UnicodeDecodeError when calling aggressor.artifact_payload

[oldloco]

Hello,

I have this small script that should create x64 executable called beacon.exe, when create-executable alias is called:

import pycobalt.engine as engine
import pycobalt.events as events                                                                                   
import pycobalt.aliases as aliases                                                                                 
import pycobalt.helpers as helpers                                                                                 
import pycobalt.commands as commands                                                                               
import pycobalt.aggressor as aggressor                                                                             
import pycobalt.callbacks as callbacks                                                                             
import pycobalt.console as console                                                                                  
                                                                                                                                             
@aliases.alias("create-executable", "Creates executable")                                                                                    
def _(bid, listener):                                                                                                                        
    executable = aggressor.artifact_payload(listener, "exe", "x64")                                                                          
    local_path = "/tmp/beacon.exe"                                                                                                           
    f = open(local_path, "wb")                                                                                                               
    f.write(executable)                                                                                                                      
    f.close()                                                                                                                                
                                                                                                                                             
engine.loop()

When I call this alias in beacon console, I get this error in Script Console:

[pycobalt] Executing script /tmp/beacon.py
[pycobalt beacon.py error] Traceback (most recent call last):
[pycobalt beacon.py error]   File "/tmp/beacon.py", line 18, in <module>
[pycobalt beacon.py error]     engine.loop()
[pycobalt beacon.py error]   File "/usr/local/lib/python3.9/dist-packages/pycobalt-1.2.0-py3.9.egg/pycobalt/engine.py", line 216, in loop
[pycobalt beacon.py error]     for name, message in read_pipe_iter():
[pycobalt beacon.py error]   File "/usr/local/lib/python3.9/dist-packages/pycobalt-1.2.0-py3.9.egg/pycobalt/engine.py", line 200, in read_pipe_iter
[pycobalt beacon.py error]     for line in _in_pipe:
[pycobalt beacon.py error]   File "/usr/lib/python3.9/codecs.py", line 322, in decode
[pycobalt beacon.py error]     (result, consumed) = self._buffer_decode(data, self.errors, final)
[pycobalt beacon.py error] UnicodeDecodeError: 'utf-8' codec can't decode byte 0xc0 in position 1: invalid start byte
[pycobalt] Script process exited: /tmp/beacon.py

I think it has something to do with aggressor.artifact_payload, since this same issue also arises when calling aggressor.artifact_stager.

So far I have been able to fix this error by adding sys.stdin.reconfigure(encoding="latin-1") to pycobalt/engine.py after imports and changing line 12 from my script to executable = bytes(aggressor.artifact_payload(listener, "exe", "x64"), "latin-1").

I wonder if this a proper way to fix this error or may the change to engine.py break something else?

Related version information:

• Cobalt Strike version: 4.3.0
• Pycobalt version: 1.2.0