New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Suggestion:Implement a way to return the output and prevent termination of parent #4

Open

Zer0-Tolerance opened this issue Aug 26, 2018 · 1 comment

Zer0-Tolerance commented Aug 26, 2018

When executed in memory using .Net reflection using a similar technique
as this : https://jimshaver.net/2018/07/25/safetykatz-over-net/#more-661 I encountered the following issue:

I can't seem to find a way to get the output from the calling program (btw it's the same issue for other GhostPack tools).
Once Safetykatz has finished its execution it also terminates the parent process (probably due to the usage of the PELoading technique)

Does it make sense ? Any idea ?

aconite33 commented Apr 25, 2019

I've encountered this issue as well. If you're following https://p16.praetorian.com/blog/running-a-.net-assembly-in-memory-with-meterpreter write up, and you try to execute from Meterpreter, it ends up killing your metasploit process. Not sure if there is a safe way around loading .NET without touching disk.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment