Error 500 in Grunt Interaction about covenant

[cobbr]

@stlorenz What kind of Tasks did you run on the Grunt?

[cobbr]

Thanks everyone for the heads up. I have fixed an issue, but I'm not sure if it's the same issue that everyone is facing.

I think I have fixed the issue that @wantafanta and @FatRodzianko are seeing in a707517. Could you all re-pull and test out the fix?

@stlorenz I'm not sure if you are facing the same issue or not, could you re-test as well?

[wantafanta]

@cobbr seems to have fixed it for me, cheers!

[stlorenz]

LsaSecrets Completed admin LsaSecrets
Download Tasked admin Download t.exe

TBH, i just installed Covenant and this are my first steps. So maybe its just something dumb.
Maybe some more information:
Its running on a fresh Kali, neither Chrome or FF working.
Binary Launcher, HTTP Listener vs a fresh Win10 1903 in my Lab

[cobbr]

I can give another test on Kali, but I've never had any issues there. Strange, I would expect some error output from Covenant. Can you connect to Covenant's stdout and make sure there are isn't any output?

[stlorenz]

~/Covenant/Covenant# docker attach covenant

fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HLPOILSMCNHA", Request id "0HLPOILSMCNHA:0000000C": An unhandled exception was thrown by the application.
System.NullReferenceException: Object reference not set to an instance of an object.
   at Covenant.Views.Grunt.Views_Grunt_Interact.ExecuteAsync() in /app/Views/Grunt/Interact.cshtml:line 317
   at Microsoft.AspNetCore.Mvc.Razor.RazorView.RenderPageCoreAsync(IRazorPage page, ViewContext context)
   at Microsoft.AspNetCore.Mvc.Razor.RazorView.RenderPageAsync(IRazorPage page, ViewContext context, Boolean invokeViewStarts)
   at Microsoft.AspNetCore.Mvc.Razor.RazorView.RenderAsync(ViewContext context)
   at Microsoft.AspNetCore.Mvc.ViewFeatures.ViewExecutor.ExecuteAsync(ViewContext viewContext, String contentType, Nullable`1 statusCode)
   at Microsoft.AspNetCore.Mvc.ViewFeatures.ViewExecutor.ExecuteAsync(ActionContext actionContext, IView view, ViewDataDictionary viewData, ITempDataDictionary tempData, String contentType, Nullable`1 statusCode)
   at Microsoft.AspNetCore.Mvc.ViewFeatures.ViewResultExecutor.ExecuteAsync(ActionContext context, ViewResult result)
   at Microsoft.AspNetCore.Mvc.ViewResult.ExecuteResultAsync(ActionContext context)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeResultAsync(IActionResult result)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResultFilterAsync[TFilter,TFilterAsync]()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResultExecutedContext context)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.ResultNext[TFilter,TFilterAsync](State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeResultFilters()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResourceFilter()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResourceExecutedContext context)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeFilterPipelineAsync()
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAsync()
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)

[cobbr]

Thanks @stlorenz, the output is helpful.

I've retraced your steps and can't seem to reproduce the issue 🙁

Did you issue any commands outside of "LsaSecrets" and "Download"?

[wantafanta]

Hello, I had the same problem. I used Seatbelt, ScreenShot, BypassAmsim Mimikatz, GetSystem, WhoAmi

Fresh dotnet build on ubuntu 19.04

[stlorenz]

Steps to reproduce:
HTTP Lister running
Binary Launcher created for the Listener
Delivered to Grunt via Direct HTTP Download from Server
Grunt connects Covenant as expected.
Hop into Grunt, Interact, Run "ProcessList", output as expected.
Hop out of Grunt to a random page
Hop back, everything ok.

Run Command BypassUACGrunt t2.exe
Hop away and back
Blank Screen, Output from console as above.

The task is also missing in the GruntTaskings

[FatRodzianko]

I've had similar issues since pulling the latest version today. When I leave a grunt page and try to return to the grunt interaction page, I get an error message. It seems to happen to me after importing a powershell script.

The grunt is running from a powershell process. Used the powershell encoded launcher.
Covenant is running on Windows Server 2016.

Here is the error message. It mentions the screenshot task, which I did not run.

Covenant.Views.Grunt.Views_Grunt_Interact.ExecuteAsync() in Interact.cshtml
+ 
321.                                        if (command.GruntTasking.GruntTask.Name == "ScreenShot")

[FatRodzianko]

Fixed for me as well. Thanks so much!

[stlorenz]

Sorry, Not for me but some more output:
warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'orderby [_g.ReferenceSourceLibrary].GetValue(1) asc, [_g.ReferenceSourceLibrary].GetValue(0) asc' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1))' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'Take(1)' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1))' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'Take(1)' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'join AnonymousObject _T in {from GruntTask T in value(Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryable1[Covenant.Models.Grunts.GruntTask]) where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1)) orderby EF.Property(?[T]?, "Id") asc select new AnonymousObject(new [] {Convert(EF.Property(?[T]?, "Id"), Object)}) => Take(1)} on Property([T.GruntTaskReferenceSourceLibraries], "GruntTaskId") equals Convert([_T].GetValue(0), Nullable1)' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'Distinct()' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1))' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'Take(1)' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1))' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'Take(1)' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'join AnonymousObject _T in {from GruntTask T in value(Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryable1[Covenant.Models.Grunts.GruntTask]) where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1)) orderby EF.Property(?[T]?, "Id") asc select new AnonymousObject(new [] {Convert(EF.Property(?[T]?, "Id"), Object)}) => Take(1)} on Property([T.GruntTaskReferenceSourceLibraries], "GruntTaskId") equals Convert([_T].GetValue(0), Nullable1)' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'Distinct()' could not be translated and will be evaluated locally. warn: Microsoft.EntityFrameworkCore.Query[20500] The LINQ expression 'join AnonymousObject _g.ReferenceSourceLibrary in {from GruntTaskReferenceSourceLibrary T.GruntTaskReferenceSourceLibraries in value(Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryable1[Covenant.Models.Grunts.GruntTaskReferenceSourceLibrary]) join ReferenceSourceLibrary g.ReferenceSourceLibrary in value(Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryable1[Covenant.Models.Grunts.ReferenceSourceLibrary]) on Property([T.GruntTaskReferenceSourceLibraries], "ReferenceSourceLibraryId") equals Property([g.ReferenceSourceLibrary], "Id") join AnonymousObject _T in {from GruntTask T in value(Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryable1[Covenant.Models.Grunts.GruntTask]) where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1)) orderby EF.Property(?[T]?, "Id") asc select new AnonymousObject(new [] {Convert(EF.Property(?[T]?, "Id"), Object)}) => Take(1)} on Property([T.GruntTaskReferenceSourceLibraries], "GruntTaskId") equals Convert([_T].GetValue(0), Nullable1) select new AnonymousObject(new [] {Convert(EF.Property(?[g.ReferenceSourceLibrary]?, "Id"), Object), [_T].GetValue(0)}) => Distinct()} on Property([g.ReferenceSourceLibrary.ReferenceSourceLibraryEmbeddedResources], "ReferenceSourceLibraryId") equals Convert([_g.ReferenceSourceLibrary].GetValue(0), Nullable1)' could not be translated and will be evaluated locally.
warn: Microsoft.EntityFrameworkCore.Query[20500]
The LINQ expression 'orderby [_g.ReferenceSourceLibrary].GetValue(1) asc, [_g.ReferenceSourceLibrary].GetValue(0) asc' could not be translated and will be evaluated locally.
warn: Microsoft.EntityFrameworkCore.Query[20500]
The LINQ expression 'where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1))' could not be translated and will be evaluated locally.
warn: Microsoft.EntityFrameworkCore.Query[20500]
The LINQ expression 'Take(1)' could not be translated and will be evaluated locally.
warn: Microsoft.EntityFrameworkCore.Query[20500]
The LINQ expression 'where ([T].Name.Equals(__name_0, OrdinalIgnoreCase) OrElse [T].AlternateNames.Contains(__name_0, __OrdinalIgnoreCase_1))' could not be translated and will be evaluated locally.
warn: Microsoft.EntityFrameworkCore.Query[20500]
The LINQ expression 'Take(1)' could not be translated and will be evaluated locally.
`

[cobbr]

@stlorenz I actually don't see any error output there. Those are just expected warnings. Are you still getting an error on the page? Is there any output lines that start with fail:?

[stlorenz]

After complete rebuild seems to be fixed for as well

[cobbr]

Awesome! Let me know if the issue happens again @stlorenz