apollo execute_coff

[hagbartx]

Mythic Version:
Mythic: v3.4.21
UI: v0.3.93

Apollo:
Version: 2.4.8

Target:
Windows 10 latest

Executing bofs fail because VCRUNTIME140.dll couldn't be loaded. Apollo Debug:

Exception: Failed to load imported DLL: VCRUNTIME140.dll Exception Location: at Tasks.execute_coff.MemoryModule.ProcessImports() at Tasks.execute_coff.MemoryModule..ctor(Byte[] dllBytes) at Tasks.execute_coff.LoadDLL(Byte[] dllBytes)

Mythic Task:

[*] Registering cacls.x64.o with Mythic... [*] Passing execution to apollo's "execute_coff" command for further processing... Failed to load COFFLoader.dll reflectively.

[hagbartx]

Need to test this first:

#166

[hagbartx]

I rebuild apollo via

sudo ./mythic-cli config set apollo_use_build_context true
sudo ./mythic-cli build apollo

from build log

#14 [10/10] RUN cd apollo/agent_code && cp COFFLoader.dll /COFFLoader.dll
#14 DONE 0.3s

I still have apollo version 2.4.8 which should have the #166 patch but I still get:

Exception: Failed to load imported DLL: VCRUNTIME140.dll
Exception Location:    at Tasks.execute_coff.MemoryModule.ProcessImports()
   at Tasks.execute_coff.MemoryModule..ctor(Byte[] dllBytes)
   at Tasks.execute_coff.LoadDLL(Byte[] dllBytes)

[*] Passing execution to apollo's "execute_coff" command for further processing...
Failed to load COFFLoader.dll reflectively.

Any hints?

[its-a-feature]

Apollo v2.4.8 is the latest version which should have that patch already. Apollo will first use the CoffLoader.dll that's been uploaded previously if it exists though, so if you did update from a previous version, I'd suggest going to the file search page, searching through your uploads for the CoffLoader.dll and deleting it, then trying to run a coff command again. Apollo will see that Mythic isn't tracking it anymore, will upload its latest version, and then that one will get used

[hagbartx]

@its-a-feature

deleted all the coffloader.dlls, generated new apollo payload. Still the same error. I can see that there is a new coffloader uploaded, but still.

[its-a-feature]

I'm having trouble replicating, but it seems like maybe it was compiled in debug mode vs release mode, so i just made a fresh compilation in release and updated apollo. Can you:

• install the latest apollo (you should see the version increment from what you currently have)
• delete the coffloader from your uploaded files
• run a new coff command (which should upload the new coffloader)

[hagbartx]

@its-a-feature

I'm having trouble replicating

ok, that's strange. I rebuild the entiere lab. Setting up new mythic server and new windows 10/11 boxes. I have apollo Version: 2.4.9. but I still getting the same error.

I build the dll by myself via

x86_64-w64-mingw32-gcc -shared -o COFFLoader.dll COFFLoader.c beacon_compatibility.c -D_CRT_SECURE_NO_WARNINGS -DNDEBUG -D_CONSOLE -O2 -s

and uploaded the dll to mythic. Now it's working.