Athena icon indicating copy to clipboard operation
Athena copied to clipboard

RHEL/CentOS Support

Open checkymander opened this issue 2 years ago • 1 comments

Describe the bug Process exits with an error when run on CentOS

Process terminated. Couldn't find a valid ICU package installed on the system. Please install libicu using your package manager and try again. Alternatively you can set the configuration flag System.Globalization.Invariant to true if you want to run with no globalization support. Please see https://aka.ms/dotnet-missing-libicu for more information.
   at System.Environment.FailFast(System.String)
   at System.Globalization.GlobalizationMode+Settings..cctor()
   at System.Globalization.CultureData.CreateCultureWithInvariantData()
   at System.Globalization.CultureData.get_Invariant()
   at System.Globalization.CultureInfo..cctor()
   at System.Globalization.CultureInfo.get_CurrentCulture()
   at System.Globalization.DateTimeFormatInfo.get_CurrentInfo()
   at System.DateTime.TryParse(System.String, System.DateTime ByRef)
   at Athena.MythicConfig..ctor()
   at Athena.MythicClient..ctor()
   at Athena.Program+<AsyncMain>d__1.MoveNext()
   at System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[[Athena.Program+<AsyncMain>d__1, Athena, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](<AsyncMain>d__1 ByRef)
   at System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start[[Athena.Program+<AsyncMain>d__1, Athena, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](<AsyncMain>d__1 ByRef)
   at Athena.Program.AsyncMain()
   at Athena.Program.Main(System.String[])
Aborted

To Reproduce 1.) Generate an Athena Agent for Linux 2.) Set your rid to linux-x64 or rhel.8-x64 3.) Execute Athena on the host

Desktop (please complete the following information): CentOS Version: 3.10.0-693.el7.x86_64 #1 SMP Tue Aug 22 21:09:27 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux Branch main/dev

Agent Config

{
    "payload_type": "athena",
    "c2_profiles": [
        {
            "c2_profile": "http",
            "c2_profile_parameters": {
                "callback_port": "443",
                "killdate": "2023-10-18",
                "encrypted_exchange_check": "T",
                "callback_jitter": "23",
                "headers": [
                    {
                        "name": "User-Agent",
                        "key": "User-Agent",
                        "value": "",
                        "custom": false
                    },
                    {
                        "name": "*",
                        "key": "",
                        "value": "",
                        "custom": true
                    }
                ],
                "AESPSK": "aes256_hmac",
                "callback_host": ""
                "get_uri": "api\/index",
                "post_uri": "api\/data",
                "query_path_name": "q",
                "proxy_host": "",
                "proxy_port": "",
                "proxy_user": "",
                "proxy_pass": "",
                "callback_interval": "10"
            }
        }
    ],
    "commands": [
        "socks",
        "jobkill",
        "load-assembly",
        "jobs",
        "load-module",
        "reset-assembly-context",
        "unload",
        "sleep",
        "exit",
        "upload",
        "execute-assembly",
        "load",
        "unlink",
        "stop-assembly",
        "download"
    ],
    "selected_os": "Linux",
    "tag": "Created by anubis at 10\/19\/2022 18:24:58 UTC",
    "wrapper": false,
    "build_parameters": [
        {
            "name": "self-contained",
            "value": "True"
        },
        {
            "name": "trimmed",
            "value": "False"
        },
        {
            "name": "compressed",
            "value": "True"
        },
        {
            "name": "ready-to-run",
            "value": "False"
        },
        {
            "name": "single-file",
            "value": "True"
        },
        {
            "name": "rid",
            "value": "linux-x64"
        },
        {
            "name": "forwarder-type",
            "value": "smb"
        },
        {
            "name": "configuration",
            "value": "Release"
        },
        {
            "name": "native-aot",
            "value": "False"
        },
        {
            "name": "output-type",
            "value": "exe"
        }
    ],
    "filename": "athena_linux_x64"
}

Additional context Current dev Athena streamlines the rid process, but removes the RHEL rid, which I'll need to find a way to re-add.

checkymander avatar Oct 19 '22 19:10 checkymander

Current workaround:

  • Set the proper environmental variable before executing payload export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1

Still need to look into proper RHEL support for everything else

checkymander avatar Oct 21 '22 15:10 checkymander

added RHEL support in dev branch, should be included with next release

checkymander avatar Feb 18 '23 05:02 checkymander