Linux Server: panic: runtime error: invalid memory address or nil pointer dereference about merlin

[Ne0nd0g]

Thanks for reporting this error @robpot891 . I believe I fixed it in the dev branch. Please let me know if you have any additional bugs or obstacles.

[robpot891]

Hey, I didn't want to start a new thread so I came across this error in latest version:

Merlin[module][SharpUp]» run
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x80 pc=0x726326]

goroutine 6 [running]:
github.com/Ne0nd0g/merlin/pkg/agents.AddJob(0xffffffffffffffff, 0xffffffffffffffff, 0x832567, 0x3, 0xc420222120, 0x9, 0x9, 0x0, 0x0, 0x0, ...)
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:366 +0x506
github.com/Ne0nd0g/merlin/pkg/cli.Shell()
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/cli/cli.go:169 +0x21c6
created by main.main
/home/silas/merlin/cmd/merlinserver/main.go:67 +0x44e

Seems to be same error as last time. The new version is a lot more stable though and I only get this error on a few modules (csharp modules mostly).

[Ne0nd0g]

I wasn't able to reproduce the error you reported. I have the output of how I configured and executed the module. Could you please share with me all the steps you took to get the error so I can reproduce it?

[-]Starting h2 listener on 127.0.0.1:443
Merlin» use module windows/x64/csharp/privesc/SharpUp
Merlin[module][SharpUp]» set agent all
[+]agent set to ffffffff-ffff-ffff-ffff-ffffffffffff
Merlin[module][SharpUp]» run
[!]there are 0 available agents, no jobs were created
Merlin[module][SharpUp]» [+]Received new agent checkin from 7e9bf7b3-6aaf-4629-ab17-c26d7db89a7b
Merlin[module][SharpUp]» run
[-]Created job uxMFyYztOG for agent ffffffff-ffff-ffff-ffff-ffffffffffff
Merlin[module][SharpUp]» [+]Results for job uxMFyYztOG
[+]Microsoft (R) Visual C# Compiler version 4.7.3056.0
for C# 5
Copyright (C) Microsoft Corporation. All rights reserved.

This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language 
<snip>
Merlin[module][SharpUp]» set agent 7e9bf7b3-6aaf-4629-ab17-c26d7db89a7b
[+]agent set to 7e9bf7b3-6aaf-4629-ab17-c26d7db89a7b
Merlin[module][SharpUp]» run
[-]Created job DKudToisLJ for agent 7e9bf7b3-6aaf-4629-ab17-c26d7db89a7b
Merlin[module][SharpUp]» [+]Results for job DKudToisLJ
[+]Microsoft (R) Visual C# Compiler version 4.7.3056.0
for C# 5
<snip>

[robpot891]

I made the agents (sudo make all) and started the server (sudo ./merlinServer-Linux). No command line arguments on the server, but I used -url on agents to connect to listening server.

When I start the server, sometimes I get the banner then the listener drops and I'm back to the cli. However, when I type the words don't appear on the terminal. I have to close terminal to retry. This is strange but it's a separate issue (maybe not?).

I managed to recreate the error today when I tried upload a file from server to agent:

**Merlin[agent][f22083b0-4a99-4907-931d-38dec9c5c07a]» upload merlinAgent-Windows-x64.exe
[-]Created job hAugknuCDA for agent f22083b0-4a99-4907-931d-38dec9c5c07a
2018/09/09 00:19:24 http2: panic serving 192.168.0.147:53230: runtime error: index out of range
goroutine 464 [running]:
net/http.(*http2serverConn).runHandler.func1(0xc42000e058, 0xc4204b1faf, 0xc4204e2380)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5753 +0x190
panic(0x7b26e0, 0xa94710)
/usr/lib/go-1.10/src/runtime/panic.go:502 +0x229
github.com/Ne0nd0g/merlin/pkg/agents.GetMessageForJob(0x749994ab08320f2, 0x7ac0c5c9de381d93, 0xc42018b760, 0xa, 0x832e4e, 0x6, 0x83314d, 0x7, 0xc4202c0e90, 0x1, ...)
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:503 +0x1a62
github.com/Ne0nd0g/merlin/pkg/agents.StatusCheckIn(0xb08320f23f800000, 0xde381d930749994a, 0x7ac0c5c9, 0xc42018b8b0, 0xd, 0x7b3920, 0xc420164640, 0xc420252000, 0x1000, 0x0, ...)
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/agents/agents.go:208 +0x3b8
github.com/Ne0nd0g/merlin/pkg/servers/http2.agentHandler(0x8899a0, 0xc42000e058, 0xc4204e0600)
/home/silas/go/src/github.com/Ne0nd0g/merlin/pkg/servers/http2/http2.go:248 +0xcaf
net/http.HandlerFunc.ServeHTTP(0x852458, 0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/server.go:1947 +0x44
net/http.(*ServeMux).ServeHTTP(0xc4200a56b0, 0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/server.go:2337 +0x130
net/http.serverHandler.ServeHTTP(0xc4200a7e10, 0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/server.go:2694 +0xbc
net/http.initNPNRequest.ServeHTTP(0xc4200b2700, 0xc4200a7e10, 0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/server.go:3260 +0x9a
net/http.(Handler).ServeHTTP-fm(0x8899a0, 0xc42000e058, 0xc4204e0600)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5475 +0x4d
net/http.(http2serverConn).runHandler(0xc4204e2380, 0xc42000e058, 0xc4204e0600, 0xc4202c1040)
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5760 +0x89
created by net/http.(http2serverConn).processHeaders
/usr/lib/go-1.10/src/net/http/h2_bundle.go:5494 +0x46b

Didn't do anything out of the ordinary. I think this may be an issue with my computer specifically.

[Ne0nd0g]

It looks like the error is caused because you did not provide a path for the file to uploaded to on the host where the agent is running. That is my fault for not checking to make sure there are 3 arguments. I'll get it updated.