cobbr / cobbr/Covenant

[Bug][Question] Covenant Team Server Memory Consumption

Open
#323 2 comments 0 reactions 1 assignee Claimed by @cobbr View on GitHub
help wanted
Dominant language
C#
Stars
4.7k
Forks
822
PR merge metrics
No merged PRs in 30d

Description

When using Covenant normally on a Ubuntu Server, after some time of use memory use spikes gradually until the oom_killer kills the Covenant process.
I tried resizing the vm several times, from 4GB up to 16GB, but the problem persists and eventually covenant server crashes.
I don't know if the HW requirements are not meeted in my scenario or there is a bug.

dmesg
[2385505.072155] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/user.slice/user-0.slice/session-759.scope,task=Covenant,pid=210546,uid=0
[2385505.072259] Out of memory: Killed process 210546 (Covenant) total-vm:40059000kB, anon-rss:15893864kB, file-rss:0kB, shmem-rss:8kB, UID:0 pgtables:33284kB oom_score_adj:0
[2385505.384048] oom_reaper: reaped process 210546 (Covenant), now anon-rss:0kB, file-rss:0kB, shmem-rss:8kB

**Describe the feature request or bug**
When using Covenant normally on a Ubuntu Server, after some time of use memory use spikes gradually until the oom_killer kills the Covenant process.

**To Reproduce**
Steps to reproduce the behavior:
1. Start covenant via detached screen
screen -dmSL covenant sudo dotnet run -p /opt/Covenant/Covenant/Covenant.csproj
2. Connect grunts to covenant
In this case whe tested msbuild launcher
3. Execute normal commands in the grunts
4. Import powershell modules (like invoke-mimikatz.ps1, powerview.ps1, etc.)
5. Execute modules locally or via remoting in other hosts
5'. Or Execute commands in a grunt
6. The memory use spikes and Covenant proccess dies

**Expected behavior**
Covenant server should not crash

**Covenant Server Information:**
uname -a
5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

mpstat
Linux 5.4.0-72-generic (C2BE) 06/08/21 _x86_64_ (8 CPU)
14:27:20 CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle
14:27:20 all 0.69 0.00 0.21 0.08 0.00 0.01 0.00 0.00 0.00 99.01

This image is of covenant memory comsuption in idle status
![imagen](https://user-images.githubusercontent.com/26616620/121217411-3530cd00-c858-11eb-9317-4e706358fff6.png)

**Browser Information:**
- Browser Chrome
- Version Versión 91.0.4472.77 (Build oficial) (64 bits)

**Target Information (System that implant is running on):**
- OS: Windows 10
- Version Windows NT 10.0.19042.0

**Additional context**
Looks like the problem gets worse when importing more than one powershell module. Y some cases after a few days of operation suddenly the memory comsumption spikes at every command executed in any grunt.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.