No callbacks to Mythic.

[timukas]

Hi,

Building Kharon with default settings, but unable to connect to Mythic.

Debug mode shows Host: 172.25.31.176, but my http profile has different callback IP/port.

[DEBUG::Source/Main.cc::Init::340] => ======== Transport Informations ========
[DEBUG::Source/Main.cc::Init::341] => profile c2: 25
[DEBUG::Source/Main.cc::Init::343] => Host: 172.25.31.176
[DEBUG::Source/Main.cc::Init::344] => Port: 443
[DEBUG::Source/Main.cc::Init::345] => Endpoint: /data
[DEBUG::Source/Main.cc::Init::346] => User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
[DEBUG::Source/Main.cc::Init::347] => Headers:
[DEBUG::Source/Main.cc::Init::348] => Secure: FALSE
[DEBUG::Source/Main.cc::Init::349] => Proxy Enabled: FALSE
[DEBUG::Source/Main.cc::Init::350] => Proxy URL:
[DEBUG::Source/Main.cc::Init::356] => Collected informations and setup agent
[DEBUG::Source/Main.cc::Start::364] => Initializing the principal routine
[DEBUG::Source/Communication/Transport.cc::Checkin::9] => start checkin routine
[DEBUG::Source/Internals/Memory.cc::Alloc::56] => execute without syscall and spoof

Makefile has this IP on line 56:

DEFS := \
        -D WEB_HOST='L"172.25.31.176"' \
        -D WEB_PORT=443                            \
        -D WEB_ENDPOINT='L"/data"'     \
        -D WEB_SECURE_ENABLED=0

Any hints/ideas?

[arrxnov]

Did you disable the aes_256_hmac encryption on the HTTP profile?

[timukas]

Yes. AESPSK set to none and encrypted_exchange_check enabled.
I have separate http profile for Kharon.

I worked some time ago, but now all generated payloads connect to 172.25.31.176:443

[arrxnov]

OK... It looks like some testing stuff got committed. The correct DEFS are still present but commented. You should be able to just uncomment them and comment the testing DEFS. It's directly above in the Makefile. Not ideal obviously but an easy fix for now.

[timukas]

With mods now i've got a callback.