Agent stuck after socks proxy

[JBalanza]

What happened?

Hi Team,

I was using Havoc and everything was going fine before I decided to create a socks proxy to enumerate the domain using Bloodhound.py. I did it before on testing environments and everything worked fine.

This time, while the socks proxy was up and running, I decided to change a couple of times the sleep of the demon. After that, I'm not able to contact the demon anymore with any command. Restarted the team server, and even removed client.db and teamserver.db in a desperate way to recover something (the logs showed below, are much before removing the files). But the demon is constantly posting back the backend without being able to recover or kill it.

Find below the logs that I find are more representative to find the problem.

From there, the logs constantly repeats the last 3 lines.

Any insight about to recover the agent, killing it, or preventing this to happen again?

Thanks in advance.

Did You Try With the Dev Branch?

I'm using Dev branch from June 24th.

Relevant log output

Nov 25 11:07:38 <redacted> sudo[387116]: [11:07:38] [DBUG] [agent.(*Agent).TaskDispatch:2661]: Agent: 207b49c8, Command: COMMAND_SLEEP, SleepDelay: 1, SleepJitter: 0
Nov 25 11:09:07 <redacted> sudo[387116]: [11:09:07] [DBUG] [agent.(*Agent).TaskDispatch:2661]: Agent: 207b49c8, Command: COMMAND_SLEEP, SleepDelay: 10, SleepJitter: 0
Nov 25 11:12:47 <redacted> sudo[387116]: [11:12:47] [DBUG] [agent.(*Agent).TaskDispatch:2661]: Agent: 207b49c8, Command: COMMAND_SLEEP, SleepDelay: 1, SleepJitter: 0
Nov 25 11:13:41 <redacted> sudo[387116]: [11:13:41] [DBUG] [agent.(*Agent).TaskDispatch:2661]: Agent: 207b49c8, Command: COMMAND_SLEEP, SleepDelay: 0, SleepJitter: 0
Nov 25 11:14:07 <redacted> sudo[387116]: [11:14:07] [DBUG] [agent.(*Agent).TaskDispatch:6018]: Agent: 207b49c8, Command: COMMAND_SOCKET - SOCKET_COMMAND_CONNECT, Id: e25c50e1, Type: 2, Success: 0, ErrorCode: 10060
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [handlers.handleDemonAgent:84]: Agent: 207b49c8, Command: DEMON_INIT
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [packer.(*Packer).Build:87]: No Aes Key specified
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [handlers.handleDemonAgent:95]: reconnected 2d5b834f
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [handlers.handleDemonAgent:84]: Agent: 207b49c8, Command: DEMON_INIT
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [packer.(*Packer).Build:87]: No Aes Key specified
Nov 25 11:14:18 <redacted> sudo[387116]: [11:14:18] [DBUG] [handlers.handleDemonAgent:95]: reconnected 2d5b834f

Did You Read Over Your Issue First?

• I declare I made an effort and provided the necessary information for replication of the issue.