Covenant icon indicating copy to clipboard operation
Covenant copied to clipboard

[Bug] powershell encoded command fails

Open ll3N1GmAll opened this issue 3 years ago • 2 comments

Bug

Describe the feature request or bug The encoded command for the powershell launcher fails to execute.

To Reproduce Steps to reproduce the behavior:

  1. create powershell launcher
  2. copy encoded command output
  3. paste command into windows terminal

Expected behavior target connects to Covenant

Screenshots no screen shots available

Covenant Server Information:

  • OS: kali and windows
  • Docker or Native: Native

Browser Information:

  • Browser firefox and brave
  • Version 78.11.0esr and 1.27.109

Target Information (System that implant is running on):

  • OS: windows
  • Version server 2019 standard

Additional context I get the standard powershell output that echoes to the screen when you enter in a command incorrectly. Exact verbiage at the top is: "cannot process the command because the value specified with -EncodedCommand is not properly encoded. The value must be Base64 encoded."

ll3N1GmAll avatar Jul 30 '21 07:07 ll3N1GmAll

I RDP'd directly into the target server and tried to use the -encodedcommand in the standard windows terminal; but it appears that it is being truncated. I noticed the same issue in [Bug] Powershell launcher fails #330; but RDPing in and pasting the command resolved the issue. This encoded command is too large to paste into the terminal though and saving it as a bat file writes to disk and triggers AV.

ll3N1GmAll avatar Jul 30 '21 20:07 ll3N1GmAll

If you're RDPing there's a good chance it will get cut off - try hosting the file instead via launcher->powershell->host panel

My RDP was giving me this error:

[14:48:12:256] [825884:825935] [WARN][com.freerdp.client.x11] - failed to get clipboard data in format UTF8_STRING [source format CF_UNICODETEXT]

0xVavaldi avatar Apr 05 '22 18:04 0xVavaldi