Octoberfest7/Inline-Execute-PE

seems like something didnt get freed in memory

Closed this issue · 8 comments

i have got this error Cannot update settings for a Beacon that is not alive or has not called back within 3x the set sleep time! after using psloggedon.exe , worked fine but i couldnt unload the PE with the error : "Cannot update settings for a Beacon that is not alive or has not called back within 3x the set sleep time!". Beacon is still running ok. somehting else , it blocked any usage of socks proxy of that specificied beacon , as if somehting blocked all accessibility to beacon, and beacon still running commands ok.
Weird behaviour.

Can you provide screenshots?

i'll do it as soon as possible. but i have got Cannot update settings for a Beacon that is not alive or has not called back within 3x the set sleep time. for sure

Did the error occur when using peconfig or peunload? Both of these commands contain logic along these lines with slightly differently worded messages:

peconfig: "Cannot update settings for a Beacon that is not alive or has not called back within 3x the set sleep time!"

peunload: "Cannot unload PE from a Beacon that is not alive or has not called back within 3x the set sleep time!"

Did you alter the sleep time of the beacon after loading the PE? Did you run petable clear at any point? Is/was the beacon still shown and listed in petable as green?

green in the table; i didint run petable clear, and the error occurs for peunload , because for me the logic after using the pe you can unload it when you want. sleep 0 was there from the beginning didint alter it.

Ah ok I would suspect sleep 0 is what is causing issues. I will test on my end and see if I can get a patch out.

thanks

New version has been pushed up and is available for download.

Added logic for peconfig and peunload to behave differently if the beacon is set to interactive; the "beacon is dead or hasn't called back in 3x sleep time" message will now display for interactive beacons if they have not called back in 15 seconds.

thanks i pull now