fortra / fortra/No-Consolation
Can no longer run pre-compiled SysInternals PE
- Dominant language
- C
- Stars
- 703
- Forks
- 90
- PR merge metrics
- No merged PRs in 30d
Description
I'm currently unable to run sdelete64.exe from SysInternals with No-Consolation in Cobalt Strike 4.10. This worked in commits through f791d277aa843c15047d290c1ba00d2bdfcbb950 (September 14, 2024), however, now the beacon hangs/dies when attempting to run the same PE.
Screenshot showing using successful execution using the commit mentioned above and then execution when using the latest commit. The test file to be deleted was recreated before attempting execution with each commit.
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the hang by running sdelete64.exe from SysInternals through No-Consolation in Cobalt Strike 4.10, comparing the known-good commit f791d277aa843c15047d290c1ba00d2bdfcbb950 with the latest commit. Trace the regression between those revisions and confirm that the beacon completes execution without hanging or dying.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100