Skip to content

Agent Response Processing Blocked by Bad Response #492

@DannyBoyk

Description

@DannyBoyk

The logic in mythic_server's handling of agent responses needs to deserialize multiple responses independently.

The current version of Medusa has a bug in the ps command when running on Linux that returns PIDs as strings instead of ints. This causes the response to not deserialize correctly in the Mythic server code and all responses are thrown away, even if some of them were good. This is bad because agents will typically resend responses until acknowledged and this one bad response will prevent any future responses from being handled.

I have a PR incoming where the logic was updated to parse and handle responses independently so that: they can all be acknowledge back to the agent even if an error occurs with some of the responses; successful responses are handled correctly; the status of any command is updated to error if the response cannot be parsed so the operator gets that feedback.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions