[Bug] Format Exception with custom template
- Dominant language
- C#
- Stars
- 4.7k
- Forks
- 822
- PR merge metrics
- No merged PRs in 30d
Description
**Feature Request or Bug**
Bug
**Describe the feature request or bug**
I created a custom listener profile and receive stack traces when using HTTP grunts (see screenshots).
Basically, there seems to be a string format issue in the HTTP handler:
~~~
fail: Microsoft.AspNetCore.Server.Kestrel[13]
Connection id "0HM7OU2GJC1EL", Request id "0HM7OU2GJC1EL:00000002": An unhandled exception was thrown by the application.
System.FormatException: Input string was not in a correct format.
at System.Text.StringBuilder.FormatError()
at System.Text.StringBuilder.AppendFormatHelper(IFormatProvider provider, String format, ParamsArray args)
at System.String.FormatHelper(IFormatProvider provider, String format, ParamsArray args)
at System.String.Format(String format, Object arg0, Object arg1)
at Covenant.Controllers.HttpListenerController.Route() in /opt/Covenant/Covenant/Controllers/ListenerControllers/HttpListenerController.cs:line 77
at lambda_method(Closure , Object )
at Microsoft.Extensions.Internal.ObjectMethodExecutorAwaitable.Awaiter.GetResult()
at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.AwaitableObjectResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|24_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|19_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
at Microsoft.AspNetCore.Routing.EndpointMiddleware.g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
~~~
This had no negative impact for the operation of the grunt, but the uncomfortable feeling remains...
**To Reproduce**
Steps to reproduce the behavior:
Honestly I have no clue what my template does differently than the builtin templates - it is just a slight modification of builtin templates (with an nginx default page instead of Hello World and different parameter names).
**Expected behavior**
No crashes / stack traces.
**Screenshots**

If applicable, add screenshots to help explain your problem.
**Covenant Server Information:**
- OS: Kali
- Docker or Native: native
- Note: I'm using the zeropoint security fork that is used for CRTO. Nevertheless, the bug also exists upstream.
**Browser Information:**
- Browser Edge Chromium
- Version 89
**Target Information (System that implant is running on):**
- OS: Windows 10
**Additional context**
The issue seems to be [here](https://github.com/cobbr/Covenant/blob/master/Covenant/Controllers/ListenerControllers/HttpListenerController.cs#L71) - the replacements performed in the main body of the function does an expansion `{` -> `{{` before replacing the values. This behavior was introduced in commit 15b1fad37f29affb75c4652566d0123c20d5afd9 but it seems it was overlooked in the exception handlers. I adapted the code in the exception handlers in my local build and the errors are gone.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.