Athena icon indicating copy to clipboard operation
Athena copied to clipboard

coff doesn't respect impersonation context of agent.

Open checkymander opened this issue 1 year ago • 0 comments

Describe the bug When running the coff command, a new thread is spun up without specifying LPSECURITY_ATTRIBUTES, the default behavior of this function is to use the token of the calling process, rather than the impersonated thread.

https://github.com/MythicAgents/Athena/blob/dev/Payload_Type/athena/athena/agent_code/AthenaPlugins/coff/coff/BofRunner.cs#L83

Fix: Since the task is already being spun up in a new thread, could I potentially just change the entry point to a delegate function and just execute it directly that way?

checkymander avatar May 05 '23 17:05 checkymander