cobbr / cobbr/Covenant

[Bug] Seatbelt via SMBGrunt

Open
#318 2 comments 0 reactions 1 assignee Claimed by @cobbr View on GitHub
Dominant language
C#
Stars
4.7k
Forks
822
PR merge metrics
No merged PRs in 30d

Description

**Feature Request or Bug**
Bug

**Describe the feature request or bug**
Executing any Seatbelt command via SMBgrunt results in no output and the loss of the SMBgrunt.

**To Reproduce**
1. Clone dev branch
2. Setup listener (used CustomHttpProfile)
3. Generate binary HTTPgrunt (Net40) and execute on client, context of admin user, medium integrity. (Seatbelt works here)
4. Generate binary SMBgrunt (Net40) and execute on client, context of admin user, either medium or high integrity.
5. Connect to SMBgrunt via HTTPgrunt using 'connect localhost
6. Execute any Seatbelt command, no result, no error on client or Covenant debug console messages. SMBgrunt process still appears to be running on client but grunt is lost.

**Expected behavior**
Seatbelt commands work when using SMBgrunt.

**Covenant Server Information:**
- OS: Kali 5.10.0 up to date
- dotnet --version 5.0.203
- Native

**Browser Information:**
- Edge
- 90.0.8118.66

**Target Information (System that implant is running on):**
- Windows 10 Professional
- 10.0.19042.631

**Additional context**
Defender has been disabled on the client PC where the implants are running.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.