[Bug] CreateThread kills the Notion agent if there's no handler to catch the shellcode shell

[mttaggart]

[Bug] CreateThread kills the Notion agent if there's no handler to catch the shellcode shell

[HuskyHacks]

Have annotated this in https://github.com/mttaggart/OffensiveNotion/wiki/6.-Agent-Interaction#windows-inject-self but will continue to work on resolving the underlying issue

[HuskyHacks]

Reproduced under different conditions: I made some Cobalt Strike shellcode, tried to overwrite it, but ended up saving 0 bytes to a file by accident. When the self-injection happened, the agent "decoded" the 0 bytes, mapped the 0 bytes into memory, executed the thread, and died hard. Noted

Possible solution for this iteration: check to make sure there are more than 0 bytes during the shellcode download

[HuskyHacks]

I just had a eureka moment and I think this might happen because msfvenom generated shellcode defaults to ExitFunc=process. I will test this with ExitFunc=thread and see if that alters the behavior.

The second bug I mentioned (agent dies because of size 0 buffer of shellcode) is still something we need to handle.

[HuskyHacks]

I noticed that the script in the wiki uses Exitfunc=thread as an argument and it still kills the agent in the event of an unsuccessful self injection (this time it was a mismatch of B64 iterations given during decode) so that smashes my hypothesis to bits.