Comments (7)
Can you please provide me the full terminal output, in order to see what's going on?
from scarecrow.
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain testing
/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”
[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open lync/lync.go: no such file or directory
goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc000186e90, 0xc, 0xc0001b6000, 0x1d69)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc0000d3200, 0x86c, 0xc0000be090, 0x2c, 0xc0000c4100, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain testing
/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”
[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open lync/lync.go: no such file or directory
goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc000186bd0, 0xc, 0xc0001ae000, 0x1d43)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc000125200, 0x86c, 0xc000016180, 0x2c, 0xc00001a3e0, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain testing
/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”
[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open OneDrive/OneDrive.go: no such file or directory
goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc00001b460, 0x14, 0xc0000d6000, 0x1d16)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc000125200, 0x86c, 0xc000016180, 0x2c, 0xc00001a3e0, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain testing
/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”
[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open Outlook/Outlook.go: no such file or directory
goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc0000bd600, 0x12, 0xc00015c000, 0x1d03)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc0000cf200, 0x86c, 0xc0000b6090, 0x2c, 0xc0000bc100, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7
from scarecrow.
It looks like your using a domain that doesn't exist or is not Internet-accessible but it's hard to confirm without knowing the domain name. The limelight lib pulls the attributes from SSL certs. Please see #1 for further details. If this is the case I will work tonight to create some error handling messages to address this.
from scarecrow.
Here I tried using google.com in multiple forms. (bold to differentiate.)
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain google.com
/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”
[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open Outlook/Outlook.go: no such file or directory
goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc0000bd600, 0x12, 0xc000168000, 0x1d43)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc0000cf200, 0x86c, 0xc0000b6090, 0x2c, 0xc0000bc100, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain www.google.com
/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”
[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open Word/Word.go: no such file or directory
goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc000192630, 0xc, 0xc0001aa000, 0x1d34)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc000125200, 0x86c, 0xc000016180, 0x2c, 0xc00001a3e0, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ ./ScareCrow -I ~/Desktop/met64.raw -domain mail.google.com
/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”
[*] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
panic: open Powerpnt/Powerpnt.go: no such file or directory
goroutine 1 [running]:
ScareCrow/Utils.check(...)
/opt/ScareCrow/Utils/Utils.go:27
ScareCrow/Utils.Writefile(0xc00001b1c0, 0x14, 0xc00019c000, 0x1cf4)
/opt/ScareCrow/Utils/Utils.go:19 +0x145
ScareCrow/Loader.CompileFile(0xc000125200, 0x86c, 0xc000016180, 0x2c, 0xc00001a3e0, 0x18, 0x773d48, 0x6, 0x0, 0x0, ...)
/opt/ScareCrow/Loader/Loader.go:653 +0x1f7
main.main()
/opt/ScareCrow/ScareCrow.go:161 +0x8b7
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow] < This check is to prove internet access.
└─$ ping google.com
PING google.com (172.217.3.110) 56(84) bytes of data.
64 bytes from lga34s18-in-f14.1e100.net (172.217.3.110): icmp_seq=1 ttl=115 time=21.0 ms
64 bytes from lga34s18-in-f14.1e100.net (172.217.3.110): icmp_seq=2 ttl=115 time=15.4 ms
64 bytes from lga34s18-in-f14.1e100.net (172.217.3.110): icmp_seq=3 ttl=115 time=11.7 ms
64 bytes from lga34s18-in-f14.1e100.net (172.217.3.110): icmp_seq=4 ttl=115 time=12.4 ms
^C
--- google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 11.656/15.124/21.048/3.697 ms
from scarecrow.
ahh so looks like its an issue around the WriteFile and Check (Utils.go +19 and Utils.go +27) when it's writing the go file to disk. I am wondering if it's a permission issue.
from scarecrow.
facepalm GDI. We can close this.
┌──(user㉿DESKTOP-O0R9DEO)-[/opt/ScareCrow]
└─$ sudo ./ScareCrow -I ~/Desktop/met64.raw -domain google.com
[sudo] password for user:
/ / ____ _____ _______ ____ _ ___ __ ______ _ __
_____ _/ \ \ __ _/ __ / \ /_ __ / _ \ / / /
/ \ ___ / __ | | /\ /\ _| | ( <> ) /
/______ /___ >____ /| _ >______ /|| __/ /_/
/ / / / /
(@Tyl0us)
“Fear, you must understand is more than a mere obstacle.
Fear is a TEACHER. the first one you ever had.”
[] Encrypting Shellcode Using AES Encryption
[+] Shellcode Encrypted
[] Creating an Embedded Resource File
[+] Created Embedded Resource File With lync's Properties
[] Compiling Payload
[+] Payload Compiled
[] Signing lync.exe With a Fake Cert
[+] Signed File Created
[+] Binary Compiled
Any chance it can SUID or ask for elevated just in case?
from scarecrow.
No problem, I'll look into adding something like that :)
from scarecrow.
Related Issues (20)
- Windows 10 bug HOT 3
- Windows defender new sandbox HOT 3
- Newest version v4.1 not working with msfvenom payload HOT 7
- Binary loader build HOT 5
- New Feature Request - ProxyAware
- '.exp' files are not the compiled Go files HOT 3
- panic: Call to VirtualProtect failed!!!!! HOT 4
- Delivery HTA with Loaders Control or Wscript not working HOT 12
- cmd.Run() failed with exit status 0xffffffff HOT 5
- Output to the user is incorrect when using the -O <file> option HOT 1
- runtime.cgocall() Issue HOT 2
- Is this project still working? experiencing issues loading several shellcodes HOT 11
- Output Types HOT 2
- Windows executables not in PATH HOT 8
- ProcessInjection crashes HOT 5
- Doc, docx, rtf HOT 1
- cmd.Run() failed with exit status 0xc0000135 HOT 4
- Still having issues with cmd.Run() failed with exit status 255 HOT 1
- Add Go Lib Requirement
- Errors running ScareCrow. Exit status 128 and exit status 255 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from scarecrow.