UnicodeDecodeError when calling aggressor.artifact_payload #8
Description
Hello,
I have this small script that should create x64 executable called beacon.exe, when create-executable alias is called:
import pycobalt.engine as engine
import pycobalt.events as events
import pycobalt.aliases as aliases
import pycobalt.helpers as helpers
import pycobalt.commands as commands
import pycobalt.aggressor as aggressor
import pycobalt.callbacks as callbacks
import pycobalt.console as console
@aliases.alias("create-executable", "Creates executable")
def _(bid, listener):
executable = aggressor.artifact_payload(listener, "exe", "x64")
local_path = "/tmp/beacon.exe"
f = open(local_path, "wb")
f.write(executable)
f.close()
engine.loop()When I call this alias in beacon console, I get this error in Script Console:
[pycobalt] Executing script /tmp/beacon.py
[pycobalt beacon.py error] Traceback (most recent call last):
[pycobalt beacon.py error] File "/tmp/beacon.py", line 18, in <module>
[pycobalt beacon.py error] engine.loop()
[pycobalt beacon.py error] File "/usr/local/lib/python3.9/dist-packages/pycobalt-1.2.0-py3.9.egg/pycobalt/engine.py", line 216, in loop
[pycobalt beacon.py error] for name, message in read_pipe_iter():
[pycobalt beacon.py error] File "/usr/local/lib/python3.9/dist-packages/pycobalt-1.2.0-py3.9.egg/pycobalt/engine.py", line 200, in read_pipe_iter
[pycobalt beacon.py error] for line in _in_pipe:
[pycobalt beacon.py error] File "/usr/lib/python3.9/codecs.py", line 322, in decode
[pycobalt beacon.py error] (result, consumed) = self._buffer_decode(data, self.errors, final)
[pycobalt beacon.py error] UnicodeDecodeError: 'utf-8' codec can't decode byte 0xc0 in position 1: invalid start byte
[pycobalt] Script process exited: /tmp/beacon.py
I think it has something to do with aggressor.artifact_payload, since this same issue also arises when calling aggressor.artifact_stager.
So far I have been able to fix this error by adding sys.stdin.reconfigure(encoding="latin-1") to pycobalt/engine.py after imports and changing line 12 from my script to executable = bytes(aggressor.artifact_payload(listener, "exe", "x64"), "latin-1").
I wonder if this a proper way to fix this error or may the change to engine.py break something else?
Related version information:
- Cobalt Strike version: 4.3.0
- Pycobalt version: 1.2.0