gloxec/CrossC2

CS4.8是否支持?4.8生成后客户端链接显示解密失败

bycimi opened this issue · 2 comments

[-] Trapped javax.crypto.BadPaddingException during RSA decrypt [HTTP session handler]: Decryption error
javax.crypto.BadPaddingException: Decryption error
at sun.security.rsa.RSAPadding.unpadV15(RSAPadding.java:369)
at sun.security.rsa.RSAPadding.unpad(RSAPadding.java:282)
at com.sun.crypto.provider.RSACipher.doFinal(RSACipher.java:372)
at com.sun.crypto.provider.RSACipher.engineDoFinal(RSACipher.java:406)
at javax.crypto.Cipher.doFinal(Cipher.java:2205)
at dns.AsymmetricCrypto.decrypt(Unknown Source)
at beacon.BeaconC2.process_beacon_metadata(Unknown Source)
at beacon.BeaconHTTP$_A.serve(Unknown Source)
at c2profile.MalleableHook.serve(Unknown Source)
at cloudstrike.WebServer._serve(WebServer.java:308)
at cloudstrike.WebServer.serve(WebServer.java:246)
at cloudstrike.NanoHTTPD$HTTPSession.run(NanoHTTPD.java:372)
at java.lang.Thread.run(Thread.java:833)
at com.oracle.svm.core.thread.JavaThreads.threadStartRoutine(JavaThreads.java:597)
at com.oracle.svm.core.posix.thread.PosixJavaThreads.pthreadStartRoutine(PosixJavaThreads.java:194)
[-] decrypt of metadata failed
[-] A Malleable C2 attempt to recover data from a '.http-get.client.metadata' transaction failed. This could be due to a bug in the profile, a change made to the profile after this Beacon was run, or a change made to the transaction by some device between your target and your Cobalt Strike controller. The following information will (hopefully) help narrow down what happened.

按之前发行版本来看4.x都是支持的,但手边暂时没有4.8可进行具体测试,所以该问题不确定,需后期再进行验证

4.8测试没有发现问题,你引用了正确的.cobaltstrike.beacon_keys进行生成吗?