hooooooooooook

Results 85 comments of hooooooooooook

It seems that it hangs when parsing the profile. Normally it should be generated immediately without waiting too much. Could you please provide your profile? You can replace all key...

> on the contrary , i did not see the mips option for payload generation is there a cna for that ? routers and stuff MIPS/ARM/AARCH64... is not available yet,...

> the exe/memory malleable sections are ommitted , like stage, transformations, process-inject , api call replacements , etc The above content runs normally on my side, and the file is...

I understand. It seems that the problem does occur in the parsing of the `c2profile`. It is speculated that it may be some newly added configurations in 4.9.1, which affects...

> btw , i tried with no profile and output was returning fine there is indeed a problem with profile parsing the problem of no echo of task execution results...

需要确认命令执行后,是执行了没传回结果,还是直接没执行呢? `touch /tmp/aaaaa`

cs+nginx+cf_cdn该方式部署较为常见,是可正常通信控制功能 那应该是linux beacon端未收到teamserver下发的指令,可能原因是由于c2profile中配置的http头中的 `Connection` 值,因为linux beacon是严格按照c2profile内容做发送和接收的,而windows beacon在发送数据时,并不完全严格遵守c2profile设定的数据。 尝试c2profile中关于http-get/post修改内容为`header "Connection" "close";`,可能类似的问题见: https://github.com/gloxec/CrossC2/issues/161

该错误之前未遇到过,从报错提示来看,更像是cs本身出现的问题 该版本cs是否是二次开发过的?以及该报错提示是在什么地方输出的?

wireshark抓包查看下呢?看看程序有做正常的dns请求吗

目前已知较为稳定的有4.1-4.4之间,测试正常稳定上线2年无掉线 4.9版本这种高版本的掉线原因暂不清楚,是否是正版?或者其他破解版未清除的暗桩导致?