PoshC2 icon indicating copy to clipboard operation
PoshC2 copied to clipboard

[BUG] FComm implants do not update "last seen" time in implant handler

Open Console opened this issue 4 years ago • 0 comments

Description

A clear and concise description of what the bug is.

Execution Environment:

All of this must be filled in

Data Value
Full Posh version (all the text between the === at the top of the Implant Handler) PoshC2 v7.3.0 (2c06985 2021-01-12 17:00:37)
Using Docker/containerisation? WSLv2

Implant Info

  • What implant does the problem occur on? FComm
  • How was the implant created? Created using scarecrow with donut shellcode x64

Defensive Technologies

  • Is the target environment running any particular defensive products? Defender, Carbon Black Cloud.

To Reproduce

Steps to reproduce the behavior: Create new fcomm implant run commands over a period of time on fcomm implant.

Expected behavior

last seen time within implant handler updates to show the time that fcomm last successfully communicated. - This does not occur, last seen time remains stuck at "initialisation" time.

Screenshots

image

Attach files if required

Additional context

I think this could be related to some of the side improvements to the implant handler brought in as part of the FComm branch.

Console avatar Feb 09 '21 15:02 Console