego

I'm not 100% because my experience with CS is limited, @CCob may be better to comment on this

0xe7 avatar Apr 29 '22 18:04 0xe7

The one for HarvestTicketGrantingTickets it fine, but StringToByteArray is used everywhere it looks like which will more likely lead to a confusing NullReferenceException. @anthemtotheego, can we change the PR so that it throws InvalidParameterException for the StringToByteArray function?

CCob avatar May 19 '22 13:05 CCob

Yeah, no issue at all with you changing it to avoid any possible issues.

anthemtotheego avatar May 19 '22 19:05 anthemtotheego