{"action":"created","issue":{"url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/136","repository_url":"https://api.github.com/repos/PowerShellEmpire/Empire","labels_url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/136/labels{/name}","comments_url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/136/comments","events_url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/136/events","html_url":"https://github.com/PowerShellEmpire/Empire/issues/136","id":134237907,"number":136,"title":"Agent Cannot Connect Due to Incorrect sysinfo Format","user":{"login":"qgrosperrin","id":456143,"avatar_url":"https://avatars.githubusercontent.com/u/456143?v=3","gravatar_id":"","url":"https://api.github.com/users/qgrosperrin","html_url":"https://github.com/qgrosperrin","followers_url":"https://api.github.com/users/qgrosperrin/followers","following_url":"https://api.github.com/users/qgrosperrin/following{/other_user}","gists_url":"https://api.github.com/users/qgrosperrin/gists{/gist_id}","starred_url":"https://api.github.com/users/qgrosperrin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qgrosperrin/subscriptions","organizations_url":"https://api.github.com/users/qgrosperrin/orgs","repos_url":"https://api.github.com/users/qgrosperrin/repos","events_url":"https://api.github.com/users/qgrosperrin/events{/privacy}","received_events_url":"https://api.github.com/users/qgrosperrin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-17T10:13:48Z","updated_at":"2016-02-24T02:43:33Z","closed_at":null,"body":"Here is the output from debug log (see last line specifically, nothing happen after that).\r\n```\r\n2016-02-17 10:04:38 HttpHandler : [*] /index.asp requested from None at X.X.X.X\r\n2016-02-17 10:04:38 Agents : [*] Sending stager (stage 1) to X.X.X.X\r\n2016-02-17 10:04:39 HttpHandler : [*] Post to /index.jsp from ATCBNAKH1KHX3WYS at X.X.X.X\r\n2016-02-17 10:04:39 Agents : [*] Agent ATCBNAKH1KHX3WYS from X.X.X.X posted to public key URI\r\n2016-02-17 10:04:39 Agents : [*] Agent ATCBNAKH1KHX3WYS from X.X.X.X posted valid RSA key\r\n2016-02-17 10:04:39 HttpHandler : [*] Post to /index.php from ATCBNAKH1KHX3WYS at X.X.X.X\r\n2016-02-17 10:04:39 Agents : [!] Agent ATCBNAKH1KHX3WYS posted invalid sysinfo checkin format\r\n```\r\n\r\nI'm using a simple launcher stager from a Windows 8.1 box. The listener is set up using the following:\r\n```\r\n(Empire: listeners) > info\r\n\r\nListener Options:\r\n\r\n  Name              Required    Value                            Description\r\n  ----              --------    -------                          -----------\r\n  KillDate          False                                        Date for the listener to exit (MM/dd/yyyy).\r\n  Name              True        test1                            Listener name.\r\n  DefaultLostLimit  True        60                               Number of missed checkins before exiting\r\n  StagingKey        True        7346f27f2a4207f0b9b62c1d1b2e7a4c Staging key for initial agent negotiation.\r\n  Type              True        native                           Listener type (native, pivot, hop, foreign, meter).\r\n  RedirectTarget    False                                        Listener target to redirect to for pivot/hop.\r\n  DefaultDelay      True        5                                Agent delay/reach back interval (in seconds).\r\n  WorkingHours      False                                        Hours for the agent to operate (09:00-17:00).\r\n  Host              True        http://X.X.X.X            Hostname/IP for staging.\r\n  CertPath          False                                        Certificate path for https listeners.\r\n  DefaultJitter     True        0.0                              Jitter in agent reachback interval (0.0-1.0).\r\n  DefaultProfile    True        /admin/get.php,/news.asp,/login/ Default communication profile for the agent.\r\n                                process.jsp|Mozilla/5.0 (Windows\r\n                                NT 6.1; WOW64; Trident/7.0;\r\n                                rv:11.0) like Gecko\r\n  Port              True        80                               Port for the listener.\r\n```\r\n\r\nI have confirmed it worked with the same listener by running the launcher on a Windows 7 box. The problem happens regardless of whether I use an HTTP or HTTPS handler.\r\n\r\nI have included the system info output from the Windows box (first empty line included).\r\n```\r\n\r\nHost Name:                 WIN-I76E10INHTB\r\nOS Name:                   Microsoft Windows 8.1 Pro\r\nOS Version:                6.3.9600 N/A Build 9600\r\nOS Manufacturer:           Microsoft Corporation\r\nOS Configuration:          Standalone Workstation\r\nOS Build Type:             Multiprocessor Free\r\nRegistered Owner:          Windows User\r\nRegistered Organization:   \r\nProduct ID:                00260-00107-97891-AA229\r\nOriginal Install Date:     11/24/2013, 2:24:42 PM\r\nSystem Boot Time:          2/15/2016, 11:14:44 AM\r\nSystem Manufacturer:       VMware, Inc.\r\nSystem Model:              VMware Virtual Platform\r\nSystem Type:               x64-based PC\r\nProcessor(s):              1 Processor(s) Installed.\r\n                           [01]: Intel64 Family 6 Model 58 Stepping 9 GenuineIntel ~2494 Mhz\r\nBIOS Version:              Phoenix Technologies LTD 6.00, 7/31/2013\r\nWindows Directory:         C:\\Windows\r\nSystem Directory:          C:\\Windows\\system32\r\nBoot Device:               \\Device\\HarddiskVolume1\r\nSystem Locale:             en-us;English (United States)\r\nInput Locale:              en-us;English (United States)\r\nTime Zone:                 (UTC) Dublin, Edinburgh, Lisbon, London\r\nTotal Physical Memory:     4,095 MB\r\nAvailable Physical Memory: 2,696 MB\r\nVirtual Memory: Max Size:  5,561 MB\r\nVirtual Memory: Available: 3,757 MB\r\nVirtual Memory: In Use:    1,804 MB\r\nPage File Location(s):     C:\\pagefile.sys\r\nDomain:                    WORKGROUP\r\nLogon Server:              \\\\WIN-I76E10INHTB\r\nHotfix(s):                 252 Hotfix(s) Installed.\r\n                           [01]: KB2899189_Microsoft-Windows-CameraCodec-Package\r\n                           [02]: KB2693643\r\n                           [03]: KB2868626\r\n                           [04]: KB2883200\r\n                           [05]: KB2887595\r\n                           [06]: KB2894852\r\n                           [07]: KB2894856\r\n                           [08]: KB2903939\r\n                           [09]: KB2904440\r\n                           [10]: KB2911106\r\n                           [11]: KB2919355\r\n                           [12]: KB2919394\r\n                           [13]: KB2919442\r\n                           [14]: KB2920189\r\n                           [15]: KB2928680\r\n                           [16]: KB2934520\r\n                           [17]: KB2938066\r\n                           [18]: KB2954879\r\n                           [19]: KB2955164\r\n                           [20]: KB2959626\r\n                           [21]: KB2962409\r\n                           [22]: KB2962806\r\n                           [23]: KB2965142\r\n                           [24]: KB2965500\r\n                           [25]: KB2966826\r\n                           [26]: KB2966828\r\n                           [27]: KB2967917\r\n                           [28]: KB2968296\r\n                           [29]: KB2969339\r\n                           [30]: KB2971203\r\n                           [31]: KB2972103\r\n                           [32]: KB2972213\r\n                           [33]: KB2973114\r\n                           [34]: KB2973351\r\n                           [35]: KB2975061\r\n                           [36]: KB2975719\r\n                           [37]: KB2976627\r\n                           [38]: KB2976978\r\n                           [39]: KB2977629\r\n                           [40]: KB2977765\r\n                           [41]: KB2978041\r\n                           [42]: KB2978122\r\n                           [43]: KB2978126\r\n                           [44]: KB2984006\r\n                           [45]: KB2987107\r\n                           [46]: KB2989647\r\n                           [47]: KB2989930\r\n                           [48]: KB2990967\r\n                           [49]: KB2993100\r\n                           [50]: KB2994290\r\n                           [51]: KB2995004\r\n                           [52]: KB2995388\r\n                           [53]: KB2996799\r\n                           [54]: KB2998174\r\n                           [55]: KB2999226\r\n                           [56]: KB3000850\r\n                           [57]: KB3003057\r\n                           [58]: KB3003667\r\n                           [59]: KB3004361\r\n                           [60]: KB3004365\r\n                           [61]: KB3004394\r\n                           [62]: KB3004545\r\n                           [63]: KB3008923\r\n                           [64]: KB3012199\r\n                           [65]: KB3012235\r\n                           [66]: KB3012702\r\n                           [67]: KB3013172\r\n                           [68]: KB3013531\r\n                           [69]: KB3013538\r\n                           [70]: KB3013769\r\n                           [71]: KB3013791\r\n                           [72]: KB3013816\r\n                           [73]: KB3014442\r\n                           [74]: KB3015696\r\n                           [75]: KB3018133\r\n                           [76]: KB3018467\r\n                           [77]: KB3019978\r\n                           [78]: KB3020338\r\n                           [79]: KB3020370\r\n                           [80]: KB3021910\r\n                           [81]: KB3021952\r\n                           [82]: KB3022345\r\n                           [83]: KB3022777\r\n                           [84]: KB3023219\r\n                           [85]: KB3023222\r\n                           [86]: KB3024751\r\n                           [87]: KB3024755\r\n                           [88]: KB3025417\r\n                           [89]: KB3029432\r\n                           [90]: KB3029603\r\n                           [91]: KB3029606\r\n                           [92]: KB3030377\r\n                           [93]: KB3030947\r\n                           [94]: KB3032359\r\n                           [95]: KB3032663\r\n                           [96]: KB3033446\r\n                           [97]: KB3034348\r\n                           [98]: KB3035126\r\n                           [99]: KB3035132\r\n                           [100]: KB3035487\r\n                           [101]: KB3035527\r\n                           [102]: KB3035583\r\n                           [103]: KB3036612\r\n                           [104]: KB3037576\r\n                           [105]: KB3037579\r\n                           [106]: KB3037924\r\n                           [107]: KB3038002\r\n                           [108]: KB3038314\r\n                           [109]: KB3038701\r\n                           [110]: KB3041857\r\n                           [111]: KB3042058\r\n                           [112]: KB3042085\r\n                           [113]: KB3042553\r\n                           [114]: KB3044374\r\n                           [115]: KB3044673\r\n                           [116]: KB3045634\r\n                           [117]: KB3045685\r\n                           [118]: KB3045717\r\n                           [119]: KB3045719\r\n                           [120]: KB3045755\r\n                           [121]: KB3045992\r\n                           [122]: KB3045999\r\n                           [123]: KB3046017\r\n                           [124]: KB3046359\r\n                           [125]: KB3046480\r\n                           [126]: KB3046737\r\n                           [127]: KB3047254\r\n                           [128]: KB3048043\r\n                           [129]: KB3049563\r\n                           [130]: KB3053863\r\n                           [131]: KB3054169\r\n                           [132]: KB3054256\r\n                           [133]: KB3054464\r\n                           [134]: KB3055323\r\n                           [135]: KB3055343\r\n                           [136]: KB3055642\r\n                           [137]: KB3056347\r\n                           [138]: KB3058168\r\n                           [139]: KB3058515\r\n                           [140]: KB3059316\r\n                           [141]: KB3059317\r\n                           [142]: KB3060716\r\n                           [143]: KB3060746\r\n                           [144]: KB3060793\r\n                           [145]: KB3061493\r\n                           [146]: KB3061512\r\n                           [147]: KB3062760\r\n                           [148]: KB3063843\r\n                           [149]: KB3064059\r\n                           [150]: KB3064209\r\n                           [151]: KB3065013\r\n                           [152]: KB3065822\r\n                           [153]: KB3065988\r\n                           [154]: KB3067505\r\n                           [155]: KB3068708\r\n                           [156]: KB3071663\r\n                           [157]: KB3071756\r\n                           [158]: KB3072019\r\n                           [159]: KB3072307\r\n                           [160]: KB3072630\r\n                           [161]: KB3072633\r\n                           [162]: KB3074228\r\n                           [163]: KB3074545\r\n                           [164]: KB3074548\r\n                           [165]: KB3075220\r\n                           [166]: KB3075249\r\n                           [167]: KB3075853\r\n                           [168]: KB3076949\r\n                           [169]: KB3077715\r\n                           [170]: KB3078071\r\n                           [171]: KB3078405\r\n                           [172]: KB3078676\r\n                           [173]: KB3079318\r\n                           [174]: KB3080042\r\n                           [175]: KB3080149\r\n                           [176]: KB3080800\r\n                           [177]: KB3082089\r\n                           [178]: KB3083325\r\n                           [179]: KB3083711\r\n                           [180]: KB3083992\r\n                           [181]: KB3084135\r\n                           [182]: KB3084905\r\n                           [183]: KB3086255\r\n                           [184]: KB3087038\r\n                           [185]: KB3087039\r\n                           [186]: KB3087040\r\n                           [187]: KB3087041\r\n                           [188]: KB3087088\r\n                           [189]: KB3087137\r\n                           [190]: KB3087916\r\n                           [191]: KB3088195\r\n                           [192]: KB3089023\r\n                           [193]: KB3091297\r\n                           [194]: KB3092601\r\n                           [195]: KB3092627\r\n                           [196]: KB3093983\r\n                           [197]: KB3095108\r\n                           [198]: KB3095701\r\n                           [199]: KB3096433\r\n                           [200]: KB3097966\r\n                           [201]: KB3097992\r\n                           [202]: KB3097997\r\n                           [203]: KB3098779\r\n                           [204]: KB3099406\r\n                           [205]: KB3099834\r\n                           [206]: KB3099864\r\n                           [207]: KB3100773\r\n                           [208]: KB3100919\r\n                           [209]: KB3100956\r\n                           [210]: KB3102429\r\n                           [211]: KB3102812\r\n                           [212]: KB3102939\r\n                           [213]: KB3103688\r\n                           [214]: KB3103696\r\n                           [215]: KB3104002\r\n                           [216]: KB3105216\r\n                           [217]: KB3107998\r\n                           [218]: KB3108381\r\n                           [219]: KB3109094\r\n                           [220]: KB3109103\r\n                           [221]: KB3109560\r\n                           [222]: KB3109853\r\n                           [223]: KB3110329\r\n                           [224]: KB3112148\r\n                           [225]: KB3112336\r\n                           [226]: KB3115858\r\n                           [227]: KB3119147\r\n                           [228]: KB3121918\r\n                           [229]: KB3122651\r\n                           [230]: KB3122654\r\n                           [231]: KB3123294\r\n                           [232]: KB3123479\r\n                           [233]: KB3123862\r\n                           [234]: KB3124001\r\n                           [235]: KB3124275\r\n                           [236]: KB3124280\r\n                           [237]: KB3126041\r\n                           [238]: KB3126434\r\n                           [239]: KB3126446\r\n                           [240]: KB3126587\r\n                           [241]: KB3126593\r\n                           [242]: KB3127222\r\n                           [243]: KB3127226\r\nNetwork Card(s):           1 NIC(s) Installed.\r\n                           [01]: Intel(R) 82574L Gigabit Network Connection\r\n                                 Connection Name: Ethernet0\r\n                                 DHCP Enabled:    No\r\n                                 IP address(es)\r\nHyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed.\r\n```\r\n\r\nAlso, is there a way to enable debug output into the console directly rather than in a log file ?\r\n\r\nEdit: Not sure if that matters but the Win8.1 box is not connected to a domain while the Win7 box is."},"comment":{"url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/comments/188028160","html_url":"https://github.com/PowerShellEmpire/Empire/issues/136#issuecomment-188028160","issue_url":"https://api.github.com/repos/PowerShellEmpire/Empire/issues/136","id":188028160,"user":{"login":"HarmJ0y","id":5504523,"avatar_url":"https://avatars.githubusercontent.com/u/5504523?v=3","gravatar_id":"","url":"https://api.github.com/users/HarmJ0y","html_url":"https://github.com/HarmJ0y","followers_url":"https://api.github.com/users/HarmJ0y/followers","following_url":"https://api.github.com/users/HarmJ0y/following{/other_user}","gists_url":"https://api.github.com/users/HarmJ0y/gists{/gist_id}","starred_url":"https://api.github.com/users/HarmJ0y/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HarmJ0y/subscriptions","organizations_url":"https://api.github.com/users/HarmJ0y/orgs","repos_url":"https://api.github.com/users/HarmJ0y/repos","events_url":"https://api.github.com/users/HarmJ0y/events{/privacy}","received_events_url":"https://api.github.com/users/HarmJ0y/received_events","type":"User","site_admin":false},"created_at":"2016-02-24T02:43:33Z","updated_at":"2016-02-24T02:43:33Z","body":"If there's no response within a few days we'll mark this issue as closed."}}