Skip to content

Commit d6b6001

Browse files
vinnybodvinnybod
authored
Merge pull request #776 from BC-SECURITY/release/6.0.2
v6.0.2 into main
2 parents 68fc935 + b367c5e commit d6b6001

File tree

6 files changed

+90
-128
lines changed

6 files changed

+90
-128
lines changed

‎.github/workflows/lint-and-test.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ jobs:
140140
# To save CI time, only run these tests when the install script or deps changed
141141
- name: Get changed files using defaults
142142
id: changed-files
143-
uses: tj-actions/[email protected].1
143+
uses: tj-actions/[email protected].3
144144
- name: Build images
145145
if: contains(steps.changed-files.outputs.modified_files, 'setup/install.sh')
146146
|| contains(steps.changed-files.outputs.modified_files, 'poetry.lock')

‎CHANGELOG.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1414

1515
## [Unreleased]
1616

17+
## [6.0.2] - 2025-04-07
18+
19+
- Fixed issue where C# modules on powershell agent would be improperly formatted
20+
- Fixed SharpWMI argument errors when using escaped quotes
21+
- Updated result parser on SharpWMI to not use StreamWriter due to messing up results
22+
1723
## [6.0.1] - 2025-04-03
1824

1925
### Fixed
@@ -1088,7 +1094,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
10881094
- Updated shellcoderdi to newest version (@Cx01N)
10891095
- Added a Nim launcher (@Hubbl3)
10901096

1091-
[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.0.1...HEAD
1097+
[Unreleased]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.0.2...HEAD
1098+
1099+
[6.0.2]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.0.1...v6.0.2
10921100

10931101
[6.0.1]: https://github.com/BC-SECURITY/Empire-Sponsors/compare/v6.0.0...v6.0.1
10941102

‎empire/server/common/empire.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
if TYPE_CHECKING:
3535
from socket import SocketIO
3636

37-
VERSION = "6.0.1 BC Security Fork"
37+
VERSION = "6.0.2 BC Security Fork"
3838

3939
log = logging.getLogger(__name__)
4040

‎empire/server/data/agent/agent.ps1

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1213,31 +1213,31 @@ function Invoke-Empire {
12131213

12141214
$scriptString = {
12151215
param($pipeServerStream, $ps, $task)
1216-
try
1217-
{
1218-
$outputCollector = [Text.StringBuilder]::new()
1219-
$streamReader = New-Object System.IO.StreamReader($pipeServerStream)
1220-
$readyMessage = $streamReader.ReadLine()
1221-
$buffer = [char[]]::new($pipeServerStream.InBufferSize)
1222-
1223-
if ($readyMessage -eq "ready") {
1224-
while ($read = $streamReader.Read($buffer, 0, $buffer.Length)) {
1225-
$outputChunk = (-join $buffer[0..($read - 1)])
1226-
1227-
[void]$outputCollector.AppendLine($outputChunk)
1216+
try {
1217+
$outputCollector = [Text.StringBuilder]::new()
1218+
$streamReader = New-Object System.IO.StreamReader($pipeServerStream)
1219+
$readyMessage = $streamReader.ReadLine()
1220+
$buffer = [char[]]::new($pipeServerStream.InBufferSize)
12281221

1229-
$output = $outputCollector.ToString().TrimEnd()
1230-
if (-not [string]::IsNullOrWhiteSpace($output)) {
1231-
$output
1232-
}
1233-
[void]$outputCollector.Clear()
1222+
if ($readyMessage -eq "ready") {
1223+
while ($read = $streamReader.Read($buffer, 0, $buffer.Length)) {
1224+
if ($read -gt 0) {
1225+
$outputChunk = -join $buffer[0..($read - 1)]
1226+
[void]$outputCollector.Append($outputChunk)
12341227
}
12351228
}
1229+
1230+
# Send full output after pipe closes
1231+
$output = $outputCollector.ToString().TrimEnd()
1232+
if (-not [string]::IsNullOrWhiteSpace($output)) {
1233+
$output
1234+
}
12361235
}
1237-
finally {
1238-
$ps.EndInvoke($task)
1239-
$script:tasks[$ResultID]['status'] = 'completed';
1240-
}
1236+
}
1237+
finally {
1238+
$ps.EndInvoke($task)
1239+
$script:tasks[$ResultID]['status'] = 'completed';
1240+
}
12411241
}
12421242

12431243
$AppDomain = [AppDomain]::CreateDomain($ResultID);

‎empire/server/modules/csharp/situational_awareness/SharpWMI.yaml

Lines changed: 57 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -44,111 +44,65 @@ csharp:
4444
{
4545
private static byte originalByte;
4646
47-
public static Stream OutputStream { get; set; }
48-
4947
public static void Main(string[] args)
5048
{
51-
using (StringWriter stringWriter = new StringWriter())
52-
{
53-
TextWriter originalOutput = Console.Out;
54-
TextWriter originalError = Console.Error;
55-
56-
StreamWriter outputStreamWriter = null;
57-
if (OutputStream != null)
58-
{
59-
outputStreamWriter = new StreamWriter(OutputStream);
60-
outputStreamWriter.AutoFlush = true;
61-
}
62-
63-
PatchEnvironmentExit();
64-
65-
try
66-
{
67-
MultiTextWriter multiWriter = new MultiTextWriter(stringWriter, outputStreamWriter);
68-
Console.SetOut(multiWriter);
69-
Console.SetError(multiWriter);
70-
71-
string allArgs = string.Join(" ", args);
72-
string[] splitArgs = Regex.Matches(allArgs, @"[^\s""=]+=""[^""]*""|[^\s""=]+=[^\s]+")
73-
.Cast<Match>()
74-
.Select(m => m.Value.Replace("= ", "=")) // Fix any accidental spaces after `=`
75-
.ToArray();
76-
77-
for (int i = 0; i < splitArgs.Length; i++)
78-
{
79-
if (splitArgs[i].StartsWith("query="))
80-
{
81-
splitArgs[i] = splitArgs[i].Replace("\"", "");
82-
}
83-
}
84-
85-
foreach (string arg in splitArgs)
86-
{
87-
Console.WriteLine($"[>] Argument: {arg}");
88-
}
89-
90-
typeof(SharpWMI.Program).GetMethod("Main", BindingFlags.NonPublic | BindingFlags.Static)
91-
.Invoke(null, new object[] { splitArgs });
92-
}
93-
catch (Exception ex)
94-
{
95-
stringWriter.WriteLine($"Error: {ex.Message}");
96-
if (ex.InnerException != null)
97-
{
98-
stringWriter.WriteLine($"Inner Exception: {ex.InnerException.GetType().FullName}: {ex.InnerException.Message}");
99-
}
100-
}
101-
finally
102-
{
103-
Console.SetOut(originalOutput);
104-
Console.SetError(originalError);
105-
106-
if (outputStreamWriter != null)
107-
{
108-
outputStreamWriter.Flush();
109-
outputStreamWriter.Close();
110-
}
111-
Console.WriteLine(stringWriter.ToString());
112-
}
113-
}
114-
}
115-
116-
private class MultiTextWriter : TextWriter
117-
{
118-
private readonly TextWriter _writer1;
119-
private readonly TextWriter _writer2;
120-
121-
public MultiTextWriter(TextWriter writer1, TextWriter writer2)
122-
{
123-
_writer1 = writer1;
124-
_writer2 = writer2;
125-
}
126-
127-
public override Encoding Encoding
128-
{
129-
get
130-
{
131-
return _writer1?.Encoding ?? Encoding.UTF8;
132-
}
133-
}
134-
135-
public override void Write(char value)
136-
{
137-
_writer1?.Write(value);
138-
_writer2?.Write(value);
139-
}
140-
141-
public override void Write(string value)
142-
{
143-
_writer1?.Write(value);
144-
_writer2?.Write(value);
145-
}
146-
147-
public override void Flush()
148-
{
149-
_writer1?.Flush();
150-
_writer2?.Flush();
151-
}
49+
PatchEnvironmentExit();
50+
51+
try
52+
{
53+
Console.WriteLine("\n[DEBUG] Original args (before normalization):");
54+
for (int i = 0; i < args.Length; i++)
55+
{
56+
Console.WriteLine($" args[{i}]: '{args[i]}'");
57+
}
58+
59+
// Normalize double-double quotes ("") to single quotes (")
60+
string normalizedArgs = args[0].Replace("\"\"", "\"");
61+
62+
Console.WriteLine("\n[DEBUG] Normalized args:");
63+
Console.WriteLine($" '{normalizedArgs}'");
64+
65+
// Now properly split arguments
66+
string[] manuallySplitArgs = Regex.Matches(normalizedArgs, @"[^\s=]+=""[^""]*""|[^\s=]+=[^\s""]+")
67+
.Cast<Match>()
68+
.Select(m => m.Value)
69+
.ToArray();
70+
71+
Console.WriteLine("\n[DEBUG] Manually split args:");
72+
for (int i = 0; i < manuallySplitArgs.Length; i++)
73+
{
74+
Console.WriteLine($" manuallySplitArgs[{i}]: '{manuallySplitArgs[i]}'");
75+
}
76+
77+
// Parse key-value pairs explicitly
78+
var parsedArgs = manuallySplitArgs.Select(arg =>
79+
{
80+
int idx = arg.IndexOf('=');
81+
if (idx > -1)
82+
{
83+
string key = arg.Substring(0, idx);
84+
string val = arg.Substring(idx + 1).Trim('"');
85+
return $"{key}={val}";
86+
}
87+
return arg;
88+
}).ToArray();
89+
90+
Console.WriteLine("\n[DEBUG] Parsed Arguments:");
91+
foreach (string arg in parsedArgs)
92+
{
93+
Console.WriteLine($"[>] Argument: {arg}");
94+
}
95+
96+
// Finally invoke SharpWMI
97+
typeof(SharpWMI.Program)
98+
.GetMethod("Main", BindingFlags.NonPublic | BindingFlags.Static)
99+
.Invoke(null, new object[] { parsedArgs });
100+
101+
}
102+
catch (Exception ex)
103+
{
104+
Console.WriteLine($"Error: {ex.Message}");
105+
}
152106
}
153107
154108
private static void PatchEnvironmentExit()

‎pyproject.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[tool.poetry]
22
name = "empire-bc-security-fork"
3-
version = "6.0.1"
3+
version = "6.0.2"
44
description = ""
55
authors = ["BC Security <[email protected]>"]
66
readme = "README.md"

0 commit comments

Comments
 (0)