Comments (6)
vysecurity
commented on August 19, 2024
1
I’ll have another look, it might be related to the loader. Though it’s just
a basic loader that uses syscalls to inject into explorer.
…On Sun, 14 Aug 2022 at 10:41, Kyle Avery ***@***.***> wrote:
@vysecurity <https://github.com/vysecurity> I just did a test where I
injected into cmd.exe on 64-bit Windows 11. Executing the exit command in
that Beacon's console did not kill the host process. Can you tell me more
about the circumstances in which you encountered this bug so that I can
replicate it?
—
Reply to this email directly, view it on GitHub
<#2 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AA3N7USTCPBMMWGGSVX72CLVZBMGLANCNFSM56NXYW4Q>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
from aceldr.
kyleavery
commented on August 19, 2024
That probably isn't a good outcome in most scenarios. I will look into this and push a fix.
from aceldr.
kyleavery
commented on August 19, 2024
@vysecurity I just did a test where I injected into cmd.exe on 64-bit Windows 11. Executing the exit command in that Beacon's console did not kill the host process. Can you tell me more about the circumstances in which you encountered this bug so that I can replicate it?
from aceldr.
ScriptIdiot
commented on August 19, 2024
@kyleavery I did the same to inject to cmd.exe on 64-bit Windows 10. Process died when exit command was issued.
Besides, may I know if AceLdr does not support .NET execution? It also died when I tried to execute .NET in memory.
Thanks!
from aceldr.
kyleavery
commented on August 19, 2024
@ScriptIdiot I just tested 64-bit Windows 10 cmd.exe and the process did not exit. Did you use the example profile? If not, can you post your profile?
from aceldr.
kyleavery
commented on August 19, 2024
I am unable to replicate the issue on Windows 10 or 11 with cmd.exe or notepad.exe. If you continue to experience this behavior, reopen the issue and post your C2 profile and any debug information you can collect.
from aceldr.
Related Issues (14)
- some problems need help HOT 2
- UDRL issue 4.7.2 (Note on how i fixed it) HOT 2
- Why do I get Abnormal private executable memory by Moneta? HOT 1
- AceLdr shellcode causes error 0xc0000005 (access violation) on Win server 2016 HOT 6
- .text section below image base HOT 2
- ‘SetProcessValidCallTargets’ redeclared without dllimport attribute error in Kali HOT 2
- AceLdr Crashes on Windows Server 2016 , 2012 , 2008 HOT 1
- `SegCs` is not initialized
- Compilation Errors - Conflicting types for SetProcessValidCallTargets HOT 10
- Add Example Malleable C2 Profile
- Incompatible with Cobalt Strike 4.7 HOT 8
- stageless shellcode exit HOT 5
- Detect by some yara rules HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aceldr.