Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Internal Monologue runs only once for each agent #43

Closed
Invoke-Mimikatz opened this issue Dec 29, 2019 · 2 comments · Fixed by #149
Closed

Internal Monologue runs only once for each agent #43

Invoke-Mimikatz opened this issue Dec 29, 2019 · 2 comments · Fixed by #149
Labels
bug Something isn't working

Comments

@Invoke-Mimikatz
Copy link

Invoke-Mimikatz commented Dec 29, 2019

Empire Version

3.0 Bug Fixes

OS Information (Linux flavor, Python version)

Kali 2019.2, Python 3.7.5

Expected behavior and description of the error, including any actions taken immediately prior to the error. The more detail the better.

Expected behaviour: invoke_internal_monologue module dumps the same NetNTLMv1 hashes every time, once for each run of the module.

Observed behaviour: invoke_internal_monologue module dumps NetNTLMv1 hashes only ONCE on the first run of the module for that agent, and never again after that (for that agent only). The agent stays alive, and commands can be run on the agent after, but invoke_internal_monologue will return no v1's again.

Screenshot of error, embedded text output, or Pastebin link to the error

image

Any additional information

Running agent on Windows 10 (1809), PSVersion 5.1

@Cx01N Cx01N added the bug Something isn't working label Dec 29, 2019
@Cx01N Cx01N linked a pull request Apr 2, 2020 that will close this issue
@Cx01N
Copy link

Cx01N commented Apr 2, 2020

@Invoke-Mimikatz I added a check to clear the table if the module has been run before. It is not the most graceful fix, but it fixes the issue. Could you test out the PR and see if it fixed the issue for your setup?

@Invoke-Mimikatz
Copy link
Author

Nice fix. Seems to work as expected on my systems

image

vinnybod added a commit that referenced this issue Apr 8, 2021
* added ms16-051 rce stager

* reformatted file

* Update empire/server/stagers/windows/ms16-051.py

Co-authored-by: Vincent Rose <vrose04@gmail.com>

* fixed error with quotes

Co-authored-by: Vincent Rose <vrose04@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants