Stager SSL cipher errors on Windows 8.1 embedded industry pro about silenttrinity HOT 9 CLOSED

Same issue here with 2012 R2 Standard (6.3.9600) and .NET Framework version 4.0.30319.42000.

In Server/listeners/http.py, line 66:

ssl_context.set_ciphers('ECDHE+AESGCM')

I just commented out this line and the stager was able to connect.

In my opinion, the ciphers used in ST are too restrictive (which is a good point for security) but in this context I think we could be more lax.
What do you think about configuring a more permissive set of ciphers?

from silenttrinity.

I'm pretty sure that's because .NET 4.5 isn't installed on windows 8.1 embedded by default. Only .NET 4.5 supports the newest TLS ciphers that ST uses.

Feel free to do some debugging tho.

from silenttrinity.

Could you give more details? How did you generate the stager? How did you run it? Can you give more information about the Windows machine? What shows you when you execute: systeminfo | findstr /C:"OS"?

Thanks.

from silenttrinity.

The systeminfo | findstr "OS" gives me 6.3.9.96000 N/A Build 96000

from silenttrinity.

Is their anyway I could get the deobfuscated c# build source code? The windows box I am using is just for hopefully contributing to this project so I could always manually install the newest version of the dot net framework, but if I could hack together a stagger that would work for both windows 10 and 8.1...

from silenttrinity.

@RayofLightz Open the visual studio solution and you should be good to go.

from silenttrinity.

Agree with @yaap7, only Windows 10 and Server 2016 supports ECDHE+AESGCM. Win8.1, Server 2012 R2 and older Windows versions support ECDHE+AES. Besides commenting out, another alternative is probably set_ciphers('ECHDE+AESGCM:ECDH+AES').

Full cipher list at https://docs.microsoft.com/en-us/windows/desktop/secauthn/cipher-suites-in-schannel

from silenttrinity.

This should have been fixed in the c2_crypto branch, feel free to try it out and report back :)

from silenttrinity.

This was fixed in 69530ae

from silenttrinity.