Havoc icon indicating copy to clipboard operation
Havoc copied to clipboard

Teamserver-Client: Reliably crash Teamserver client through Scripting Console

Open rmusser01 opened this issue 3 years ago • 2 comments

Issue: When interacting with the scripting console on a Teamserver client, it is possible to reliably crash the Teamserver client application by submitting input with () appended.

Reproduction:

  1. Launch teamserver client
  2. Connect to teamserver
  3. Open Script console
  4. Enter the string help()
  5. Script console will become unresponsive, and you must kill the process for it to close.

Output from teamserver client console is as follows:

[20:48:11] [error] [DB] Couldn't query Scripts: No query Unable to fetch row
Traceback (most recent call last):
  File "<string>", line 1, in <module>
NameError: name 'check' is not defined
Traceback (most recent call last):
  File "<string>", line 1, in <module>
NameError: name 'pease' is not defined
Traceback (most recent call last):
  File "<string>", line 1, in <module>
NameError: name 'please' is not defined
^C[20:51:21] [info] Havoc Application status: 0

Resolution: When entering commands into the script console, unexpected or malformed input is disregarded and safely handled.

rmusser01 avatar Sep 17 '22 00:09 rmusser01

This should be resolved properly but Ill still say that an error-handler is a good idea regardless, so https://github.com/HavocFramework/Havoc/issues/137 is related.

chbGSmCm avatar Oct 05 '22 17:10 chbGSmCm

As far as i know this issue still is there and i gotta take a look on how to resolve that since its related to the python intepreter.

Cracked5pider avatar Oct 05 '22 17:10 Cracked5pider