| Description | Basic http listener is broken when windows/launcher_bat stager connects. The agent is unable to be created. The error is "unable to open the database file". Traceback is this:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/flask/app.py", line 2447, in wsgi_app
response = self.full_dispatch_request()
File "/usr/lib/python3/dist-packages/flask/app.py", line 1952, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/usr/lib/python3/dist-packages/flask/app.py", line 1821, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/usr/lib/python3/dist-packages/flask/_compat.py", line 39, in reraise
raise value
File "/usr/lib/python3/dist-packages/flask/app.py", line 1950, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/lib/python3/dist-packages/flask/app.py", line 1936, in dispatch_request
return self.view_functionsrule.endpoint
File "/usr/share/powershell-empire//lib/listeners/http.py", line 1086, in handle_get
stage = self.generate_stager(language=language, listenerOptions=listenerOptions,
File "/usr/share/powershell-empire//lib/listeners/http.py", line 581, in generate_stager
stager = helpers.keyword_obfuscation(stager)
File "/usr/share/powershell-empire/lib/common/helpers.py", line 274, in keyword_obfuscation
conn = sqlite3.connect('./data/empire.db', check_same_thread=False)
sqlite3.OperationalError: unable to open database file |
|---|
| Steps To Reproduce |
- In a brand new Kali 2020.2a VMware image downloaded fresh from the OffSec website, run "apt update" and "apt install powershell-empire"
- Run powershell empire as the kali user and use the workaround for first-time run mentioned in this bug report (still not fixed): https://bugs.kali.org/view.php?id=6449
- "listeners", "uselistener http", set the Host and Port, and "execute"
- "back", "usestager windows/launch_bat", set the Listener to http, and "execute"
- transfer the stager to the target and run it
- Observe the error noted above in powershell-empire
|
|---|
| Additional Information | This can be fixed by modifying line 274 in /usr/share/powershell-empire/lib/common/helpers.py like this:
############
#conn = sqlite3.connect('./data/empire.db', check_same_thread=False)
conn = sqlite3.connect(os.path.expanduser("~/.local/powershell-empire/empire.db"), check_same_thread=False)
############
so that it matches up with lines 26-40 in /usr/share/powershell-empire/empire and also similar to how it was handled on line 322 of /usr/share/powershell-empire/lib/commonempire.py:
############
self.conn = sqlite3.connect(os.path.expanduser('~/.local/powershell-empire/empire.db'),
############ |
|---|
