cobbr / cobbr/Covenant

[Bug] Dev Branch: Mimikatz tasks failing to find decoy modules, not running.

Open
#308 7 comments 0 reactions 1 assignee Claimed by @cobbr View on GitHub
cant-reproduce
Dominant language
C#
Stars
4.7k
Forks
822
PR merge metrics
No merged PRs in 30d

Description

**Feature Request or Bug**
Bug

**Describe the feature request or bug**
On the dev branch I cannot run any mimikatz-related tasks successfully; I receive "Failed to find suitable decoy module." errors.

**To Reproduce**
Steps to reproduce the behavior:
1. Create an HTTP (no ssl) listener on port 80 with CustomHttpProfile preset.
2. Create an GruntHTTP launcher (tested shellcode, binary, and PS). I have attempted both .Net 3.5 and .Net 4.0 grunts, same result.
3. Launch Grunt, ensure high integrity, ensure simple commands like "WhoAmI" work as expected.
4. Attempt to launch any mimikatz related tasks like "LogonPasswords", "Mimikatz token::elevate lsadump::sam" or "LsaSecrets" to verify that after a 30s-5min wait the task completes with the "Failed to find suitable decoy module." error.

**Expected behavior**
I expected credentials/secrets/sam stuff to be returned.

**Screenshots**
If applicable, add screenshots to help explain your problem.
![image](https://user-images.githubusercontent.com/81834305/113515667-e4dd7c00-9543-11eb-83d7-abd7ecd89be3.png)

**Covenant Server Information:**
- OS: Tested on both Linux and Windows 10 Pro 19042,
- Docker or Native: I've tested both.

**Browser Information:**
- Browser: Firefox 78 and Chrome 89

**Target Information (System that implant is running on):**
- OS: Windows 10 Pro 19042 and 17763

**Additional context**
The master branch has no issues with this. I suspect this issue stems from the modifications made to SharpSploit.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.