SQL-BOF icon indicating copy to clipboard operation
SQL-BOF copied to clipboard

Crash in x86 version

Open bugch3ck opened this issue 9 months ago • 2 comments

Description

Running sql-info or sql-query in a x86 beacon results in a crash.

Steps to reproduce

Start x64 beacon (reproduced with stageless x86 exe).

beacon> sql-info asd
beacon> sql-query asd asd

Watch beacon die and review Application Eventlog for crash.

Faulting application name: https_x86.exe, version: 0.0.0.0, time stamp: 0x00000000
Faulting module name: msvcrt.dll, version: 7.0.22621.2506, time stamp: 0xd9bf2a9a
Exception code: 0xc0000005
Fault offset: 0x0007e6de
Faulting process ID: 0x0x7FC
Faulting application start time: 0x0x1DAA7D8E039336E
Faulting application path: C:\[redacted]\https_x86.exe
Faulting module path: C:\Windows\System32\msvcrt.dll
Report ID: 2a799cca-6f49-4643-b944-ea70ed563a6f
Faulting package full name: 
Faulting package-relative application ID: 

Test environment

  • OS: Microsoft Windows [Version 10.0.22631.3447]
  • CobaltStrike: 4.9.1
  • Kits: None
  • Profile: webbug

bugch3ck avatar May 16 '24 21:05 bugch3ck