kyleavery/thirdeye

Weaponizing CLRvoyance for Post-Ex .NET Execution

thirdeye's Issues

FileNotFoundError: [Errno 2] No such file or directory: 'sc-64-clr-apc'

Hello Kyle, awesome webinar, i was following with very interest and quickly tested your code.
down below everything is running fine but if i use the swtich -s i get this error:

PS C:\temp\ThirdEye > python .\thirdeye.py C:\temp\cmdrbs.exe -e -s -p='currentluid'
msbuild wrapper/wrapper -p:TargetFrameworkVersion=v4.5 -p:Configuration="Release" -p:Platform="x64" /verbosity:quiet
Namespace(assembly='C:\temp\cmdrbs.exe', architecture='64', encode=True, newdomain=False, outfile='./out.bin', parameters='currentluid', safe=True)
Microsoft (R) Build Engine version 16.10.2+857e5a733 for .NET Framework
Copyright (C) Microsoft Corporation. All rights reserved.

Traceback (most recent call last):
File "C:\temp\ThirdEye\thirdeye.py", line 67, in
clrvoyance.run(cvArgs)
File "C:\temp\ThirdEye\CLRvoyance\CLRvoyance\clrvoyance.py", line 64, in run
bootstrap = open("sc-%s-clr-apc" % options.platform, 'rb').read()
FileNotFoundError: [Errno 2] No such file or directory: 'sc-64-clr-apc'

actually i see inside the CLRvoiaynce folder and even at the original code from Accenture is really missing that file.
environment is vm with windows 10 and vstudio 2019 , python 3.9.5
anything i do wrong ?
thanks