cobbr/Covenant

[Bug][Question] Covenant Team Server Memory Consumption

Open

#323 opened on Jun 8, 2021

 (2 comments) (0 reactions) (1 assignee)C# (825 forks)batch import
help wanted

Repository metrics

Stars
 (4,724 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

When using Covenant normally on a Ubuntu Server, after some time of use memory use spikes gradually until the oom_killer kills the Covenant process. I tried resizing the vm several times, from 4GB up to 16GB, but the problem persists and eventually covenant server crashes. I don't know if the HW requirements are not meeted in my scenario or there is a bug.

dmesg [2385505.072155] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/user.slice/user-0.slice/session-759.scope,task=Covenant,pid=210546,uid=0 [2385505.072259] Out of memory: Killed process 210546 (Covenant) total-vm:40059000kB, anon-rss:15893864kB, file-rss:0kB, shmem-rss:8kB, UID:0 pgtables:33284kB oom_score_adj:0 [2385505.384048] oom_reaper: reaped process 210546 (Covenant), now anon-rss:0kB, file-rss:0kB, shmem-rss:8kB

Describe the feature request or bug When using Covenant normally on a Ubuntu Server, after some time of use memory use spikes gradually until the oom_killer kills the Covenant process.

To Reproduce Steps to reproduce the behavior:

  1. Start covenant via detached screen screen -dmSL covenant sudo dotnet run -p /opt/Covenant/Covenant/Covenant.csproj
  2. Connect grunts to covenant In this case whe tested msbuild launcher
  3. Execute normal commands in the grunts
  4. Import powershell modules (like invoke-mimikatz.ps1, powerview.ps1, etc.)
  5. Execute modules locally or via remoting in other hosts 5'. Or Execute commands in a grunt
  6. The memory use spikes and Covenant proccess dies

Expected behavior Covenant server should not crash

Covenant Server Information: uname -a 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

mpstat Linux 5.4.0-72-generic (C2BE) 06/08/21 x86_64 (8 CPU) 14:27:20 CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle 14:27:20 all 0.69 0.00 0.21 0.08 0.00 0.01 0.00 0.00 0.00 99.01

This image is of covenant memory comsuption in idle status imagen

Browser Information:

  • Browser Chrome
  • Version Versión 91.0.4472.77 (Build oficial) (64 bits)

Target Information (System that implant is running on):

  • OS: Windows 10
  • Version Windows NT 10.0.19042.0

Additional context Looks like the problem gets worse when importing more than one powershell module. Y some cases after a few days of operation suddenly the memory comsumption spikes at every command executed in any grunt.

Contributor guide