Update agent response handling to deserialize multiple responses independently #493
Conversation
…pendently The current version of Medusa has a bug in the ps command when running on Linux that returns PIDs as strings instead of ints. This causes its response to not deserialize correctly in the Mythic server code and all responses would be thrown away, even if some of them were good. This is bad because agents will typically resend responses until acknowledged and this one bad response will prevent any future responses from being handled. The logic was updated to parse and handle responses independently so that: they can all be acknowledge back to the agent even if an error occurs with some of the responses; successful responses are handled correctly; the status of any command is updated to error if the response cannot be parsed so the operator gets that feedback. Fixes its-a-feature#492
|
This is a great idea! I see you're doing stuff like marshalling multiple times (since you're processing each response individually). I'll have to look into what kind of performance hit that might have with larger responses or messages from agents that have a lot of entries in the responses array. Marshalling/Unmarshalling tends to be an expensive task |
|
Yeah, I didn't really see any way around having to process each individual response one-at-a-time to solve this issue. Since it's not trying to process the internal messages on the first go-around, I was hoping it was fast enough. As it is now, if you have one bad response (does not deserialize due to type mismatch), all the response handling gets hosed. I don't know about other agents, but Medusa never recovers as it never receives a response back to clear pending responses. |
2 participants
The current version of Medusa has a bug in the ps command when running on Linux that returns PIDs as strings instead of ints. This causes its response to not deserialize correctly in the Mythic server code and all responses would be thrown away, even if some of them were good. This is bad because agents will typically resend responses until acknowledged and this one bad response will prevent any future responses from being handled.
The logic was updated to parse and handle responses independently so that: they can all be acknowledge back to the agent even if an error occurs with some of the responses; successful responses are handled correctly; the status of any command is updated to error if the response cannot be parsed so the operator gets that feedback.
Fixes #492