UnicodeDecodeError when calling aggressor.artifact_payload #8
Description
Hello,
I have this small script that should create x64 executable called beacon.exe, when create-executable alias is called:
import pycobalt.engine as engine import pycobalt.events as events import pycobalt.aliases as aliases import pycobalt.helpers as helpers import pycobalt.commands as commands import pycobalt.aggressor as aggressor import pycobalt.callbacks as callbacks import pycobalt.console as console @aliases.alias("create-executable", "Creates executable") def _(bid, listener): executable = aggressor.artifact_payload(listener, "exe", "x64") local_path = "/tmp/beacon.exe" f = open(local_path, "wb") f.write(executable) f.close() engine.loop()When I call this alias in beacon console, I get this error in Script Console:
[pycobalt] Executing script /tmp/beacon.py [pycobalt beacon.py error] Traceback (most recent call last): [pycobalt beacon.py error] File "/tmp/beacon.py", line 18, in <module> [pycobalt beacon.py error] engine.loop() [pycobalt beacon.py error] File "/usr/local/lib/python3.9/dist-packages/pycobalt-1.2.0-py3.9.egg/pycobalt/engine.py", line 216, in loop [pycobalt beacon.py error] for name, message in read_pipe_iter(): [pycobalt beacon.py error] File "/usr/local/lib/python3.9/dist-packages/pycobalt-1.2.0-py3.9.egg/pycobalt/engine.py", line 200, in read_pipe_iter [pycobalt beacon.py error] for line in _in_pipe: [pycobalt beacon.py error] File "/usr/lib/python3.9/codecs.py", line 322, in decode [pycobalt beacon.py error] (result, consumed) = self._buffer_decode(data, self.errors, final) [pycobalt beacon.py error] UnicodeDecodeError: 'utf-8' codec can't decode byte 0xc0 in position 1: invalid start byte [pycobalt] Script process exited: /tmp/beacon.py I think it has something to do with aggressor.artifact_payload, since this same issue also arises when calling aggressor.artifact_stager.
So far I have been able to fix this error by adding sys.stdin.reconfigure(encoding="latin-1") to pycobalt/engine.py after imports and changing line 12 from my script to executable = bytes(aggressor.artifact_payload(listener, "exe", "x64"), "latin-1").
I wonder if this a proper way to fix this error or may the change to engine.py break something else?
Related version information:
- Cobalt Strike version: 4.3.0
- Pycobalt version: 1.2.0