Missing some go modules apparently about scarecrow HOT 7 CLOSED

Can you please provide me the full terminal output, in order to see what's going on?

from scarecrow.

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain testing

/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”

[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open lync/lync.go: no such file or directory

goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc000186e90, 0xc, 0xc0001b6000, 0x1d69)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc0000d3200, 0x86c, 0xc0000be090, 0x2c, 0xc0000c4100, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain testing

/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”

[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open lync/lync.go: no such file or directory

goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc000186bd0, 0xc, 0xc0001ae000, 0x1d43)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc000125200, 0x86c, 0xc000016180, 0x2c, 0xc00001a3e0, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain testing

/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”

[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open OneDrive/OneDrive.go: no such file or directory

goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc00001b460, 0x14, 0xc0000d6000, 0x1d16)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc000125200, 0x86c, 0xc000016180, 0x2c, 0xc00001a3e0, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain testing

/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”

[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open Outlook/Outlook.go: no such file or directory

goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc0000bd600, 0x12, 0xc00015c000, 0x1d03)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc0000cf200, 0x86c, 0xc0000b6090, 0x2c, 0xc0000bc100, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7

from scarecrow.

It looks like your using a domain that doesn't exist or is not Internet-accessible but it's hard to confirm without knowing the domain name. The limelight lib pulls the attributes from SSL certs. Please see #1 for further details. If this is the case I will work tonight to create some error handling messages to address this.

from scarecrow.

Here I tried using google.com in multiple forms. (bold to differentiate.)

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain google.com

/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”

[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open Outlook/Outlook.go: no such file or directory

goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc0000bd600, 0x12, 0xc000168000, 0x1d43)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc0000cf200, 0x86c, 0xc0000b6090, 0x2c, 0xc0000bc100, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain www.google.com

/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”

[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open Word/Word.go: no such file or directory

goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc000192630, 0xc, 0xc0001aa000, 0x1d34)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc000125200, 0x86c, 0xc000016180, 0x2c, 0xc00001a3e0, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain mail.google.com

/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”

[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open Powerpnt/Powerpnt.go: no such file or directory

goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc00001b1c0, 0x14, 0xc00019c000, 0x1cf4)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc000125200, 0x86c, 0xc000016180, 0x2c, 0xc00001a3e0, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow] < This check is to prove internet access.
└─$ ping google.com
PING google.com (172.217.3.110) 56(84) bytes of data.
64 bytes from lga34s18-in-f14.1e100.net (172.217.3.110): icmp_seq=1 ttl=115 time=21.0 ms
64 bytes from lga34s18-in-f14.1e100.net (172.217.3.110): icmp_seq=2 ttl=115 time=15.4 ms
64 bytes from lga34s18-in-f14.1e100.net (172.217.3.110): icmp_seq=3 ttl=115 time=11.7 ms
64 bytes from lga34s18-in-f14.1e100.net (172.217.3.110): icmp_seq=4 ttl=115 time=12.4 ms
^C
--- google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 11.656/15.124/21.048/3.697 ms

from scarecrow.

ahh so looks like its an issue around the WriteFile and Check (Utils.go +19 and Utils.go +27) when it's writing the go file to disk. I am wondering if it's a permission issue.

from scarecrow.

facepalm GDI. We can close this.

┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ sudo ./ScareCrow -I ~/Desktop/met64.raw -domain google.com
[sudo] password for user:

/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”

[] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
[] Creating an Embedded Resource File
[+] Created Embedded Resource File With lync's Properties
[] Compiling Payload
[+] Payload Compiled
[] Signing lync.exe With a Fake Cert
[+] Signed File Created
[+] Binary Compiled

Any chance it can SUID or ask for elevated just in case?

from scarecrow.

No problem, I'll look into adding something like that :)

from scarecrow.